After mandatory cyber awareness for city employees, leadership asks whether behavior improved. Which metrics should be collected?
Select an answer to reveal the explanation.
Short Explanation
Finishing the course is step one; changing behavior is the goal. Track completion and things like report-vs-click rates. Catering costs, slide counts, and rumors do not prove awareness worked.
Full Explanation
Training and awareness process data should include completion and indicators of behavioral change, such as phishing report and click metrics. Those measures let management judge program effectiveness. Budget trivia, slide counts without attendance outcomes, and rumor-based assessments do not provide reliable evidence for security process review.