SSAP Exam Overview
The SSAP exam was created by the GIAC Exam Development team, the same professionals behind all GIAC certifications. If you already hold a GIAC certification, we recommend you still review the information below as there are some important differences you should know about.
What is the SSAP?
Organizations seek proven leaders who have the expertise and skills to effectively manage and measure human risk. The SANS Security Awareness Professional (SSAP) provides not only that expertise, but also identifies you as a leading expert in this growing field. The SSAP credential signifies, documents, and certifies that the holder has met the requirements to elevate and measure the overall security behavior of the workforce and an expert in this growing field. The SSAP is the most effective, comprehensive way to accelerate your career and advancement opportunities in the field of managing human risk.
MGT 433 Course Details
The MGT 433 course spans over an intense two-days. It teaches key concepts and skills needed to effectively secure the human element by establishing a mature security awareness program. This course will help you develop a program that goes beyond just compliance, by changing peoples' behaviors and create a secure culture.
- MGT 433 Course Overview
- MGT 433 Day 1: Plan and Build
- MGT 433 Day 2: Implement, Maintain, and Measure
Course content in MGT433: SANS Security Awareness: How to Build, Maintain, and Measure a Mature Awareness Program is based on lessons learned from hundreds of security awareness programs from around the world. You will learn not only from your instructor, but also from extensive interaction with your peers. You will develop your own custom security awareness plan that you can implement as soon as you return to your organization through a series of hands-on labs and exercises.
Day one of the MGT 433 Course will address:
- The five stages of the Security Awareness Maturity Model
- The three variables of risk and their role in awareness
- Why humans are so vulnerable and the latest methods cyber attackers use to exploit these vulnerabilities
- The learning continuum: awareness, training, and education
- Steps to gaining and maintaining leadership support
- How to develop and leverage an effective Advisory Board
- B.J. Fogg Behavior Model and how it applies to your overall strategy of changing workforce behavior
- Developing a strategic plan based on three key questions: Who, What, and How
- Who: Identifying the different targets of your awareness program. Whose behaviors do you want to change? NOTE: This section includes an interactive group lab where you identify and analyze key target groups in your organization
- What: Identifying and prioritizing the top human risks to your organization and the behaviors that will most effectively manage those risks. NOTE: This section includes two interactive labs, one conducting a qualitative risk analysis for your organization and a second lab on behavioral management by defining key learning objectives
In the second day of this course, participants will work collectively to understand:
- How: How will you communicate your program and train your workforce. This includes defining why cybersecurity is important to your organization, different training modalities and the most successful strategies to engage people.
- The effective use of imagery, to include imagery within diverse or international environments
- Top tips for effective translation / localization
- The two different communication methods: primary and reinforcement, and the advantages / disadvantages of each
- How to effectively develop and provide instructor-led training (ILT)
- How to effectively develop and deploy online / computer based training (CBT)
- Different reinforcement methods, including newsletters, fact sheets, posters, internal social media, hosted speaker events, hacking demos, escape rooms, lunch-n-learns and numerous other training activities. NOTE: This section includes an interactive lab combining a cultural analysis, communication methods, and different training modalities
- Long term sustainment for effective culture impact, to include gamification and ambassador programs
- Design, deploy, and leverage metrics to measure the impact of your awareness program, including how to effectively establish a global phishing program and measure culture. Note: This section includes an interactive lab in identifying and defining the top security awareness metrics specific to your program.
- Walking through the final planning and execution steps, to include documenting a comprehensive project plan
Benefits for Your Employer
By acquiring the SSAP, you gain valuable skills that help you grow your career. But what are the benefits to your employer?
This credential will demonstrate to your organization:
- You possess all the necessary knowledge and skill to build any size security awareness program. This includes launching new or compliance-based programs up to advanced, mature awareness programs covering all relevant threats and risks.
- That you have a baseline of “awareness program excellence.” SANS courseware and certifications is known throughout the cybersecurity industry as being the most-trusted and leading source of security training. Employers who provide this credential to employees can rely on the training they receive – it’s constantly updated, and covers practical, useful information that those building awareness programs can implement immediately.
Earn your Badge
Upon completion of the MGT 433 course and passing SSAP exam, individuals will receive a specialized digital badge, which includes information on when your SSAP was obtained and the particular skills acquired. This badge can be prominently displayed on professional networking pages, portfolios, signatures and on résumés to indicate this professional career enhancement.
Why SANS Security Awareness?
Drawing on over 25 years of experience in cyber security strategy and training, we leverage our fleet of the world’s best cyber threat experts and learning behavior professionals, making SANS the best choice for security awareness training. We'll help you create a best-in-class cyber security awareness training program, get leadership support for your program, connect with the community, and change user behavior.
