Specific inquiry
I have been instructed to establish an annual information security training plan for the entire organization.
How should I approach it? What should I pay particular attention to? Examples from other companies would be very helpful.
A typical procedure for establishing an annual training plan consists of several steps.
Training in an organization is closely related to the organization’s HR vision, not only in information security but also in job competency and talent management.
The following procedure for establishing an annual training plan on a general subject can therefore be considered.
(1) Internal and external environment analysis – understand management, the HRD environment, organizational strategy, and similar factors, and explore ways to connect them
(2) Requirements and competency analysis – survey and analyze the mindsets of management and internal employees, and analyze HRD competencies
(3) Establish vision, mission, and goals – establish and refine a mid- to long-term vision, mission, and goals based on internal and external requirements and the analysis
(4) Establish priority tasks and strategy – SWOT analysis, and establishment of strategy and priority tasks
(5) Establish a training system – establish a training system and roadmap
(6) Establish a training operations plan – establish an operations plan for each training course
(7) Establish the annual training plan and budget – annual training plan and budget (by organization, by workplace, and consolidated enterprise-wide)
Examine the enterprise-wide training system that is already in operation.
Most organizations already have an enterprise-wide training system operated by a dedicated HR organization.
Here, “system” means not only programs such as training courses, but also definitions of each role and responsibility based on the PDCA (Plan-Do-Check-Act) cycle.
Identifying the following points in the existing enterprise-wide training system will therefore be very helpful.
– What are the vision, mission, and goals of the enterprise-wide training system?
– How are the R&R (roles and responsibilities) by area of the enterprise-wide training system operated?
– In what way are the programs of the enterprise-wide training system operated (plan, execute, and evaluate)?
– What is the scale of the annual training-system plan and budget?
– How is performance management of the annual training system carried out?
(*) While meeting with related organizations to understand the current state as above, R&R is sometimes defined naturally, and the scope of the role the dedicated security organization must perform is determined
There are several points to consider when designing an information security training plan.
As noted above, the better the information security training system is integrated with the existing enterprise-wide training system, the better it can be operated and improved.
Beyond the elements common to a training system, however, there are several points that must be considered because of the characteristics of information security work alone.
(1) How far should the scope of training extend?
This will differ depending on the organization’s structure and roles, but there are several topics related to information security. Because much of what follows changes depending on how far the scope of the annual plan is defined, this first step is important. Candidate topics include information security, personal information protection, trade-secret management, and intellectual property management. The scope of the annual training plan will differ according to the organization’s structure, size, and industry characteristics.
(2) Who should be selected as training targets?
Training goals differ depending on who the trainees are, and therefore the focus of the training, KPI indicators, and similar elements also differ.
When identifying training targets, a common grouping is executives (senior managers), middle managers, general employees, IT staff, dedicated security staff, and partner-company employees. In some cases, employees traveling overseas are classified separately.
(3) How will training be evaluated and improved?
For any work, evaluating the results is essential for continual improvement. Selecting annual goals that reflect the characteristics of the trainees and evaluating that performance can be sensitive depending on the organization, so it is effective to set an achievable target level and raise it gradually.
For general users, attendance rate can be set as a goal. For IT staff or dedicated security staff, the number of external professional courses completed can be a less burdensome goal. Some companies include a test after training, define maturity as L1, L2, and L3, and manage those who pass by organizational unit each year. This is a high-level example of performance evaluation. (This method, however, requires substantial cost and effort.)
An approach worth considering in the future is awareness change management, not training alone.
The purpose of information security training is to raise members’ awareness and thereby bring about a change that improves information security awareness.
Most organizations focus on how to deliver training, establish a plan and budget, and operate the program, but they find that training alone has limits in leading the target audience to put it into practice.
The next step is therefore to move beyond a one-way training-system approach and adopt a change-management system approach.
Client Company A, whose organization is quite large and is dispersed nationwide across diverse units, once carried out an enterprise-wide information security change-management project for more than about three months, with help from an external specialist, so that employees across the organization would understand information security and personal information protection well and be led to practice them enterprise-wide.
The distinctive points of this approach, compared with a conventional training system, are as follows. Please refer to them.
– Define the organization’s stages of accepting change as awareness, participation, and practice, and design and build a change-management framework
– Design and apply two-way communication techniques appropriately, rather than one-way methods such as training
– Analyze the mindset of each organizational unit, build an enterprise change-management network (change network), and establish a two-way system of continual improvement
– Establish a phased mid- to long-term plan for embedding the change in the organization (change introduction stage – change-foundation building stage – change diffusion and embedding stage)
* For business and related inquiries: T) 02-322-4688, F) 02-322-4646, E) info@wikisecurity.net