Security Awareness

What is Security Awareness?

Security awareness is the structured training, informing and engagement of employees so that they recognise cyber threats, work safely and report incidents promptly. It is not a single course but an ongoing programme that addresses knowledge, behaviour and culture together, which makes it a permanent part of an organisation-wide cybersecurity strategy. In OT environments the emphasis lies on different risks than in the office: infected USB sticks, contractor laptops, unintended changes to controllers and remote access to SCADA and HMI systems.

In OT, a human error can directly affect the physical process: downtime, lost product or an unsafe situation. That is why awareness matters at least as much here as it does in IT.

🎯 Why is security awareness so important in OT?

Technical measures do not cover everything. Many attacks start with a person who clicks a link, shares a password or plugs in an unknown device. Three characteristics make OT especially sensitive:

• Long system lifetimes — controllers and operator stations often run for ten to twenty years, sometimes with outdated software that cannot be patched straight away. Safe behaviour offsets part of that risk.
• Physical transfer routes — Stuxnet spread via USB sticks to systems without a network connection. An air gap therefore offers no protection against an employee who carries a stick across it.
• Many external parties — system integrators, OEMs and service engineers work with their own laptops and remote maintenance. They need to know the house rules too.

Awareness is one layer in defence in depth. A well-trained operator spots anomalies that no detection system sees, but does not replace a firewall or segmentation.

🧠 How does a security awareness programme work?

An effective programme follows a fixed cycle, as also described in NIST SP 800-50 Rev. 1 (September 2024). That publication supersedes the original SP 800-50 from 2003 and SP 800-16 from 1998, and puts the emphasis on behaviour change, culture and measurable results.

1. Identify risks per target group — operators, process engineers, maintenance technicians, IT administrators, contractors and management each face different risks.
2. Define goals and desired behaviour — for example: only scanned USB media, no shared accounts, report every suspicious email.
3. Train and practise — short e-learning modules, toolbox talks on the shop floor, phishing simulations and hands-on exercises.
4. Communicate and repeat — posters near the control room, short messages after topical incidents, a recognisable reporting point.
5. Measure and adjust — evaluate reports, click rates and audit findings, and update the programme every year.

Security awareness is not a one-off training but a continuous process woven into culture and working practice.

👥 Which target groups need which training?

A single generic e-learning module for everyone works poorly in OT. A role-based approach fits daily practice better:

🏭 Which topics belong in OT awareness?

• Social engineering and phishing — recognising fake emails, phone calls from so-called suppliers and requests for passwords
• Removable media — only use USB sticks that have first been checked on a scanning station; malware via USB remains a well-known route
• Access and accounts — no shared passwords, screen locking on operator stations, logging off after maintenance
• Changes to controllers — every change through change management, with a backup beforehand
• Reporting — whom do I call about a suspicious event, also outside office hours, and what must I leave untouched?
• Escorting visitors — suppliers and technicians only get escorted access to cabinets, network ports and engineering systems

The water incident in Oldsmar (Florida, 2021) shows the value of alert operators. An operator saw the mouse cursor move and the sodium hydroxide setpoint rise from 100 to 11,100 ppm, and reversed the change immediately. It later became disputed whether this was an attack or an operating error, but the event showed how much attentiveness and willingness to report matter.

🔍 What is the difference between security awareness and technical measures?

The two reinforce each other. A USB policy only works if employees understand why it exists, and training works better when technology blocks the unsafe alternative.

📜 Which laws and standards require security awareness?

Training is no longer an optional good habit. Several frameworks name it explicitly:

For board members, the Dutch Cybersecurity Decree requires a certificate stating the name, date, topics covered and provider. The regulatory burden assessment assumes almost nine hours per board member at a large company.

🧭 How do you set up an OT awareness programme step by step?

1. Map the starting point — which incidents and near misses occurred, which rules already exist, and who works with which systems?
2. Link it to your risk analysis — choose topics that match the largest risks in your risk assessment, not those of an off-the-shelf package.
3. Make it practical — use examples from your own plant, short sessions that fit shift patterns and instructions at the machine.
4. Train external parties too — include awareness requirements in contracts, in line with supplier security and IEC 62443-2-4.
5. Exercise incidents — a tabletop exercise lets operators, engineers and management walk through the incident response plan together, including the reporting obligation.
6. Measure the effect — track the number of reports, the click rate in simulations and findings from walk-arounds.

Many organisations choose an annual baseline training with short quarterly refreshers. Free in-depth material is also available: the US agency CISA offers online ICS courses and runs hands-on training at Idaho National Laboratory.

🔐 Which security goals does awareness support?

• Fewer unintentional errors — the biggest gain lies in mistakes, not malicious intent
• Faster reporting — an open reporting culture shortens the time between the first signal and incident response
• Support for policies on Remote Access, patch management and Backup
• Awareness of insider threats — training helps people recognise warning signs, but malicious insiders also call for technical and organisational controls
• Collaboration between IT, OT and security — a shared language about risk and availability
• Demonstrable compliance with IEC 62443, NIS2 and ISO 27001

❓ Frequently asked questions

How often should security awareness training take place?

Security awareness works best as an ongoing programme: an annual baseline training supplemented by short refreshers and campaigns throughout the year. NIS2 refers to training on a regular basis but does not set a fixed frequency. Organisations determine the interval themselves based on their risk analysis.

Is security awareness training mandatory under NIS2?

Yes, NIS2 lists basic cyber hygiene practices and cybersecurity training as one of the mandatory risk-management measures. Members of the management bodies of essential and important entities must complete training themselves. In the Netherlands this is worked out in the Cyberbeveiligingswet and the Cyberbeveiligingsbesluit.

What is the difference between security awareness in IT and in OT?

Security awareness in IT focuses mainly on email, passwords and data protection. In OT it also covers USB media, supplier laptops, changes to controllers and reporting abnormal process behaviour. Availability and process safety come first in OT.

Do phishing simulations work for operators?

Phishing simulations are useful for operators who use email, but they cover only part of the OT risks. For operators, practical exercises with USB sticks, unknown visitors and unusual HMI messages often work better. Simulations should teach rather than shame, otherwise the willingness to report drops.

How do you measure the effect of security awareness?

You measure the effect of security awareness with behavioural indicators: the number of reports of suspicious events, the click rate in phishing simulations and findings from audits and workplace walk-arounds. The number of completed courses says little about actual behaviour. A rising number of reports is often a good sign.

Do suppliers and contractors need security awareness too?

Suppliers and contractors often have far-reaching access to OT systems and therefore belong in the security awareness programme. Set out the requirements in contracts and give a short induction when they access the site. IEC 62443-2-4 describes security requirements for service providers of industrial systems.

📌 In summary

Security awareness turns employees in OT environments into an active layer of defence by teaching them to recognise threats, work safely and report incidents straight away. With role-based training, hands-on exercises and measurable goals, you meet NIS2, the Dutch Cybersecurity Act and IEC 62443, and reduce the risk of human error, social engineering and malware via USB.