AUD / AUD-07
Cybersecurity awareness programme audit
An assessment of risk understanding and awareness-programme effectiveness, beyond simply counting training attendance.
WHEN IT HELPS
A focused response
to a defined need.
HR, CISO or executives; low engagement, few reports or campaigns without usable measurement.
SCOPE & OUTCOMES
What the engagement covers.
Scope
- Interviews and questionnaires
- role-based content review
- assessment of onboarding, reporting and existing indicators
Deliverables
- Audience-level diagnosis
- learning gaps
- improvement programme and monitoring indicators
Acceptance evidence
A usable baseline and improvement objectives are agreed without unnecessarily exposing individual results.
DELIVERY
How the work is structured.
Approach
Scope assets and criteria; gather evidence and interviews; validate gaps; present priorities and limitations.
Prerequisites & responsibilities
Customer: inventory, read access, documents and business contacts. Provider: assessment and debrief. Production changes are not included by default.
Scope factors
Sites, assets, technologies and interviews; assessment depth; inventory quality; access constraints; required reporting. One-off project with optional follow-up.
Questions to clarify
Which behaviours should change? Do staff know how to report? Are results used to support people or punish them?
IMPORTANT BOUNDARIES
A phishing simulation is a separate option; agree staff information, confidentiality and permitted use of results.
Sampling and observation date are explicit. No assessment certifies the absence of flaws; remediation, penetration testing and recurring follow-up are separate scopes.
IN PRACTICE
Illustrative situations.
These examples describe possible engagements and target outcomes. They are not customer references or achieved results.
Scenario 01
A 250-person company completes annual training, but staff cannot identify the reporting channel. Project: questionnaire and interviews. Target outcome: simpler reporting and targeted learning, followed by a repeat assessment.
Scenario 02
An international group uses French-only training for everyone. Project: assess languages, roles and working situations. Target outcome: tailored learning and comparable indicators; language differences are not labelled as carelessness.
Technology and reference context
Questionnaires, interviews and the existing awareness platform; no collection of real passwords.
The final technology set is agreed during scoping, based on interoperability, licensing, access rights and operating requirements.
CONNECTED SERVICES
Build the next step.
These services can complement the engagement. They are not automatically included.
START A CONVERSATION
Make the scope clear.
We will clarify the objective, dependencies and responsibilities of this service before proposing delivery.