It is generally understood by the IT security professional community that people are one of the weakest links in attempts to secure systems and networks. It is also understood that the “people factor” – not technology – is the key to providing an adequate and appropriate level of security. A robust and entity-wide awareness and training program is the key to ensuring that people understand their IT security responsibilities and understand that they will be held accountable for the proper use and protection of IT resources entrusted to them.

This document can be used as a general guide to help companies design and implement a security training and awareness program.