AR-in-a-Box - Building a Custom Cyber Awareness Program

Sep 23, 2026

Upload by Melati

AR-in-a-Box outlines how to build a custom cyber awareness program spanning multiple activities over a long period, aligned with an organization’s cybersecurity strategy. It explains why organizations need employee-focused training due to evolving threats and social engineering that can bypass technical defenses. The plan covers objectives, roles, target audience segmentation, behavior change methods, and program implementation steps, including evaluation and guidance for ISO 27001 clause 7.2.2 awareness training.

LanguageEnglish

CategoryPresentations

FormatPDF

Pages25

Reading Time9 min

AccessFree to download

Cyber Awareness Program

Why Have One

Still Not Sure? ISO 27001/2 & Awareness Training

How to Build the Program

Identify Objectives

Roles

Identify Target Audience

Change Behavior

AR-IN-A-BOX : BUILDING A CUSTOM CYBER AWARENESS PROGRAM Dimitra Liveri Team Leader for Awareness raising and Education 12 10 2022 CYBER AWARENESS PROGRAM A plan encompassing multiple awareness raising activities over a long period of time following the organizational strategy for cybersecurity • Teaches employees how to mitigate the impact of cyber threats. • Incorporates activities, materials and training to promote a culture of cyber security. WHY HAVE ONE? ➢ New threats are emerging. ➢ Organizations can no longer just rely on their technological defenses to be safe. ➢ Cybercriminals use sophisticated social engineering techniques to by-pass defenses. ➢ All it takes is one employee to click on a malicious link and it’s game over! ➢ Your employees are your first line of defense. A comprehensive Cyber Security Awareness program is the best way to educate staff and create a security-first culture. 3 STILL NOT SURE? ISO 27001/2 & Information Security Awareness Training For ISO 27001 compliance, it is essential to comply with clause 7.2.2 . 4 HOW TO BUILD THE PROGRAM Identify objectives Secure financial resources Ensure human resources Split your employees into target groups Choose the right implementation means Implement the program Evaluate the program 5 IDENTIFY OBJECTIVES • Evaluate the threat landscape and identifying your top risks. • Find or develop the right training. • Every organization has a different threat profile. • Be sure to cover: phishing, malware, and poor security practices. • Phishing is behind 71% of all cyber attacks worldwide. 6 Threat Landscape—ENISA (europa.eu) 7 ROLES Creating a team of Experts cultivates Culture Use rolling roles! • Management • Cyber Security Officer • Heads of Departments • Public Relations • ICT • HR • DPO / LEGAL 8 IDENTIFY TARGET AUDIENCE | | Audience groups |
Clustered audiences | | --- | --- | --- | | 1 | Generic Employee | | | 2 | Contractor | | | 3 | HR | Generic Employee | | 4 | Communications & Marketing | | | 5 | Legal | | | 6 | Operations & R&D | | | 7 | Finance & Procurement | | | 8 | Managers, Officers | C-Level, Decision Makers, Handling budgets | |
9 |
Head of Unit, Directors | | | 10 | Cybersecurity professionals | Professionals / Horizontal implementors of cybersecurity actions and users of cybersecurity solutions, working for organisations and/or | | 11 | IT professionals | individuals | 9 CHANGE BEHAVIOR • We are not in the ’00, forget boring classrooms. Employees need to be engaged • Training needs to be role-specific, tailored, fun, and address daily challenges • Make it Audience Specific • Provide easily consumable content (videos, realistic scenarios, quizzes, policies and real-world phishing simulation tests) • Utilize communications & marketing tools such as blogs, awareness posters • Break the culture barrier that cyber security is an IT thing 10

FAQs

What is the AR-in-a-Box cyber awareness program intended to achieve?

It is a long-term plan covering multiple awareness activities that teaches employees how to mitigate cyber threats and promotes a cyber-security culture through training, materials, and exercises.

Why does the program emphasize employee awareness rather than only technical defenses?

The content states that organizations can’t rely solely on technological defenses because new threats and sophisticated social engineering can succeed when one employee clicks a malicious link.

How should organizations structure the program?

The document outlines steps including identifying objectives, securing financial and human resources, splitting employees into target groups, implementing the program, and evaluating outcomes.

Sep 23, 2026

Upload by Melati