Certificate Topics — Building a Cybersecurity Awareness Program (Year 1 Foundations)

School: Minister Destiny Testimony Schools Track: Law Enforcement Class: Certificate Topics — Year 1 (Foundations) · Home: Schools — Law Enforcement track Certificate behind this topic: "Building a Cybersecurity Awareness Program" — LinkedIn Learning, earned by Minister Destiny Marie Morgan (May 29, 2025) — earned ×2, including accredited versions (PMI-accredited version) Founded and presented by: Minister Destiny Marie Morgan, Minister

This lesson is educational information from Minister Destiny Testimony Schools. It teaches the public body of knowledge in this subject — the same ground Minister Destiny studied for her certificate — in this school's own words. It is not the original course, it does not award the original credential, and it is not legal or medical advice. If you are in danger right now, call 911. It is community-designed training, not agency policy, and school completion is a school achievement only — not a law-enforcement rank, title, or credential.

Before you start

• This school never asks your name. Your progress is saved to your student record, so you can pick up on any device. If you pass this unit's quiz (80% or higher, retakes allowed), you earn a downloadable certificate with a blank line — you write your own name on it after you save it. Quiz answers are not shown; if you miss a question, re-read the lesson and try again.
• This is the builder's unit: how to design awareness for other people — staff, volunteers, or a whole agency — so behaviour changes, not just attendance. The companion skill, being aware yourself, comes first in your own habits; this unit is about teaching it well.
• Minister Destiny Marie Morgan earned the certificate behind this topic in two versions, including an accredited version. This unit teaches the public programme-design ground — needs, audiences, ethics, and measurement — in this school's own words.

The lesson

Part 1. Awareness Is Behaviour, Not Attendance

An awareness programme succeeds when people do different things on ordinary Tuesdays: they pause before clicking, they report a strange message instead of deleting it, they lock a screen, they call the number they already trust instead of the number in the message. A programme that counts only how many people sat through a video has measured attendance, not awareness. NIST's learning-programme guidance, SP 800-50, draws the useful line: awareness shapes what people notice and care about; training builds a specific skill; education goes deeper still. A good programme uses all three, on purpose, for different audiences.

That distinction protects your budget and your audience's patience. Executives do not need a password-manager tutorial in the same session where records clerks need one; dispatchers need the reporting habit drilled until it is automatic. Start every design decision with one sentence: After this, people will do X instead of Y. If you cannot finish that sentence, you are planning content, not change.

Part 2. Know Your Audiences and Assess the Need

A needs assessment asks three questions before any material is made. What incidents and near-misses have we actually had? What do people currently do — observed kindly, through help-desk patterns, reported phish counts, and short anonymous surveys? And what does each audience's job actually expose them to? Finance staff face invoice fraud; front-desk staff face pretexting in person; leadership faces targeted impersonation. One programme, several audiences, different emphases.

Assessment also reveals the honest starting point. If most staff cannot find the report-phishing button, the first month is not 'advanced threat lectures' — it is making the button known. Skipping assessment produces the classic failure: a polished annual presentation nobody needed, while the actual gap stays open. Write the assessment down in a page or two; it becomes your evidence when you later show leadership what changed and why you chose these topics.

Part 3. Choose Topics and Build a Calendar, Not an Event

Behaviour changes with reinforcement over time, not with one heroic training day. Build a topic calendar: one focused theme a month — phishing and reporting, passwords and multi-factor authentication, handling sensitive records, safe remote work, social engineering in person and by phone, data disposal — each delivered in short pieces people can absorb between real work. Micro-learning — two-to-five-minute lessons, a single scenario, one habit — fits real schedules and repeats well.

Sequence matters. Teach the reporting route before the first simulation, teach multi-factor authentication before the enrolment deadline, and return to core habits in new clothing across the year so they stay fresh without becoming a rerun. October's Cybersecurity Awareness Month, promoted by CISA with its 'Secure Our World' materials, is a useful anchor for a launch or a refresh — but a programme that exists only in October is a poster, not a programme.

Part 4. Simulations, Especially Phishing — Power With Ethics

A phishing simulation sends a controlled, fake phishing message to your own staff to practise recognition and reporting in safety. Done well, it teaches the exact habit you want — pause, inspect, report — and shows the programme where teaching is needed. Done badly, it humiliates people and teaches them to hide mistakes, which is the opposite of security. The ethics are not optional decoration; they are what makes the tool work.

