How to Communicate a Cybersecurity Awareness Campaign in 14 Steps

Before taking the plunge and launching your security awareness campaign by delivering your trainings and sending out your communications, it pays to take some time to think through exactly what steps you need to take and what process you will follow.

Pre-campaign:

1. Start early

Time is key when it comes to preparation – depending on the size of the campaign, aim to start preparations 4-6 weeks before the campaign start date.

2. Consider your objectives & KPIs, and ways of measuring these

Always stay focused on your “why” – also always make sure you know how you can measure the “why”.

3. Develop baseline metrics

To evaluate whether the campaign was a success, you need to create your pre-campaign baseline measurements.

4. Decide on, and understand, your audience

Will the campaign be focused on a select group of individuals or will it be organization-wide? Where does your audience get their information from? What is their preferred learning style? What is relevant to them concerning cybersecurity awareness, and what would they be interested in?

5. Consider what resources you have available

The current resources you have may allow you to increase your budget on other aspects of your campaign.

6. Source your awareness materials

Based on your chosen theme or the existing materials you have, you might need to source other materials. This is the time to do this. You can see ideas for various training awareness types here.

7. Craft your messaging

Begin drafting all communications you plan on sending out during the campaign. Make sure to keep the tone in line with the knowledge level of your identified users as well as in line with your infosec team branding. You should also make sure you have considered all available channels in order to best reach your audience.

Live campaign:

8. Launch your campaign! Send out your first communication

Send out your first message. Host your first training. Collect data from each of these so you can evaluate if any slight revisions are needed.

9. Conduct your training sessions and send out regular communications

Now you’re in the thick of it. Make sure to stick to your plan, keeping to timelines as best as you can. If any hick-ups arise, handle them swiftly. Remember the bigger picture whilst ensuring you are capturing participant data where possible.

10. Tweak where necessary

Based on how your first messages and trainings went, make any required tweaks to your messaging, channels, or trainings.

Post-campaign:

11. The hard work is done! Enjoy the feedback but stay calm

It’s done! You’ve hopefully received fantastic feedback, and your dopamine levels might be at an all-time high. You might be tempted to repeat aspects of the campaign straight away – everyone loved it, right? However, it pays to keep calm and not send any additional communications just yet. You don’t want your campaign efforts to be diluted, as in order to obtain true metrics, your post-campaign evaluation should be on the planned campaign and not mixed with additional messaging.

12. Post campaign metrics

Based on your pre-campaign planning, capture the post-campaign metrics.

13. Post campaign analysis

Spend some time analysing how the campaign went, noting it down for future reference. What went well and what could have been improved?

14. Post campaign communication

Were the results as expected or did something extraordinary happen? You can leverage the post-campaign period to reach out to thank your audience and re-iterate key messages, or use this as an opportunity to communicate any interesting learnings to your audience.

Want a summarized version of the above information? Download the infographic above.

At Ozmeos, we can provide you with more in-depth details of each of the above steps, or compile a full awareness campaign strategy and communication plan package. We have experience in developing full cybersecurity awareness campaigns, and understand exactly where each pain point might be.