No matter how good your policies and procedures are they are only as good as the people you employ to use them.

All of your employees have responsibilities regarding Information Security, Data Protection, Health & Safety and a number of other important issues. In addition, they may have further specific Information Governance requirements in respect of the Freedom of Information Act, the Caldicott Principles, Data Quality and Records Management. They have a key role to play in reducing the risks your organisation is exposed to on an ongoing basis.

You may well have policies and procedures in place which are designed to guide employees (via a handbook or information on the intranet) on how to perform their roles in line with ‘best practice’. However:

Getting the message across
In an effort to boost awareness many organisations conduct one-off awareness presentations to all staff. In the short term, this method can be effective, although usually expensive and time consuming and because of this, training is usually provided too infrequently to be effective in the long run.

So, how can you deliver an awareness programme that is effective, yet does not cost inappropriate amounts of time and money to create and maintain AND automatically assesses your employees’ awareness levels?