SAFE in practice

To effect any kind of change, we need to know where your organization stands at the moment. That's why we start with a baseline measurement. This includes a measurement of current behavior, ability, motivation and opportunity. The measurement uses a variety of methodologies, so it goes much further than a standard survey. With the outcome of the baseline measurement we can define the goals of the program.

SAFE's basic program is then rolled out for the whole organization. All three factors of behavior receive repeated attention: Keeping the necessary knowledge up to date, boosting motivation and establishing the right culture. This is done in various ways, for instance using social engineering and road shows. The repeated attention to these three factors is necessary to activate the topic of information security and to remind and enable employees to behave safely.

In addition to the basic program, a tailored program runs every quarter for the focus group of that specific quarter. This approach is repeated in the second year, so each focus group receives repeated attention. For each focus group, we identify specific goals, given the nature of their work. Which safe behavior should each group ideally display?

We use so-called barrier assessments for each focus group, to investigate what is withholding this focus group from the target behavior. These insights are then translated into concrete interventions: what does this focus group need to actually display the desired behavior? For example, sometimes the analysis will show that the focus group benefits most from experiencing the urgency of an incident simulation. Another time it might be necessary to create support by setting up an ambassador network, increasing motivation through a hack demo, or a highly targeted e-learning module to update a specific gap in knowledge.

All these assessments and interventions should lead to actual behavioral change - the goal of the SAFE program. At the end of the year, the measurements from the baseline measurement are repeated to check the effects of the program.