What does it mean that the "people factor", not technology, is the key to providing...

If people are the key, but are also a weak link, more and better attention must be paid to this “component of security”. A robust and enterprise-wide awareness and training program is paramount to ensuring that people understand their IT security responsibilities, organizational policies, and how to properly use them to protect the IT resources entrusted to them.

This practice provides a strategy for building and maintaining a comprehensive awareness and training program, as part of an organization’s IT security program. The strategy is presented in a life cycle approach, ranging from designing, developing, and implementing awareness and training program, through post-implementation evaluation of the program. The document includes guidance on how IT security professionals can identify awareness and training needs, develop a training plan, and get organizational buy-in for the funding of awareness and training program efforts.