TO: YOU AS CISO

FROM: James Preston, CEO

SUBJECT: Security Awareness Training Program

Im concerned about the new security awareness training program that you are rolling out across the company. It seems as though that you want all staff (including me) to participate in a two-hour training event in a few weeks. Why dont we just target those who seem to have more security incidents? We did spend nearly $100k on a helpdesk system to generate these kinds of reports that could be leveraged for this. I need to justify to the Board, the CFO, and department heads the costs of this training. As for me, Im afraid my schedule is too packed right now to complete this training on your timeframe. I will have to take it next time around.

So you are the CHIEF INFORMATION SECURITY OFFICER and JAMES PRESTON is the CHIEF EXECUTIVE OFFICER. The Chief Executive Officer brought this issue in a meeting

Im concerned about the new security awareness training program that you are rolling out across the company. It seems as though that you want all staff (including me) to participate in a two-hour training event in a few weeks. Why dont we just target those who seem to have more security incidents? We did spend nearly $100k on a helpdesk system to generate these kinds of reports that could be leveraged for this. I need to justify to the Board, the CFO, and department heads the costs of this training. As for me, Im afraid my schedule is too packed right now to complete this training on your timeframe. I will have to take it next time around.

What do you think as a CHIEF INFORMATION SECURITY OFFICER, what is your thought about this.