How can Care Ltd evaluate whether its cybersecurity awareness programme is contributing to improved protection?

### What a good answer covers - State that the awareness programme should be continuously monitored and improved. - Explain that measurable indicators can show whether the programme is progressing. - Connect the indicators to the cyber-risk metrics dashboard and management decisions. - Describe using results to adjust training rather than treating training as a one-time task. ### The concept Training is a protective measure because staff actions can affect information security. A metric does not prove that every individual will behave safely, but it can help management track whether planned awareness work is taking place and whether improvement is needed. Care Ltd specifically proposes awareness key performance indicators as part of its cyber-risk metrics. Measurement is most useful when it informs decisions and follow-up actions. ### Terms - **Key performance indicator**: a measure used to track progress toward an intended result. - **Cyber-risk dashboard**: a concise presentation of measures used to inform risk decisions. ### Remember Measure awareness to guide improvement, not simply to record that training happened.