ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

SSCP guidance stresses that awareness efforts should address the organization's actual threat landscape, focus on the users who are most exposed, deliver concise messages through familiar channels, and include measurable feedback for continuous improvement. Sending monthly micro-training emails that teach finance staff how to spot finance-related spear phishing, reinforced by simulated phishing messages whose click rates are tracked, directly targets the at-risk audience, uses an inexpensive medium, and produces metrics to show whether the training is reducing risky behavior.

Forwarding generic guidelines to everyone provides no tailoring or measurement. Mandating an annual all-hands classroom session covers far more than the identified threat and costs considerably more while offering limited tracking. Disabling external email for finance would disrupt business operations and does not constitute an awareness communication. Therefore, the targeted, trackable micro-training with simulations is the most appropriate choice.