Developers and system administrators receive the same general awareness training as all other staff. Several recent incidents involved insecure code and misconfigured servers. What should the information security manager do?
Select an answer to reveal the explanation.
Short Explanation
Teaching a pilot and a passenger the same safety briefing makes sense for the seatbelt part, but only one of them needs to know how to land the plane. Your technical staff need training aimed at the mistakes they can make. The trap is more of the same generic content.
Full Explanation
General awareness training covers risks common to everyone, such as phishing and data handling, but it does not address the specialized risks created by people with technical privileges. Developers need secure coding practices relevant to the languages and frameworks they use, and administrators need secure configuration, privileged access and change practices. Role-based training targets these risks directly, and the recent incidents show exactly where the gap lies. Lengthening the general training for everyone adds cost and fatigue for the whole workforce while still not providing the technical depth that developers and administrators need. Removing those staff from general awareness entirely would leave them without baseline content that applies to them as much as anyone; role-based training supplements general awareness rather than replacing it. Requiring them to retake the general module repeats content that has already proven insufficient for their roles and would not change how they write code or configure servers. Exam caveat: CISM expects training to be tailored by role and risk, including privileged users, executives and third parties, with content linked to observed incidents and threats. Operational check: identify roles with elevated technical risk, map required training content to each, track completion, and measure change in related incidents or code and configuration findings.