ISMS awareness campaigns effectiveness
A campaign worked if people understood it.
What the published 2016 guidance says
A campaign worked if people understood it. The construct tests a sample of the target group before and after the campaign, or after it where no baseline exists, and reports the share who pass. Illustrative bands are green from 90 to 100, orange from 60 to 90 and red below 60. Evidence is the campaign material, the list of people who followed it and the tests. It is collected one month after the campaign. HR owns and collects it, and the security manager is the client. A pie chart shows the pass rate and a line chart shows the trend where extra training followed a weak topic.
What it means in practice
A campaign is effective if people understood it. Test before and after, or test a sample after, and report the pass rate. The measure is about comprehension, not attendance, and the test questions should map to the campaign content.
Status of this record. For B.14, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Keep the campaign material, the target group and the test results. Count the pass rate after the campaign. Compare with the pre-campaign result if one exists. Use the failed questions to improve the content.
Evidence an assessor asks for
- Awareness and trainingCampaign material and distribution list
- Awareness and trainingKnowledge test and results one month after
- Awareness and trainingPie and line charts
The question an assessor will ask
An assessor will ask for campaign material and distribution list. The test for B.14 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Campaigns run with no test of understanding
- Tests set immediately after the campaign, measuring recall rather than retention
Before the next review
Before the next review, test this against one live record: campaigns run with no test of understanding.
What to check when the revision publishes
When DIS 27004 is published, compare the B.14 ISMS awareness campaigns effectiveness record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.