The city administration had not yet pursued a security awareness program. This made it impossible for it to make an objective assessment of the topics and areas of information security about which employees already had good knowledge, and where they needed more training. The first step was to change this. However, the city of Biel did not have the necessary knowhow internally. So, it decided to investigate further with an external provider.

A first assessment was carried out together with TreeSolution Security Awareness. With the Awareness Success ElevatorTM (ASE), on the one hand, the current situation was recorded, and, on the other hand, possible actions were indicated for improving the current situation and achieving a higher level of maturity.

The analysis presented the current situation based on 5 areas. It showed the level of maturity of the administration. The areas in which the city was already well positioned became clear, but also the ones in which improvement measures should be implemented to achieve a higher maturity level. To this end, possible measures were suggested in the analysis for each of the areas.

The goal for the city of Biel is to use the knowledge gained to develop a strategy and suitable implementation measures for the next few years to increase the maturity level and strengthen its "human firewall".

The following recommendations were made by TreeSolution:

• Create an overview with all the guidelines.
• Communicate regularly on the status of current security awareness. This promotes interest in the topic and knowledge among employees.
• Define the training orientation by target group and topic.
• Collect the most important indicators of awareness regularly.
• Create a medium-term and long-term roadmap with points that should be implemented and incorporated in order to reach further levels in the maturity model.
• Identify relevant stakeholders and target groups, together with the most important behavioral goals per target group.
• Create an overview of possible metrics and information regarding human resources.

Thanks to this analysis, the city of Biel now has a good starting position from which to develop a strategy for further awareness measures. It also has a list of possible indicators (KPIs) that it can use for evidence of required training. Thanks to the knowledge gained about target groups and topics, specific training courses can also be offered in addition to group-wide basic training. This builds and strengthens the information security culture, which leads to increased security through the “human firewall.”

The analysis with the Awareness Success Elevator^TM gave us clarity about our security awareness and security culture. We now have the tools in hand to define a clear strategy and develop a roadmap for training actions. We at the city of Biel now know which KPIs we need to measure, and which target groups and topics should be trained.”

Yannick Moutcho
Chief Information Security Officer, City of Biel

After the analysis with the Awareness Success Elevator^TM, the city of Biel decided to become a member of the Security Awareness Club and thereby gain access to extensive training material. This will be used to train employees with security awareness campaigns in the coming years. A first campaign has already been carried out.