# Chapter 4: User education and awareness

See also: [ISO_27002_2022_6.3_OT Information security awareness, education and training](../iso27diy-corp/Corpus/Standards/ISO-27002-OST/ISO27002-EN-2022/ISO_27002_2022_6.3_OT%20Information%20security%20awareness%2C%20education%20and%20training.md)

Repetition. Not only train, also educate.

- Establish Objectives
- Establish Baselines
- Create Program Rules and Guidelines
- Implement and Document Program Infrastructure
- Positive Reinforcement for reporting incidents
- Gamification
- Define Incident Response Processes

See appendix A for training templates.

https://www.csoonline.com/article/2134189/how-to-create-security-awareness-with-incentives.html

## Meaningful metrics
Here are some common totals to track: 
* Emails sent 
* Emails opened 
* Links clicked 
* Credentials harvested 
* Reports of phishing attempts 
* Emails not reported on 
* Hits on training sites



