From Compliance to Impact: Tracing the Transformation of an Organizational Security Awareness Program

Published

November 26, 2024

Author(s)

Julie Haney, Wayne Lutters

Abstract

There is a growing recognition of the need for a transformation from organizational security awareness programs focused on compliance  measured by training completion rates  to those resulting in behavior change. However, few researchers or practitioners have begun to unpack the organizational practices of the security awareness teams tasked with executing program transformation. We conducted a year-long case study of a security awareness program in a United States (U.S.) government agency, collecting data via observations, interviews, and documents. Our findings reveal the challenges and practices involved in the progression of a security awareness program from being compliance-focused to emphasizing impact on workforce attitudes and behaviors. We capture transformational organizational security awareness practices in action from multiple workforce perspectives. Our study insights can serve as a resource for other security awareness programs and workforce development initiatives aimed at better defining the security awareness work role.

Citation

Cyber Security: A Peer-Reviewed Journal

Volume

8

Issue

2

Pub Type

Journals

Download Paper

https://doi.org/10.69554/NJYA9034

Local Download

Keywords

cyber security, awareness, training, compliance, measures, case study

Citation

Haney, J. and Lutters, W. (2024), From Compliance to Impact: Tracing the Transformation of an Organizational Security Awareness Program, Cyber Security: A Peer-Reviewed Journal, [online], https://doi.org/10.69554/NJYA9034, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=935669 (Accessed October 27, 2025)