A security program organizes policies, processes, education, and controls to manage organizational security. It treats security as everyone’s responsibility and addresses both technical and human vulnerabilities. section 11.0 section 11.2.2
The core security program elements are:
- User awareness: reminders and activities that help employees recognize threats and risks without constituting formal training. section 11.2.2
- User training: formal, often mandatory education about corporate security policies and how to avoid threats such as social engineering. section 11.2.2
- Physical access control: protection of facilities and equipment against unauthorized physical access. section 11.2.2
Simulated phishing awareness
An organization sends harmless false phishing emails. Employees who click and submit credentials are informed that the exercise was part of an awareness program and are reminded to respond more cautiously. section 11.2.2
