Leadership asserts 'we have training' but never tracks phishing click rates or other behavior-change indicators. What does an effective awareness program require?
Select an answer to reveal the explanation.
Short Explanation
Having a course on the shelf isn't the same as changing habits. Measure the clicks, the reports, the near-misses—attendance is just a headcount. If you never score the game, you don't know if training works.
Full Explanation
An effective awareness program evaluates results with metrics such as phishing click rates, report rates, and observable behavior change—not merely proof that training exists or that staff opened an LMS title. Leadership claims of 'we have training' without outcome measures cannot demonstrate control effectiveness or guide improvement. Eliminating metrics based on a blanket privacy claim is usually overbroad; aggregated phishing metrics can be designed with appropriate privacy safeguards. Counting slides authored measures production activity, not whether employees resist or report attacks. Municipal programs need feedback loops: if click rates stay high in finance or permitting, content and coaching should target those behaviors. Exam caveat: CISSP awareness and training include evaluating program effectiveness, not stopping at attendance or course catalogs. Operational check: define KPIs (click rate, report rate, time-to-report, repeat offenders), review them on a fixed cadence, protect individual privacy in reporting, and tie poor metrics to targeted interventions rather than only more slides. Present trend lines to leadership so 'we have training' is replaced with evidence of improving or lagging behaviors.