After launching security awareness for new hires, leadership asks whether training stays effective over time. What should the program measure and schedule?
Select an answer to reveal the explanation.
Short Explanation
Train once and ghost the metrics? That’s how habits fade. Track who finished, whether it worked, and bring people back for recaps on a real cadence.
Full Explanation
Awareness effectiveness over time requires measurement and cadence. Programs should track completion and effectiveness metrics and deliver both initial onboarding training and recurring awareness cycles. Completion shows coverage; effectiveness measures such as quiz results, simulation performance, and related incident trends show whether behaviors improved. Refreshers fight fade and address new threats municipal workers face as tools and tactics change.
One lifetime session with no metrics and no refresher guarantees decay and leaves auditors without proof of ongoing diligence. Optional training only for executives with no management reporting leaves the broader workforce untrained and leadership blind to gaps. Random unannounced firings instead of monitoring outcomes is punitive theater, not a training program, and destroys the trust needed for a healthy reporting culture.
Exam caveat: SY0-701 expects onboarding plus recurring training with metrics—not one-and-done sessions or punitive substitutes for measurement and improvement.
Operational check: define KPIs (percent trained on time, phish report rate, repeat-click rate), report them to management monthly or quarterly, auto-assign refreshers on a set cycle and after major incidents, and remediate low-effectiveness pockets with targeted modules rather than silence or scare tactics.