Sourcing Security Awareness Content

The security awareness programme’s effectiveness depends not only on what is delivered and how often but on the quality, relevance, and engagement of the content itself. The content development strategy that the ISO must govern determines whether the programme’s delivery architecture is filled with the material that genuinely serves the programme’s behavioural objectives or the generic content that satisfies the schedule’s calendar requirements without the audience relevance and quality engagement that the culture transformation ambition demands.

The ISO faces a fundamental governance decision in content development that carries significant resource, quality, and operational implications: whether to develop content in-house using the organisation’s own expertise and resources, to procure content through a third-party vendor whose specialist content development capability and platform infrastructure the market provides, or to govern a hybrid approach that combines the advantages of both while managing the complexities that the combination creates. The right answer is not the same for every organisation, and the ISO must govern the decision through the evidence-based assessment of the organisation’s specific capability, resource, and requirement profile rather than the convention or cost optimisation that less deliberate approaches produce.

In-House Content Development #

In-house content development places the content creation responsibility within the organisation, drawing on the internal expertise of the security, HR, and communications functions to produce the materials that the programme delivers. Its primary governance advantage is the organisational specificity that internal knowledge enables, because the internal team’s familiarity with the organisation’s culture, operational context, specific risks, and workforce characteristics enables the content relevance that vendor-produced generic content cannot achieve without the significant customisation investment that the vendor relationship requires.

Advantages #

Organisational specificity is the most significant and most difficult to replicate advantage of in-house content development. The internal team can produce content that: