Even the most skilled and equipped team of cybersecurity professionals can’t effectively protect the rest of the workforce unless all employees—from top to bottom—embrace a culture of security. A culture of security is part of a broader organizational culture, incorporating behaviors, principles and values that contribute to the attitudes of employees toward security programs and policies.

Does your organization have a Security Education Training Awareness (SETA) program? Let's explor some useful information on how to setup a SETA program.

Education | Training| Awareness

• Education: Integrating skills and knowledge competencies into a common body of knowledge.
• Training: Building meaningful knowledge and developing skills. Applying knowledge and skills to scenarios.
• Awareness: Receiving information passively.

key Components When Developing a SETA Program:

• Review your existing organizational policy to ensure program alignment
• Define a scope and establish learning objectives
• Avoid technical jargons and make training relatable to your audience
• Incorporate timing and frequency of your communications
• Differentiate your audience to better cater your program to different groups
• Define program deployment methods
• Define roles and responsibilities of personnel involved in your program
• Measure effectiveness of the program using metrics
• Evaluate and update your training materials

SETA Plan Development Checklist:

• Upper Management Approval
• Communications Details
• Budget and Cost Estimate
• Program Charter
• List of Tools and Technologies

Regulatory Compliance Requirements:

Compliance:

• NIST RMF
• ISO-27001
• NIST 800-53
• PCI-DSS

Regulation:

• FERPA
• FISMA
• GLBA
• HIPPA