CompTIA Security+ SY0-701 · Free study guide

Objective 5.6 — Build and operate security awareness practices

Awareness programs improve recognition, judgment, and reporting. They should be role-aware, recurring, measurable, accessible, and psychologically safe. Punishing every mistake discourages reporting and hides risk.

Teach people how to recognize suspicious messages: unexpected urgency, mismatched domains, unusual payment or credential requests, unsafe attachments, and attempts to move a conversation outside normal channels. More importantly, provide a simple reporting method and a fast response. When a message is reported, preserve evidence, analyze it, search for other recipients, contain harmful content, and communicate useful guidance.

Behavior and context

Anomalous behavior can be risky, unexpected, or unintentional. A worker uploading data to an unapproved service may be trying to meet a deadline rather than steal information. The response should protect data, understand the workflow, and address the control or training gap while escalating deliberate misuse appropriately.

Guidance should cover passwords and passwordless methods, removable media and cables, social engineering, operational security, data handling, and hybrid or remote work. Tailor examples for finance, developers, administrators, executives, support staff, and vendors because their attack paths differ.

Initial training establishes expectations; recurring training reinforces and adapts them. Short, timely guidance after a relevant event can be more effective than one annual presentation. Ensure content supports different abilities and does not require color, audio, or one language alone to understand essential instructions.

Measure outcomes

Phishing simulations can measure reporting speed, reporting rate, and repeated risky behavior. Click rate alone can reward easier campaigns or punish difficult ones without showing improvement. Track whether users report real messages, whether responders act quickly, and whether training addresses observed patterns.

Program development identifies risks, audiences, objectives, delivery methods, cadence, and measures. Execution needs leadership support and easy reporting. Monitoring should produce improvements with owners and due dates.

Decision rule: make the safe action clear and easy, measure reporting and risk reduction, tailor guidance to roles, and use mistakes to strengthen systems rather than suppress disclosure.