Measuring the Impact of a Security Awareness Program

This report explains how to build and measure an organizational security awareness program by identifying key risks, defining human-behavior metrics (such as clean desk, dumpster diving results, vishing assessments, lost/stolen devices, and endpoint encryption), engaging a cross-departmental advisory board, and reporting trend-focused metrics to executive leadership to demonstrate program impact.