Annual sixty-slide PDF security training for city staff shows about two percent completion. Which change best improves awareness effectiveness?
Select an answer to reveal the explanation.
Short Explanation
A once-a-year slide mountain that nobody finishes isn't training—it's digital wallpaper. Switch to bite-sized modules, phishing drills, and local champions who make it real. Engagement beats page count.
Full Explanation
Security awareness effectiveness improves with engaging methods—short frequent modules, phishing simulations, and departmental champions—far more than lengthening an unread annual PDF. Two percent completion on a sixty-slide deck signals delivery failure; doubling slide count increases burden without fixing engagement. Making the PDF mandatory only for staff who already finished it rewards prior completers and ignores the vast incomplete population. Stopping awareness because completion is low abandons a required control family instead of redesigning it. Municipal workforces are diverse; microlearning, role-relevant scenarios, and local champions raise reach and retention for civic staff who will not sit through long static decks. Exam caveat: CISSP awareness and training emphasize effective communication methods and continuous reinforcement, not mere existence of lengthy content. Operational check: replace or supplement the annual PDF with short modules, run simulated phishing with coaching, appoint department champions, measure completion and behavior metrics, and iterate content based on results. Align topics to real municipal risks such as public-facing social engineering and improper handling of sensitive case or resident data.