Security Awareness
What is Security Awareness?
The knowledge and understanding that employees have about cybersecurity threats and their role in protecting organizational information assets.
Terms that appear alongside security awareness
Each of these is named in at least one of the same controls as security awareness. The number is how many controls name both.
- security awareness training 25 shared controls
- information security 9 shared controls
- phishing 8 shared controls
- nist 7 shared controls
- security training 6 shared controls
- cybersecurity 6 shared controls
- personnel security 6 shared controls
- risk assessment 5 shared controls
Frameworks that govern security awareness
What the standards actually require on security awareness
Requirements naming security awareness across 6 standards, quoted from the control text.
Agencies must build information security awareness training into the induction programmes for new employees.
new-zealand-information-security-manual-nzism::9.1.5.C.02 · 9.1.5.C.02 Security awareness training included in staff induction →A formal security awareness program must be in place so that all personnel know the entity's security policy and its procedures, and understand their own part in protecting cardholder data.
12.6.1 · 12.6.1 Formal security awareness program →A cyber security awareness training register is developed, implemented and maintained.
ISM-2022 · Cyber security awareness training register →In the low impact cyber security plan, reinforce cyber security practices, which may include associated physical security practices, at least once every 15 calendar months.
nerc-cip::CIP-003 R2 Att1 S1 · CIP-003-9 R2 Att1 S1: Low impact plan Section 1: cyber security awareness →Requirement 0024 (Part One: Governance, section 3.5 Security Planning, Incidents and Training; applies to All entities; dated 31 October 2024;
protective-security-policy-framework-pspf-release-2026::0024 · 0024 Security awareness training at engagement and annually →Provide security awareness and skills training tailored to specific roles, for example secure systems administration courses for IT staff, OWASP Top 10 awareness and prevention training for web developers, and advanced social engineering awareness for high-pro...
CIS-14.9 · Conduct Role-Specific Security Awareness and Skills Training →Questions people ask about security awareness
What is Security Awareness?
Why is Security Awareness important for compliance?
Which compliance frameworks address Security Awareness?
Where can I learn more about Security Awareness?
See how Security Awareness applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.