Security Awareness
What is Security Awareness?
The knowledge and understanding that employees have about cybersecurity threats and their role in protecting organizational information assets.
Terms that appear alongside security awareness
Each of these is named in at least one of the same controls as security awareness. The number is how many controls name both.
- security awareness training 25 shared controls
- information security 9 shared controls
- phishing 8 shared controls
- nist 7 shared controls
- security training 6 shared controls
- cybersecurity 6 shared controls
- personnel security 6 shared controls
- risk assessment 5 shared controls
Frameworks that govern security awareness
What the standards actually require on security awareness
Requirements naming security awareness across 6 standards, quoted from the control text.
Personnel receive security awareness training upon hire and at least once every 12 months, covering threats and vulnerabilities including phishing, social engineering, and acceptable use.
12.6.3 · Security awareness training delivered →A cyber security awareness training register is developed, implemented and maintained.
ISM-2022 · A cyber security awareness training register is developed, implemented and maintained. →Conduct role-specific security awareness and skills training. Example implementations include secure system administration courses for IT professionals, (OWASP® Top 10 vulnerability awareness and prevention training for web application developers, and advanced...
CIS-14.9 · Conduct Role-Specific Security Awareness and Skills Training →Operate cyber hygiene + security awareness per OSFI B-13 Domain 5. Cyber hygiene must (a) maintain patch management with risk-based prioritisation + KEV-driven remediation + (b) configuration management with hardened baselines + drift detection + (c) vulnerabi...
OSFIB13-5 · Cyber Hygiene and Security Awareness →The applicant makes employees aware of the importance of maintaining the security of personal information, for example through regular training and oversight.
CBPR-PR-29 · Employee security awareness →Implement a security awareness programme for all personnel including role-based training for operational technology staff.
AWWA-1.3 · Security Awareness and Training →Questions people ask about security awareness
What is Security Awareness?
Why is Security Awareness important for compliance?
Which compliance frameworks address Security Awareness?
Where can I learn more about Security Awareness?
See how Security Awareness applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.