{"id":259,"date":"2009-08-11T10:30:01","date_gmt":"2009-08-11T17:30:01","guid":{"rendered":"http:\/\/blog.cosaint.net\/?p=259"},"modified":"2023-01-24T06:57:08","modified_gmt":"2023-01-24T06:57:08","slug":"1-course-per-month-programs-why-i-dont-like-them","status":"publish","type":"post","link":"https:\/\/www.empowerelearning.com\/blog\/1-course-per-month-programs-why-i-dont-like-them\/","title":{"rendered":"1 Course per Month Programs – Why I Don’t Like Them"},"content":{"rendered":"

\"months\"Some organizations use a “1 course per month” approach to trickle security awareness training out to their staff – the intention being that they avoid overloading staff with a large amount of training upfront by dividing it up into more manageable chunks, and that the courses themselves act as periodic security reminders.<\/p>\n

It’s certainly an effective approach for the first year if you have a fairly steady (low turnover) staff. But there are a number of problems with the approach that I think negate or, at best, reduce its value.<\/p>\n

<\/p>\n

    \n
  1. It’s difficult to think up new topics after the first 12 or so, making each subsequent training module less effective.<\/li>\n
  2. Until the initial program has been fully completed, your training will be incomplete. For instance, you might be subject to a phishing attack before you’ve covered that topic in the training leaving you more vulnerable. Or your auditors may be a little worried that the program is incomplete if they look at your training records.<\/li>\n
  3. Staff joining after the program has started will have missed some of the topics. So they’ll need to do “catch up” training. This isn’t too much of a problem if they join in the first couple of months – they’ll only have a couple of additional courses to do. But 12 months later, the backlog can be considerable.<\/li>\n
  4. This system won’t meet the requirements of regulations or standards that specify completion of a training program at hiring and\/or before network access is granted.<\/li>\n<\/ol>\n

    Because of these shortcomings, I far prefer an approach based on:<\/p>\n