Specific Inquiry
I have been instructed to establish an annual information protection training plan for the company’s entire organization.
How should I approach it? What should be considered in particular? An introduction to cases from other companies would be a great help.
A typical procedure for establishing an annual training plan consists of several steps.
Training in an organization is a subject closely related to the organization’s HR vision, covering not only information security but also job competency and talent management.
The following procedure for establishing an annual training plan on a general subject can therefore be considered.
- Internal and external environment analysis – identify management, the HRD environment, the organization’s strategy, and so on, and seek ways to link them
- Requirements and competency analysis – survey and analyze the mindsets of management and internal employees, and analyze HRD competencies
- Establish vision, mission, and goals – establish and refine a mid- to long-term vision, mission, and goals based on internal and external requirements and analysis
- Establish priority tasks and strategy – SWOT analysis, and establishment of strategy and priority tasks
- Establish the training system – establish the training system and roadmap
- Establish the training operation plan – establish an operation plan for each training course
- Establish the annual training plan and budget – annual training plan and budget (by organization, by workplace, and consolidated enterprise-wide)
Examine carefully the enterprise-wide training system that is already in operation.
Most organizations already have an enterprise-wide training system operated by a dedicated HR organization.
Here, a system means not only programs such as training courses, but also the definition of each role and responsibility on the basis of the PDCA (Plan-Do-Check-Act) cycle.
Identifying the following points in the existing enterprise-wide training system will therefore be very helpful.
- What are the vision, mission, and goals of the enterprise-wide training system?
- How are the R&R (roles and responsibilities) by area of the enterprise-wide training system operated?
- In what manner (plan-implement-evaluate) are the programs of the enterprise-wide training system operated?
- What is the scale of the annual training-system plan and budget?
- How is performance management of the annual training system carried out?
(*) While meeting with related organizations to grasp the current state as above, R&R is sometimes defined naturally, and the scope of the role that the dedicated security organization should perform is determined
There are several matters to consider when designing an information security training plan.
As mentioned earlier, the better an information security training system is integrated with the existing enterprise-wide training system, the better it can be operated and improved.
Beyond the matters common to a training system, however, there are several matters that must be considered because of the characteristics of information security work alone.
- How far should the scope of training extend?
– It differs according to the composition and roles of the organization, but there are several subjects related to information security, and much of what follows changes greatly depending on how far the scope of the annual plan is defined, so this first step is important.
– Subjects that can be considered as candidates include information security, personal information protection, trade secret management, and intellectual property management.
– The scope for establishing the annual training plan will differ according to the organization’s composition, size, and industry characteristics, will it not?\ - How far should the training audience be selected?
– Depending on who the trainees are, the goal of the training differs, and therefore the focus of the training, the KPI indicators, and so on also differ.
– When the training audience is identified, a common grouping is executives (senior managers), middle managers, general employees, IT staff, dedicated security staff, and partner-company staff. Overseas business travelers are sometimes distinguished separately as well. - How will training be evaluated and improved?
– Whatever the work, performance evaluation of its results is an essential element for continual improvement.
– Selecting annual goals in consideration of the characteristics of the training audience and evaluating that performance can be sensitive depending on the organization, so an approach that sets an attainable target level and gradually raises it is effective.
– For general users, attendance rate can be set as the goal. For IT staff or dedicated security staff, something such as the number of external professional courses taken can be a less burdensome goal.
– Some companies include a test after the training in the course, define maturity as L1, L2, and L3, and evaluate and manage each year, by organizational unit, the people who pass. This is a high-level case of performance-evaluation management. (This method, however, requires considerable cost and effort.)
An approach worth considering going forward is awareness change management rather than training alone.
The purpose of information protection training is change that raises information security awareness by raising the awareness of members. Most organizations focus on how to conduct training, establish a plan and a budget, and operate them, but they come to learn that training alone has limits in drawing practice from the audience.
The next step is therefore to advance beyond a training-system approach, which is a one-way delivery format, and to approach the work as a change-management system.
In the case of client Company A, whose organization is quite large, diverse, and distributed nationwide, an enterprise-wide information security change-management project was carried out for more than about three months with the help of an external specialist firm, so that employees across the organization would know information security and personal information protection well and so that enterprise-wide practice could be induced more effectively.
The points that distinguish this approach from the existing training system are as follows.
- Define the organization’s stages of accepting change as awareness, participation, and practice, and design and build a change-management framework
- Design and apply two-way communication techniques appropriately, rather than one-way methods such as training
- Analyze the mindset of each organizational unit, build an enterprise change-management network (change network), and establish a two-way system of continual improvement
- Establish a phased mid- to long-term plan for settlement within the organization (change introduction stage – change foundation-building stage – change diffusion and settlement stage)
* Business and related inquiries: T) 02-322-4688, F) 02-322-4646, E) info@wikisecurity.net