Awareness Procedure
Communications plan, talks, phishing campaigns and validation checklists for the Awareness Program
Purpose
Define the operational how of the Awareness Management Policy: the steps, roles and records needed to run the Information Security Awareness Program, from onboarding to the periodic validation of employee and leader performance.
Scope
Applies to all of the organization's employees, contractors and temporary staff, managed by the Information Security Team with support from HR and area leads.
Roles and Responsibilities
- Information Security Team: Designs the communications plan, runs talks and campaigns, and consolidates results.
- HR: Coordinates the onboarding talk as part of the onboarding process, and re-onboarding when applicable.
- Area lead: Applies the validation checklist to their team and reinforces good practices day to day.
- Employee: Takes part in talks, campaigns and assessments, and applies what they've learned.
1. Communications Plan
The Information Security Team defines and carries out a periodic communications plan (at least monthly) with short messages about current risks, good practices and policy reminders, distributed through the organization's internal channels.
2. Onboarding Talk
Every new employee receives, as part of their onboarding process (see the Talent Acquisition Procedure), an onboarding talk covering the basic principles of information security, acceptable use of assets and incident reporting channels, before or during their first week of work.
3. Cybersecurity Talks
Periodic talks (monthly or quarterly according to the program calendar) are held for all employees, going deeper into current risks, incident management, data protection and business continuity, in line with the standards of the Awareness Management Policy.
4. Phishing Campaigns
The Information Security Team runs simulated phishing campaigns on a regular basis to measure staff exposure. Employees who interact with the simulation receive immediate feedback and, if necessary, refresher training.
5. Employee Re-onboarding
Employees who change roles, return after a prolonged absence, or perform poorly in assessments or phishing campaigns are included in a re-onboarding process: a refresher session that reviews current policies and reinforces the security practices expected in their new context.
6. Validation Checklist
- Employee validation checklist: Each employee confirms receipt and understanding of the applicable policies, attendance at mandatory talks and participation in the program's campaigns.
- Leader-to-team validation checklist: Each area lead validates quarterly that their team completes the training, campaigns and individual checklists, and reports findings or gaps to the Information Security Team.
Related Documents
- Awareness Management Policy
- Talent Acquisition Procedure
- Human Resources Security Policy
- Communication Procedure and Plan
Monitoring and Review
The Information Security Team consolidates the results of talks, campaigns and checklists quarterly and reports them to management. The procedure is reviewed annually or upon relevant changes in risks, technology or program results.