Security training gap analysis in Company X
Annette Forsell · Theseus (Ammattikorkeakoulujen) · 2018
This bachelor’s thesis is conducted as a case study and is commissioned by a company that is called in this research as Company X. The objectives of this study are to determine gaps between of the case company’s security training system’s current and desired states by using gap analysis methodology. The identified gaps are improvement opportunities for the case company to ensure that their security training system is compliant with different requirements in the future. The current state of the case company’s security training system is researched to understand how security training is organized in the case company now. The current state analysis is conducted by running a quantitative questionnaire to the company’s employees, interviewing four managers and analysing the company’s current training materials. The desired state of the security training system is determined by using content analysis to study relevant acts, security standards and guidelines. The theoretical framework includes the desired state and functions of corporate security, successful security training systems and some pedagogics. The current state analysis indicate that the company’s employees are interested on their own and their employer’s safety and security. The case company educates employees in security, but the held training sessions are mainly focused on new employees and on current employees’ voluntary participation. Mandatory annual security trainings are carried by asking employees to read the case company’s Security & Safety guidebook and then sign a form that they have done this. Based on the conducted gap analysis there were identified gaps which are improvement opportunities. The case company is recommended to provide their employees with more regular security training and steadier updates on current security related topics. During the gap analysis there were identified some required subjects that are missing from the case company’s current security training program. These topics include remote working policy, mobile device policy, crypto graphic’s policy and threats of malwares. These topics are recommended to be added to the case company’s security training system in the future to ensure compliance with legislation and different security standards.