Raising awareness? An explanation of ISO 27001 information security awareness.

Awareness within a management system?

An important part of obtaining and/or maintaining certification for your organization is awareness. During the audits of the standard ISO/IEC 27001 information security, on various topics, it is tested whether the organization has sufficient awareness. The importance of information security is brought to the attention through the management system. In doing so, the organization strives to increase the level of awareness of staff, contractors and other stakeholders.

‍

Importance of information security

How do you use the right tools and tools to raise awareness within the organization, on the subject of information security? By setting up the management system, based on the PDCA model, awareness can be continuously improved. The PDCA model continuously monitors whether the planned components are being achieved and where improvements can be made. The management system analyses opportunities and risks. Based on this analysis, a selection can be made of topics where awareness can be raised.

‍

Focus on behavior and human error

By actively paying attention to behavior, you increase user awareness. Indeed, the “Annual Data Breach Report 2017” by the Data Protection Authority shows that almost 80% of all internal data breaches are caused by human error. The most common forms of data breaches include misaddressing emails and losing data carriers (such as USB sticks).

‍

How do you increase awareness?

To raise awareness, several methods are effective:

‍

• Information Security Onboarding Program: Integrate information security into the onboarding process for new employees.
• Periodic Awareness Sessions: Have regular sessions that address relevant topics and raise awareness.
• Phishing Simulations: Feed regularly phishing simulations out to make employees aware of potential threats.
• Visual Aids: Distribute flyers, posters, or newsletters to provide visual reminders of information security.
• E-learning Modules: Provide courses and e-learning modules, such as Guardey, on to delve deeper into information security.

‍

‍These are just a few examples of raising awareness within your organization. After all, every organization requires a different approach.

‍

Tailored awareness training courses for your organization

‍By properly implementing an awareness plan, you lower the risk of possible incidents. As a result, the staff becomes more aware and you prevent image damage. At Fendix, we offer various Security Awareness tailor made services for your organization.