Hold these lines: simulate the tactics attackers use, never a person's private pain — no fake messages about bonuses owed, family emergencies, health results, or discipline, and never during a known crisis. Agree the rules with leadership and staff representatives in advance, say plainly that simulations will happen during the programme, measure and report results in aggregate, and coach individuals privately and kindly. The person who clicks is your student, not your culprit — and the person who reports quickly is the success story you celebrate publicly.

Part 5. Reinforce, Make It Easy, and Keep It Human

People repeat what is easy and praised. Put the secure behaviour within one click: a report button in the mail client, a password manager already installed, a one-page 'what to do if…' card by the phone. Praise reporting out loud — a short note from leadership thanking staff for the reports that caught a real campaign teaches faster than any slide. Managers matter most: when a supervisor treats a security pause as professionalism rather than slowness, the whole team copies it.

Watch the tone of everything you send. Fear fades in a week; usefulness lasts. Short stories from your own organisation — anonymised — beat generic warnings, because people recognise their own hallway in them. Avoid shame charts and public rankings of who clicked. A programme people quietly resent will be quietly evaded, and evasion hides exactly the incidents you most need reported early.

Part 6. Measure Behaviour, Report Honestly

Measure what the programme exists to change. Useful measures include: the share of simulated phishes reported (not merely not clicked), time from delivery to first report, real phish reports per month, multi-factor enrolment, and repeat themes in incidents. Click rates alone mislead twice — a harder simulation raises clicks even as people improve, and a person can avoid clicking yet still fail to report, leaving the next colleague exposed.

Report to leadership in plain language, with the baseline from your needs assessment beside the current numbers, and say what you will change next because of them. Honest reporting includes the misses: a topic that did not land, an audience you have not reached. A programme that reports only victories will eventually be caught by reality; a programme that reports honestly earns the trust — and the budget — to keep improving.

Words to know — Building a Cybersecurity Awareness Program

• Awareness programme — An ongoing, planned effort to change everyday security behaviour across an organisation, not a single training event.
• Needs assessment — A short study of actual incidents, current behaviour, and each audience's exposure, done before designing materials.
• Micro-learning — Very short lessons — a few minutes, one scenario, one habit — repeated over time.
• Phishing simulation — A controlled fake phishing message sent to your own staff to practise recognition and reporting safely.
• Leading measure — A measure of behaviour happening now, such as report rate, that predicts future outcomes.
• Report rate — The share of people who report a suspicious message through the proper route — the habit awareness programmes most want to build.
• Reinforcement — Repeated, varied reminders and praise that keep a new habit alive after the first lesson.
• Aggregate reporting — Reporting results for groups rather than naming individuals, so measurement teaches instead of shaming.
• Secure Our World — CISA's public awareness programme offering free materials anyone may use.

Myths vs facts — Building a Cybersecurity Awareness Program

• Myth: One annual training day creates awareness. Fact: Behaviour changes through short, repeated reinforcement across the year. One event fades within weeks.
• Myth: The click rate is the score that matters. Fact: Reporting is the habit that protects everyone. Someone who does not click but never reports leaves colleagues exposed.
• Myth: Frightening people works best. Fact: Fear fades fast and breeds hiding. Usefulness, ease, and praise change behaviour durably.
• Myth: Simulations should be as sneaky and personal as real attacks. Fact: Simulations must never exploit private pain — bonuses, health, family emergencies, or discipline. Unethical tests destroy reporting trust.
• Myth: If people still make mistakes, the programme failed. Fact: Mistakes are data. A good programme expects them, coaches kindly, and adjusts the teaching — and measures whether mistakes decline.

Think it through — Building a Cybersecurity Awareness Program

A mid-size agency ran one long training each October. Attendance was perfect; incidents did not change. Last spring, three staff paid a fake invoice that arrived by email, and nobody reported the message, so it reached two more departments before the bank caught it. Leadership asks you to rebuild the programme. Money is limited.

