After mandatory cyber awareness for city employees, leadership asks whether behavior improved. Which metrics should be collected?
Select an answer to reveal the explanation.
Short Explanation
Finishing the course is step one; changing behavior is the goal. Track completion and things like report-vs-click rates. Catering costs, slide counts, and rumors do not prove awareness worked.
Full Explanation
Training and awareness process data should include completion rates plus indicators of behavioral change. After mandatory cyber awareness for city employees, leadership cannot judge effectiveness from attendance alone; they need completion metrics and behavioral measures such as phishing report rates and click trends over time. Those combined measures show whether people finished the training and whether risky or protective behaviors moved afterward—fulfilling Domain 6 expectations for collecting process data on awareness programs.
The catering budget for a kickoff lunch is a cost detail, not a learning or risk metric. The number of slides in the deck regardless of attendance measures content bulk, not reach or impact. Anonymous rumors about who ‘probably’ learned something are unusable for management decisions and cannot be audited.
Exam caveat: Awareness effectiveness pairs participation with behavior metrics. Prefer answers that include both completion and phish-related behavioral trends when leadership asks whether behavior improved.
Operational check: Report mandatory completion by department, overlay phish click and report trends for the same periods, set targets, investigate departments that complete training yet still click at high rates, and feed results into the city’s security management review.