Why Cyber Security Training Is Important

Why is cyber security training important, expressed as cost rather than risk? Because the direct loss from an incident is usually the smallest part of what follows.

The larger costs arrive afterwards. Investigation and forensic work to establish what was accessed. Legal advice on notification obligations. Notifying affected individuals, which is time-consuming and public. Downtime while systems are rebuilt or restored. Regulator engagement. Client and contract loss, which is difficult to quantify and often the most damaging.

Then there is the internal cost. Senior people spend weeks on it, and that time comes out of everything else.

Against that, awareness training is inexpensive. The difficulty is that it is spent against a cost you will never see, which is why it competes badly for budget until something happens.

The Australian Cyber Security Centre publishes incident guidance. This is general information rather than legal advice, and obligations vary by state and territory.

See Sentrient’s cyber security course and risk management system.