Main Nav

Security Awareness Training Content - Primary vs. Reinforcement

In our last blog post, we discussed the challenges of awareness training that is compliance focused vs impact focused.  Compliance focused training has the primary goal of meeting compliance requirements, ensuring the organization can 'check the box' to meet certain standards (such as FERPA, GLBA, etc).  While important, my passion and goal is to go beyond just compliance and change behaviors, to make people and your organization more secure.  To do this I break awareness training down into two categories.

PRIMARY:  This is traditional annual awareness training.  The goal with primary training is to teach new topics and concepts, often in the form of online training or onsite workshops.  While this is a good way to communicate alot of information, people will forget over time.  Just like you have to patch a computer every month, so to do you have to patch a human, but remind them on key topics or learning objectives.

REINFORCEMENT:  This is where most awareness programs fail, they have no plan or structure to reinforce the primary training. Think about it, no company advertises their product only once, they constantly remind you in TV ads, Web adds, newsletters, etc.  The same is true for awareness.  However instead of selling a product, our goal is to communicate topics, to change behaviors.  As such we recommend organizations have a program that remind and reinforces these key topics at least once a month.  This can be in the form of newsletters, posters, screensavers, banners, webinars, podcasts, whatever works for your organization.    The goal is to focus in on and reinforce topics from the PRIMARY training.

Security awareness is a continous life-cycle, there is no end.  By combining both Primary and Reinforcement training you can more effectively not only remain compliant, but change key behaviors and create a more secure organization. 

Lance Spitzner is the Technical Director of the SANS Institute.  He works with organizations around the world helping them with their awareness programs.  You can follow him on Twitter @lspitzner or his blog at



This is an excellent topic. I think that not reinforcing awareness programs is where most efforts in this area fail. People do need to be "patched" regularly, just like software programs. It can be a lot of work and people may get bored with hearing and/or seeing the same message(s) so, the coordinator of these programs will need to be creative in order to grasp their audience's attention year after year.


Annual Conference
September 29–October 2
Register Now!

Events for all Levels and Interests

Whether you're looking for a conference to attend face-to-face to connect with peers, or for an online event for team professional development, see what's upcoming.


Digital Badges
Member recognition effort
Earn yours >

Career Center

Leadership and Management Programs

EDUCAUSE Institute
Project Management



Jump Start Your Career Growth

Explore EDUCAUSE professional development opportunities that match your career aspirations and desired level of time investment through our interactive online guide.


EDUCAUSE organizes its efforts around three IT Focus Areas



Join These Programs If Your Focus Is


Get on the Higher Ed IT Map

Employees of EDUCAUSE member institutions and organizations are invited to create individual profiles.



2014 Strategic Priorities

  • Building the Profession
  • IT as a Game Changer
  • Foundations

Learn More >

Uncommon Thinking for the Common Good™

EDUCAUSE is the foremost community of higher education IT leaders and professionals.