“Security Awareness” is explicitly required for ALL employees, whereas “Security Basics and Literacy” is required for those employees, including contractor employees, who are involved in any way with IT systems. In today’s environment this typically means all individuals within the organization.

Sicherheit; Awareness; SAK; Verhalten; Zielgruppe;

{nist800-16} 'Mark Wilson and Dorothea E. {de Zafra} and Sadie I. Pitcher and John D. Tressler and John B. Ippolito' (2003) : Information Technology Security Training Requirements: A Role- and Performance-Based Model

The “Security Basics and Literacy” category is a transitional stage between “Awareness” and “Training.” It provides the foundation for subsequent training by providing a universal baseline of key security terms and concepts.

Sicherheit; Awareness; SAK; Verhalten; Zielgruppe;

{nist800-16} 'Mark Wilson and Dorothea E. {de Zafra} and Sadie I. Pitcher and John D. Tressler and John B. Ippolito' (2003) : Information Technology Security Training Requirements: A Role- and Performance-Based Model

After “Security Basics and Literacy,” training becomes focused on providing the knowledges, skills, and abilities specific to an individual’s “Roles and Responsibilities Relative to IT Systems.” At this level, training recognizes the differences between beginning, intermediate, and advanced skill requirements.

Sicherheit; Awareness; SAK; Verhalten; Zielgruppe;

{nist800-16} 'Mark Wilson and Dorothea E. {de Zafra} and Sadie I. Pitcher and John D. Tressler and John B. Ippolito' (2003) : Information Technology Security Training Requirements: A Role- and Performance-Based Model

The ›Education and Experience‹ level focuses on developing the ability and vision to perform complex multi-disciplinary activities and the skills needed to further the IT security profession and to keep pace with threat and technology changes.

Sicherheit; Awareness; SAK; Verhalten; Zielgruppe;

{nist800-16} 'Mark Wilson and Dorothea E. {de Zafra} and Sadie I. Pitcher and John D. Tressler and John B. Ippolito' (2003) : Information Technology Security Training Requirements: A Role- and Performance-Based Model

Learning achieved through a single awareness activity tends to be short-term, immediate, and specific. Training takes longer and involves higher-level concepts and skills. For example, if a learning objective is “to facilitate the increased use of effective password protection among employees,” an awareness activity might be the use of reminder stickers for computer keyboards. A training activity might involve computer-based instruction in the use of passwords, parameters, and how to change the passwords for organization systems.

Sicherheit; Awareness; SAK; Verhalten; Zielgruppe;

{nist800-16} 'Mark Wilson and Dorothea E. {de Zafra} and Sadie I. Pitcher and John D. Tressler and John B. Ippolito' (2003) : Information Technology Security Training Requirements: A Role- and Performance-Based Model

Effective IT security awareness presentations must be designed with the recognition that people tend to practice a tuning-out process called acclimation. If a stimulus, originally an attentiongetter, is used repeatedly, the learner will selectively ignore the stimulus. Thus, awareness presentations must be on-going, creative, and motivational, with the objective of focusing the learner’s attention so that the learning will be incorporated into conscious decision-making. This is called assimilation, a process whereby an individual incorporates new experiences into an existing behavior pattern.

Sicherheit; Awareness; SAK; Verhalten; Zielgruppe;

{nist800-16} 'Mark Wilson and Dorothea E. {de Zafra} and Sadie I. Pitcher and John D. Tressler and John B. Ippolito' (2003) : Information Technology Security Training Requirements: A Role- and Performance-Based Model

Learning achieved through a single awareness activity tends to be short-term, immediate, and specific. Training takes longer and involves higher-level concepts and skills. For example, if a learning objective is “to facilitate the increased use of effective password protection among employees,” an awareness activity might be the use of reminder stickers for computer keyboards. A training activity might involve computer-based instruction in the use of passwords, parameters, and how to change the passwords for organization systems.

Sicherheit; Awareness; SAK; Verhalten; Zielgruppe;

{nist800-16} 'Mark Wilson and Dorothea E. {de Zafra} and Sadie I. Pitcher and John D. Tressler and John B. Ippolito' (2003) : Information Technology Security Training Requirements: A Role- and Performance-Based Model