Cybersecurity · Intermediate level

Intermediate level · Module 5: Security Policies and Awareness · Lesson 3 of 3

Measuring Security Behaviour

Check whether policies and training change what people do.

In this lesson you will

  • Choose behaviour measures
  • Use results to improve

Key concepts

MFA coveragereporting ratespatch statusimprovement cycle

The lesson

Measure behaviour, not just attendance: the percentage of accounts with MFA, devices fully patched, phishing reports per month and backups tested.

Share results with management and staff and celebrate improvement.

Use measures to focus the next round of training and policy changes.

Step by step

  1. Choose four measures.
  2. Collect baseline values.
  3. Set targets.
  4. Plan a quarterly review.

Practice activity

Write a security measures sheet for the organisation.

Expected result: Measures with baselines, targets and a review plan.

Check your understanding

  1. Give one behaviour measure.

    Show answer

    Percentage of accounts with MFA.

  2. Why measure behaviour rather than attendance?

    Show answer

    Attendance does not show whether habits changed.

Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.