User awareness makes employees aware of security threats and risks without constituting formal training. It supports the principle that security is everyone’s responsibility, including non-IT staff. section 11.0 section 11.2.2
Distinguish the main security program elements:
- User awareness uses reminders or realistic tests to keep threats such as phishing at the forefront of employees’ minds. section 11.2.2
- User training is more formal, often mandatory, and teaches corporate security policies or methods for avoiding social engineering attacks. section 11.2.2
- Physical access control protects systems and data by restricting entry to authorized users. section 11.2.2
False phishing email
An organization sends a harmless simulated phishing email. Employees who click the link and submit credentials are informed that the exercise was part of user awareness and are reminded to treat deceptive messages cautiously. section 11.2.2
