The majority of the employees at your company are honest and want to do the right thing. Sometimes, employees unintentionally violate security policies simply because they don't know what the policies are. In other cases, employees unknowingly do things that can place the company's assets and the employee's own safety at risk.

 

We strongly recommend that every company institute some type of "security awareness" training program for all employees. Security awareness training should be conducted for all new employees when they join the company. In addition, periodic security awareness training sessions should be conducted for all employees on at least an annual basis.

 

Is it worth the expense and effort to conduct security awareness training for every employee?

 

Having the employees of your company become part of the solution rather than part of the problem greatly leverages the effectiveness of your security program. It is our opinion that every dollar spent for security awareness training is worth at least three dollars spent for other types of security measures, such as security monitoring equipment or security guards.

 

An employee security awareness training program works best when it has been specifically developed for the unique requirements of your organization. Topics that should be considered for inclusion into your training program should include:

 

• The need for security at your company.

 

• The employee's role in loss prevention.

 

• Company security policies and procedures.

•  

• The problem of "tailgating": keeping unknown people from entering the building as you leave or enter.

 

• Confronting unknown or unauthorized people on the property.

 

• How to reports thefts and other security incidents.

 

• Personal safety and security while on company property.

 

• Using the "buddy" system.

 

• Security of confidential information.

 

• Social engineering and "pretexting" schemes

 

• Security of high-value assets.

 

• Limitations of existing security program.

 

• Benefits of the security program to employees.

 

We recommend that each training session be limited to about one-hour. This provides enough time for a presentation of approximately 40 minutes, and allows about 20 minutes for questions and answers. Ideally, training sessions should be limited to about 30 employees to permit full participation by all attendees.

 

Employee security awareness training sessions should be conducted in a positive, upbeat way that communicates to employees that the security program is as much for their own benefit as it is for the protection of company assets.

 

Many companies choose to conduct their periodic security awareness training sessions in the early fall (September or October). This is about the time that it begins to get dark early, and a time when employees are generally most receptive to learning about ways to improve their safety and security.

 

Who should conduct the training sessions? We strongly recommend that the security manager (or person who acts in this capacity) conduct all sessions personally if possible. This gives employees an opportunity to relate to the security manager in a positive and proactive way. (All too often the security manager is seen as the "company cop" who only comes around to investigate a theft or violation of company policy.)

 

Conducting security awareness training sessions is also a great opportunity for the security manager to hear about the "real-world" security concerns of the average employee.