Main Nav

Security Awareness Training Content - Primary vs. Reinforcement

In our last blog post, we discussed the challenges of awareness training that is compliance focused vs impact focused.  Compliance focused training has the primary goal of meeting compliance requirements, ensuring the organization can 'check the box' to meet certain standards (such as FERPA, GLBA, etc).  While important, my passion and goal is to go beyond just compliance and change behaviors, to make people and your organization more secure.  To do this I break awareness training down into two categories.

PRIMARY:  This is traditional annual awareness training.  The goal with primary training is to teach new topics and concepts, often in the form of online training or onsite workshops.  While this is a good way to communicate alot of information, people will forget over time.  Just like you have to patch a computer every month, so to do you have to patch a human, but remind them on key topics or learning objectives.

REINFORCEMENT:  This is where most awareness programs fail, they have no plan or structure to reinforce the primary training. Think about it, no company advertises their product only once, they constantly remind you in TV ads, Web adds, newsletters, etc.  The same is true for awareness.  However instead of selling a product, our goal is to communicate topics, to change behaviors.  As such we recommend organizations have a program that remind and reinforces these key topics at least once a month.  This can be in the form of newsletters, posters, screensavers, banners, webinars, podcasts, whatever works for your organization.    The goal is to focus in on and reinforce topics from the PRIMARY training.

Security awareness is a continous life-cycle, there is no end.  By combining both Primary and Reinforcement training you can more effectively not only remain compliant, but change key behaviors and create a more secure organization. 

Lance Spitzner is the Technical Director of the SANS Institute.  He works with organizations around the world helping them with their awareness programs.  You can follow him on Twitter @lspitzner or his blog at



This is an excellent topic. I think that not reinforcing awareness programs is where most efforts in this area fail. People do need to be "patched" regularly, just like software programs. It can be a lot of work and people may get bored with hearing and/or seeing the same message(s) so, the coordinator of these programs will need to be creative in order to grasp their audience's attention year after year.