SAFE in Practice

Baseline measurement

Measurements enable testing the effect of the interventions, but also to define the goals of the program. The SAFE baseline measurement thus includes a measurement of current behavior, ability, motivation and opportunity. This baseline measurement consists of a variety of methodologies, so it goes much further than a standard survey. The outcome of the baseline measurement provides a clear insight into the current status and into which of the factors require extra attention.

Basic program for the entire organization

SAFE consists of a basic program for the entire organization in which all three factors of behavior receive repeated attention: Keeping the necessary knowledge up to date, boosting motivation and establishing the right culture. This is done in various ways such as social engineering and road shows. The repeated attention to these three factors is necessary to activate the topic of information security and to remind and enable employees behave safely.

Tailored program for focus groups

In addition to the basic program, a tailored program runs every quarter for the focusgroup of that specific quarter. This approach will be repeated in the second year, meaning that each focusgroup will receive repeated attention. For each focusgroup, specific goals will be identified, given the nature of their work: what safe behavior should this group display in each case?

Subsequently, a barrier assessment takes place to investigate what is withholding this focusgroup from the target behavior. Finally, these insights are translated into concrete interventions: what does this focusgroup need to actually display the desired behavior? This methodology ensures that the actions taken match the needs of the focusgroup. For example, sometimes the analysis will show that the focusgroup benefits most from experiencing the urgency of an incident simulation. Another time it will be about creating support by setting up an ambassador network, or increasing motivation through a hack demo, or a highly targeted e-learning module to update a specific gap in knowledge.

Effect measurement

To measure the effects of the program, the measurements from the baseline measurement are repeated.