Managing an Information Security and Privacy Awareness and Training Program

Rebecca Herold

• Publisher: CRC Press
• Year: 2010
• Topic: Computer Science
• eBook ISBN:
  9781040061923
• Subtopic: Human Resource Management
• Index: Computer Science

Starting with the inception of an education program and progressing through its development, implementation, delivery, and evaluation, Managing an Information Security and Privacy Awareness and Training Program, Second Edition provides authoritative coverage of nearly everything needed to create an effective training program that is compliant with applicable laws, regulations, and policies. Written by Rebecca Herold, a well-respected information security and privacy expert named one of the Best Privacy Advisers in the World multiple times by Computerworld magazine as well as a Top 13 Influencer in IT Security by IT Security Magazine, the text supplies a proven framework for creating an awareness and training program. It also:

• Lists the laws and associated excerpts of the specific passages that require training and awareness



• Contains a plethora of forms, examples, and samples in the book's 22 appendices



• Highlights common mistakes that many organizations make



• Directs readers to additional resources for more specialized information



• Includes 250 awareness activities ideas and 42 helpful tips for trainers

Complete with case studies and examples from a range of businesses and industries, this all-in-one resource provides the holistic and practical understanding needed to identify and implement the training and awareness methods best suited to, and most effective for, your organization.

Praise for:

The first edition was outstanding. The new second edition is even better ... the definitive and indispensable guide for information security and privacy awareness and training professionals, worth every cent. As with the first edition, we recommend it unreservedly..—NoticeBored.com

Table of contents

• Cover
• Half title
• Title Page
• Copyright Page
• Dedication
• Table of Contents
• Foreword
• Preface
• About the Author
• Introduction
• Chapter 1 Brief History of Corporate Information Security and Privacy Awareness and Training
• Chapter 2 Why Training and Awareness Are Important
• Chapter 3 Legal and Regulatory Requirements for Training and Awareness
• Chapter 4 Incorporating Training and Awareness into Job Responsibilities and Appraisals
• Chapter 5 Common Corporate Education Mistakes
• Chapter 6 Getting Started
• Chapter 7 Establish a Baseline
• Chapter 8 Get Executive Support and Sponsorship
• Chapter 9 Identify Training and Awareness Methods
• Chapter 10 Awareness and Training Topics and Audiences
• Chapter 11 Define Your Message
• Chapter 12 Prepare Budget and Obtain Funding
• Chapter 13 Training Design and Development
• Chapter 14 Awareness Materials Design and Development
• Chapter 15 Communications
• Chapter 16 Deliver In-Person Training
• Chapter 17 Launch Awareness Activities
• Chapter 18 Evaluate Education Effectiveness
• Chapter 19 Leading Practices
• Appendix A: Sample Executive Education Sponsorship Memos
• Appendix B: Training Contact Training Data Collection Form
• Appendix C: Effectiveness Evaluation Framework
• Appendix D: Sample Privacy Roles Definitions
• Appendix E: Suggested Privacy Awareness and Training Strategy Announcement as Voice Mail Message
• Appendix F: Privacy Icon or Mascot
• Appendix G: Sample Privacy Training Survey
• Appendix H: Privacy Sample Training Plans
• Appendix I: Advocate and SME Interview Questions to Assist with Privacy Training Development
• Appendix J: Training and Awareness Inventory
• Appendix K: Incorporating Training and Awareness into the Job Appraisal Process Interview/Questionnaire
• Appendix L: Sample Customer Privacy Awareness and Training Presentation
• Appendix M: Designated Security- and Privacy-Related Days
• Appendix N: Education Costs Worksheet
• Appendix O: Sample Pretraining/Awareness Questionnaire
• Appendix P: Security Awareness Quiz Questions
• Appendix Q: Social Engineering Quiz
• Appendix R: Information Security and Privacy Awareness and Training Checklist
• Appendix S: Awareness and Training Resources
• Appendix T: Awareness and Training Glossary
• Appendix U: Sample Case Studies
• Index