Walk it through:

1. Begin with Part 2: assess the real gap. The failure was not knowledge of invoices in the abstract — it was that nobody reported a suspicious message, so it spread.
2. Apply Part 1: name the behaviour — 'report any suspicious payment request through the button and by phone to finance, before acting.'
3. Use Part 3: spread teaching across the year in micro-lessons, with an invoice-fraud month aimed at finance and approvers, and the reporting habit for everyone.
4. Apply Part 4 carefully if you simulate: a generic invoice-style simulation agreed in advance, aggregate results, private coaching — never a fake message about anyone's pay or discipline.
5. Close with Parts 5–6: make reporting one click, praise the first reporters publicly, and measure report rate and time-to-report against today's baseline — not attendance.

Try this — Building a Cybersecurity Awareness Program

• ☐ Write your programme's one-sentence behaviour goal: 'After this, people will do _ instead of _'
• ☐ Draft a one-page needs assessment from your last five incidents or near-misses
• ☐ Sketch a 12-month topic calendar with one short theme per month
• ☐ Write your simulation ethics rules in advance: allowed tactics, banned topics, aggregate-only reporting
• ☐ Choose two behaviour measures — report rate and time-to-first-report — and record today's baseline

Resources to keep — Building a Cybersecurity Awareness Program

• NIST SP 800-50 Rev. 1 — Building a Cybersecurity and Privacy Learning Program (csrc.nist.gov) — The federal guide to designing, delivering, and measuring workforce learning programmes.
• CISA Secure Our World (cisa.gov) — Free awareness materials, tip sheets, and Cybersecurity Awareness Month resources anyone may use.
• CISA Cyber Essentials (cisa.gov) — Starter practices that give an awareness programme concrete habits to teach.
• National Cybersecurity Alliance (staysafeonline.org) — Free, plain-language awareness resources and campaign materials for organisations of any size.

What you earned / what's next — Building a Cybersecurity Awareness Program

✅ Building a Cybersecurity Awareness Program complete (quiz score 80% or higher): You can design an awareness programme around real behaviour — assessed needs, a year-long calendar, ethical simulations, and honest measurement.

Your certificate

Minister Destiny Testimony Schools Certificate of Completion — Building a Cybersecurity Awareness Program

This certificate is presented by Minister Destiny Marie Morgan, Minister

Awarded to: ______________________________ (write your name here after you download — your name is never collected or stored by this school)

Date completed: ______________

Congratulations. You can now build teaching that respects people and still changes what they do on an ordinary Tuesday — and in security, ordinary Tuesdays are where protection lives. Keep it kind, keep it short, and keep praising the reporters. — Minister Destiny Marie Morgan

This is a certificate of educational completion from Minister Destiny Testimony Schools. It is not a state license, a government certification, or the original course credential. School rank and completion are school achievements only — not a law-enforcement rank, title, or credential.

What's next: Return to the Certificate Topics for your next Year 1 Foundations topic.

Sources

• NIST SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program — NIST (csrc.nist.gov) — awareness vs training vs education, programme lifecycle, and measurement.
• CISA Secure Our World and Cyber Essentials — Cybersecurity and Infrastructure Security Agency (cisa.gov) — free public awareness materials and starter behaviours.
• NIST Cybersecurity Framework 2.0 — NIST (nist.gov) — Protect-function awareness and training outcomes (PR.AT).

Course Record — Building a Cybersecurity Awareness Program

• Learning outcomes: On completing this unit, the student can:
• Define an awareness programme by the behaviour it changes, not by attendance
• Run a short needs assessment across distinct audiences before designing materials
• Build a topic calendar using micro-learning and reinforcement across the year
• State the ethical rules that govern phishing simulations and why they protect reporting
• Choose behaviour measures such as report rate and time-to-report, and explain why click rate alone misleads
• Report programme results to leadership honestly, with baselines and next changes
• Study time: Approximately 1 hours — an estimate covering reading, activities, and the test. Students move at their own pace.
• Assessment: A 10-question test drawn only from this unit's lesson. 80% or higher passes and earns the unit certificate. Answers are not shown; your score is saved to your student record, and retakes are allowed.
• Level: Certificate Topics — Year 1 (Foundations) · Law Enforcement school · working rank on completion path: Freshman → Sophomore.
• Version: Version 1.0 — October 2026.

Minister Destiny Testimony Schools — Law Enforcement. Educational information only. Help lines: 911 for emergencies · 988 Suicide & Crisis Lifeline (call/text 988).