Building a Cybersecurity and Privacy Learning Program

Published

September 12, 2024

Author(s)

Marian Merritt, SUSAN HANSCHE, BRENDA ELLIS, Julie Nethery Snyder, KEVIN SANCHEZ-CHERRY, DONALD WALDEN

Abstract

This publication provides guidance for federal agencies and organizations to develop and manage a life cycle approach to building a Cybersecurity and Privacy Learning Program (CPLP). The approach is intended to address the needs of large and small organizations as well as those building an entirely new program. The information leverages broadly accepted standards, regulations, legislation, and best practices. The recommendations are customizable and may be implemented as part of an organization-wide process that manages awareness, training, and education programs for a diverse set of federal employee audiences. The program should encourage behavior change as part of risk management and lead to developing a privacy and security culture in the organization. The guidance also includes suggested metrics and evaluation methods to regularly improve and update the program as needs evolve.

Citation

Special Publication (NIST SP) - 800-50r1

Report Number

800-50r1

NIST Pub Series

Special Publication (NIST SP)

Pub Type

NIST Pubs

Download Paper

https://doi.org/10.6028/NIST.SP.800-50r1

Local Download

Keywords

awareness, behavior change, cybersecurity, education, learning program, privacy, privacy culture, role-based, security culture, training.

Citation

Merritt, M. , HANSCHE, S. , ELLIS, B. , Nethery Snyder, J. , SANCHEZ-CHERRY, K. and WALDEN, D. (2024), Building a Cybersecurity and Privacy Learning Program, Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.SP.800-50r1, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=958397 (Accessed October 13, 2025)