Security Awareness Training: Building a Cyber-Aware Organisation

NIS2 establishes two distinct training obligations that organisations must address. Article 20(2) requires members of the management body to undergo training to gain sufficient knowledge and skills to identify risks, assess cybersecurity risk-management practices, and evaluate their impact on the services provided by the entity. This is a personal obligation on board members and C-suite executives — it cannot be satisfied by delegating attendance to subordinates or by passive awareness campaigns. Article 21(2)(g) separately requires basic cyber hygiene practices and cybersecurity training for all employees, establishing a general workforce training obligation that complements the management-level requirement.

DORA reinforces and extends these training requirements for financial entities. Article 13(6) requires financial entities to develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. The training must be proportionate to the functions performed and the entity's ICT risk profile, and must be adapted for critical ICT third-party service providers where relevant. The European Supervisory Authorities' RTS further specify that training programmes must cover ICT-related incident identification and reporting, business continuity procedures, and the entity's ICT risk management framework — moving beyond generic awareness into operationally specific training content.

GDPR Article 39(1)(b) assigns the Data Protection Officer the task of monitoring compliance including the assignment of responsibilities, awareness-raising, and training of staff involved in processing operations. While GDPR does not prescribe training frequency or format, the accountability principle (Article 5(2)) and the requirement for appropriate technical and organisational measures (Article 32) together create an expectation that staff handling personal data receive adequate data protection training. For organisations subject to all three frameworks, the training programme must satisfy each framework's specific requirements — a single, well-designed programme can address all three, but only if it is structured to cover the distinct topics and audiences each framework demands.

Measuring the effectiveness of security awareness training is essential for both operational improvement and regulatory compliance. Supervisory authorities under NIS2 and DORA will assess not just whether training exists, but whether it demonstrably changes behaviour. The two primary measurement mechanisms are phishing simulations and knowledge assessments, and an effective programme uses both in combination.

Phishing simulations provide the most operationally relevant metric: how do employees actually behave when confronted with a simulated attack? Deploy monthly phishing simulations using progressively sophisticated scenarios — start with obvious phishing indicators (misspelled domains, generic greetings, urgency pressure) and advance to targeted spear-phishing scenarios that mimic real attack patterns observed in your sector. Track three key metrics: click rate (percentage of users who click the malicious link or open the attachment), report rate (percentage who report the simulation through your incident reporting channel), and susceptibility trend (how click and report rates change over time). A mature programme targets a click rate below 5% and a report rate above 60%. Users who fail simulations should receive immediate just-in-time training — a brief module explaining what indicators they missed, delivered within seconds of the click.

Knowledge assessments complement phishing simulations by measuring cognitive understanding of security concepts. Deploy assessments at the end of each training module to verify comprehension, and conduct annual baseline assessments to track organisational knowledge levels over time. Structure assessments as scenario-based questions rather than rote knowledge tests — asking "what would you do if you received an email requesting urgent wire transfer from a colleague" tests applied knowledge, while asking "what is the definition of phishing" tests only recall. Track pass rates, repeat-failure rates, and topic-specific scores to identify areas where additional training investment is needed. Document all measurement results with timestamps and participant records — this evidence directly supports NIS2 Article 21(2)(g) compliance and DORA Article 13(6) training programme effectiveness requirements.

A security awareness training programme requires formal governance to ensure it remains effective, current, and aligned with regulatory requirements. Assign programme ownership to a senior role — typically the CISO, Head of Security, or DPO (for GDPR-focused training components). The programme owner is responsible for content currency, delivery execution, effectiveness measurement, and regulatory alignment. Establish an annual programme review cycle that assesses: whether training content reflects the current threat landscape and regulatory requirements, whether delivery mechanisms are reaching all required audiences, whether effectiveness metrics demonstrate improvement over the previous period, and whether the programme satisfies audit and supervisory expectations.

Content must be updated at least annually and more frequently when significant changes occur. Trigger events for content updates include: new regulatory requirements or supervisory guidance (such as NCA-published training expectations), significant changes to the organisation's threat landscape (new attack techniques targeting your sector), internal incidents that reveal training gaps, changes to organisational IT environment (new cloud platforms, remote working policies, BYOD programmes), and employee feedback indicating content is not relevant or engaging. Stale training content is worse than useless — it signals to employees that security is a check-box exercise rather than an operational priority, undermining the cultural change that effective awareness training seeks to achieve.

Integrate the training programme into your broader security culture initiatives. Training alone does not create a security-aware organisation — it must be reinforced by leadership behaviour, security champions within business units, visible recognition of good security practices (employees who report phishing attempts), and a blame-free reporting culture where employees report incidents without fear of punishment. The combination of formal training, continuous phishing simulations, management body engagement, and cultural reinforcement produces a security awareness posture that is both regulatory-compliant and operationally effective. Measure cultural indicators alongside training metrics: incident reporting volume (higher is better — it means people are noticing and reporting), time-to-report for security events, and employee survey results on security culture questions.