Build a cybersecurity learning program that changes behavior

Source fact: completion is only one program measure

NIST SP 800-50 Rev. 1 describes a cybersecurity and privacy learning program as a lifecycle with four phases: plan and strategy; analysis and design; development and implementation; and assessment and improvement. It replaces an event-centered view of annual awareness with a managed program tied to organizational mission, risks, roles, culture, and measurable outcomes. The publication is directed to federal organizations but explicitly offers a voluntary approach that other organizations can adapt.

The NIST learning-program guidance distinguishes broad awareness, role-based training, and education. It emphasizes leadership support, stakeholder involvement, communication, accessibility, evaluation, and continual improvement. A course-completion percentage can show delivery, but it does not establish that people recognize a threat, follow a procedure, or make a safer decision under pressure.

Design around roles and real decisions

Identify audiences by what they can affect. Everyone may need to report suspicious messages and protect credentials, while finance verifies payment changes, managers approve access, administrators protect privileged systems, developers handle secrets, facilities staff preserve physical evidence, and executives make crisis decisions. Contractors, temporary staff, vendors, and users requiring accessible or multilingual material need deliberate coverage.

Use incidents, audit findings, help-desk data, threat intelligence, business changes, and regulatory duties to define observable objectives. “Understand phishing” is vague; “report a simulated credential request through the approved channel without entering a password” can be practiced and measured. Select delivery methods that match the decision: short reminders for awareness, guided exercises for procedures, labs for technical skills, and tabletop scenarios for coordination.

DSE recommendation: operate a measured lifecycle

1. Name an executive sponsor and accountable program owner. Define scope, resources, required stakeholders, risk priorities, and the decisions the program is intended to improve.
2. Build a role-to-objective matrix covering new hires, role changes, recurring learning, incidents, long absences, and departure. Assign content owners and review dates.
3. Develop practical activities with current procedures, realistic tools, safe environments, accessibility checks, and a clear reporting or escalation path.
4. Pilot with representative users. Correct confusing instructions, inaccessible content, broken reporting routes, and scenarios that reward guessing rather than the intended behavior.
5. Combine delivery measures with outcome measures: completion and lateness; scenario choices; reporting quality and speed; exercise performance; recurring control failures; and help-desk trends.
6. Review results with business, security, privacy, HR, legal, and accessibility stakeholders. Record changes, owners, due dates, and evidence that the revised activity worked.

Avoid punitive metrics that discourage reporting or turn simulation results into a ranking without context. Segment results by role and scenario, protect personnel data, and look for process failures as well as individual mistakes. If employees repeatedly choose an unsafe workaround, improve the workflow and the learning together.