Awareness and measurement: making cyber a routine, like safety

This is the last of the 12 parts of the “Common language” series on industrial cybersecurity.

Most industrial sites have run a cybersecurity awareness campaign at some point. Posters in the corridor, a phishing simulation, maybe a video looping in the control room. Then the project closed, the budget line disappeared, and a year later nobody can quite remember the rule for USB sticks.

The people did not fail. The format did. Awareness run as an event behaves like one: it happens, then it is over.

Why a campaign has a shelf life

There is research behind the intuition. In a study presented at USENIX SOUPS 2020, Reinheimer and colleagues followed 409 employees of a German public administration after a phishing awareness programme. Their ability to tell phishing from legitimate email was significantly better straight after the training, and still four months later. At six months the improvement was no longer significant. The authors recommend a reminder after about half a year.

That study is about office email, not control rooms. Anyone who runs safety training will still recognise the curve. Reflexes loosen, new staff arrive who never got the session, contractors rotate, and the threat moves on anyway. Our working rule: count on a useful life of about six months for any campaign, and book the next touchpoint before then.

So the fix is organisational more than pedagogical. Awareness is not a milestone to tick off. It is a standing function, with a calendar, a named owner and a recurring budget, as ordinary on site as the safety toolbox talk.

The standards point the same way. IEC 62443-2-1 (2024 edition) lists security awareness training and security responsibilities training among the organisational requirements of an asset owner’s security programme. NIS2 goes further for leadership: Article 20(2) requires members of the management bodies of essential and important entities to follow training, and asks Member States to encourage entities to offer similar training to their employees regularly. What the rest of the Directive expects as evidence is covered in the NIS2 article.

On a pharmaceutical site, none of this is new. EU GMP Chapter 2, point 2.11, already asks for training suited to each person’s duties, continuing training whose practical effectiveness is periodically assessed, and training records. The same training system, with its role matrix and its records, can carry the cyber modules. No parallel spreadsheet, and the inspector has one place to look.

One cycle a year: the content changes, the cadence does not

A simple yearly cycle keeps the function alive without reinventing it every time. We use four steps.

• Remind. The basics, again and again: removable media, access rules, how to report a doubt. The removable media article has the rules worth repeating.
• Update. New techniques: voice phishing, malicious QR codes, an AI-cloned voice that sounds like the plant manager or the vendor’s engineer.
• Fill gaps. Topics not yet covered: physical security, subcontracting, handling sensitive information.
• Capitalise. Lessons from exercises and real incidents go back into the site’s security standard and into next year’s content.

Same cycle every year, fresh content each time. Reflexes come from regularity, not from one intense week. Safety managers know this already: nobody expects a single induction day to keep a plant accident-free for five years.

Different audiences, different risky gestures

An operator, a plant director and a contractor do not make the same mistakes, so they should not sit through the same session. The plan below is a starting point; adjust it to the size and criticality of the site.

Experts first, in every cycle

If the plan has one priority, it is the site’s engineers and technicians. They design the architectures, approve vendor interventions and write the procedures. Theirs are the sessions you do not cancel when the shutdown overruns, and the ones that have to be built on the site’s own equipment rather than a generic slide deck. In our experience, an hour spent on their skills does more than ten hours of general communication.

Measure it the way you measure safety

A programme without numbers will not survive an investment committee. The indicators below have two things in common: a site director can read them without a translator, and they can be checked without fancy tooling. Track them at the same rhythm as the safety indicators, ideally in the same meeting. The targets are our suggested starting points, not values from a standard.

People misread the last line. A low number of reports looks reassuring on a slide. It is usually bad news.

A falling number of reports almost never means less is happening. It usually means people have stopped talking. Treat it the way a safety manager treats a sudden drop in near-miss reports: as something to investigate, not something to celebrate.

From campaign to function

What turns awareness from an event into a function is the same set of things that keeps a safety programme alive: an owner, a calendar, a budget and a review.

No new discipline required

Industrial sites already know how to analyse a hazard, rank consequences, write a procedure, train a team, audit a gap and weigh an investment against a risk. Industrial cybersecurity asks for exactly those skills, applied to one more hazard, with words everyone understands the same way.

That is why this series opened with vocabulary. Its first part argued that segregating is not segmenting, that safety is not security, and that a site cannot agree on a programme until it agrees on what its words mean. Everything since, the internal standard, the roles, the roadmap, the remediation cycle, the risk assessment, the skills question, rests on that shared language. Awareness and measurement are how it lasts: repeated every year, checked every quarter, until cyber is as routine on site as safety.

Where to start

1. Name the owner. One person accountable for the awareness calendar and the indicators, with time actually set aside for it.
2. Put the four-step cycle in next year’s calendar, with the first reminder before the six-month mark of the last campaign.
3. Load the audience plan into the training system: cyber modules by role, in the same matrix and records as GMP and safety training.
4. Pick four indicators for the first quarter. Inventory completeness, MOC with cyber review, awareness coverage and reports received can all be measured without new tools.
5. Put them on the safety meeting agenda. Same meeting, same rhythm, same seriousness.

Five common mistakes

• Running awareness as a project. It closes, the budget goes, and the reflexes follow within months.
• One session for everyone. The operator, the director and the contractor do not make the same mistakes.
• Forgetting contractors and new starters, often the very people who plug in the device nobody expected.
• Reading a drop in reports as good news.
• Measuring what the tool reports instead of what the director understands. An indicator nobody reads in the safety meeting will not defend a budget.

The day a site can say what it protects, against what, under which rule and under whose responsibility, half the work is done.

References

• B. Reinheimer et al., An investigation of phishing awareness and education over time: when and how to best remind users, USENIX SOUPS 2020. usenix.org
• IEC 62443-2-1:2024, Security program requirements for IACS asset owners. webstore.iec.ch
• European Commission, EudraLex Volume 4, EU GMP Part I, Chapter 2 Personnel, point 2.11. health.ec.europa.eu
• Directive (EU) 2022/2555 (NIS2), Article 20. eur-lex.europa.eu