<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: implementing-security-awareness-governance
description: >-
  Design, implement, and measure enterprise security awareness governance programs. Covers phishing simulation frameworks, training metrics (click-through rates, report rates), behavior analytics, role-based training matrices, executive reporting dashboards, and compliance mapping to NIST 800-50, ISO 27001 A.7.2.2, and CIS Control 14.
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
  - security-awareness
  - governance
  - phishing-simulation
  - training-metrics
  - behavior-analytics
  - compliance
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  nist-csf:
  - "PR.AT-1"
  - "PR.AT-2"
  - "PR.AT-3"
  - "PR.AT-4"
  - "PR.AT-5"
  frameworks:
  - "NIST SP 800-50"
  - "ISO 27001 A.7.2.2"
  - "CIS Control 14"
  mitre-attack: []
---

# Implementing Security Awareness Governance

## Overview

Security awareness governance transforms ad-hoc training into a measurable,
risk-driven program with executive accountability. It encompasses phishing simulation
campaigns, role-based curricula, behavioral metrics collection, and continuous
improvement cycles aligned to regulatory and framework requirements.

## Workflow

1. **Program Assessment** — Evaluate current awareness maturity using SANS Security Awareness Maturity Model
2. **Stakeholder Mapping** — Identify executive sponsors, department champions, and high-risk user groups
3. **Risk-Based Curriculum Design** — Map training content to organizational threat landscape and role-based risk profiles
4. **Phishing Simulation Deployment** — Configure campaign cadence, difficulty progression, and reporting workflows
5. **Metrics Collection** — Track click rates, report rates, training completion, and repeat offender trends
6. **Executive Dashboard** — Build KPI dashboards with trend analysis and benchmark comparisons
7. **Continuous Improvement** — Quarterly program review with threat intelligence-informed content updates
8. **Compliance Mapping** — Document program controls against NIST 800-50, ISO 27001, and regulatory requirements

## Key Concepts

### SANS Security Awareness Maturity Model

| Level | Name | Description |
|-------|------|-------------|
| 1 | Non-Existent | No awareness program |
| 2 | Compliance-Focused | Annual training for checkbox compliance |
| 3 | Promoting Awareness | Content beyond compliance, multiple touchpoints |
| 4 | Long-Term Sustainment | Continuous engagement, behavior change measured |
| 5 | Metrics Framework | ROI demonstrated, risk reduction quantified |

### Phishing Simulation Metrics

| Metric | Target | Measurement |
|--------|--------|-------------|
| Click-Through Rate | < 5% | Percentage of users clicking simulated phish |
| Report Rate | > 70% | Percentage of users reporting via phish button |
| Time-to-Report | < 5 min | Median time from delivery to first report |
| Repeat Offender Rate | < 2% | Users failing 3+ consecutive simulations |
| Training Completion | > 95% | On-time completion of assigned modules |

### Role-Based Training Matrix

| Role | Base Training | Specialized Modules | Frequency |
|------|--------------|-------------------|-----------|
| All Staff | Security fundamentals | Social engineering | Quarterly |
| Developers | Secure coding | OWASP Top 10 | Monthly |
| Executives | Business email compromise | Wire fraud | Quarterly |
| IT Admins | Privileged access | Credential hygiene | Monthly |
| Finance | Invoice fraud | Payment verification | Monthly |

## Detection Opportunities

### Program Effectiveness Indicators

- **Positive signals**: declining click rates, increasing report rates, faster time-to-report
- **Negative signals**: flat metrics despite training, repeat offender growth, low engagement scores
- **Compliance gaps**: missed training deadlines, undocumented role-based requirements
- **MITRE mapping**: T1566.001 (Spearphishing Attachment), T1566.002 (Spearphishing Link), T1534 (Internal Spearphishing)


## Quick Reference

```bash
node scripts/agent.js analyze --target <scope>
```
