Security awareness and training metrics measure the effectiveness of cybersecurity education programs through participation, training frequency, and phishing-simulation results. They support continuous improvement by showing strengths, gaps, and progress in organizational security practices. section 6.4.1 section 7.9
Track the program with complementary measures:
- Percentage of employees trained: include training during onboarding, repeat it annually, and use incomplete coverage to focus compliance efforts. section 6.4.1
- Training frequency: monitor how regularly awareness sessions occur as part of ongoing program improvement. section 6.4.1
- Phishing simulation results: count messages marked as spam, opened, clicked, or used to submit requested compromising data. section 6.4.1
- Retraining response: conduct mandatory retraining after a failed phishing simulation and use failures to target improvement. section 6.4.1
Quarterly phishing review
A quarterly simulation sends mock emails and records spam reports, opens, clicks, and compromising submissions. Employees who fail receive mandatory retraining, while the results identify where awareness efforts need strengthening. section 6.4.1
