Awareness
- Cybersecurity awareness sessions
- Role-based awareness content
- Human risk awareness
Training & Awareness
Build practical cybersecurity awareness and strengthen incident readiness through training and exercises.
Last reviewed:
What is this service?
Cybersecurity training and awareness helps people recognise relevant risks and practise the behaviours their roles require. General awareness, technical training and leadership exercises have different learning objectives. JODOR scopes the audience, decisions and practical scenarios first, so sessions relate to the organisation's services and policies. Attendance alone is not evidence that behaviour changed or that an organisation meets every security obligation.
Who needs it?
This service supports new-starter awareness, role-based learning for privileged users and exercises for incident decision-makers. Programmes should accommodate language, accessibility and operational schedules. A short targeted exercise can be more useful than an undifferentiated course, particularly when teams need to practise escalation, evidence handling or decisions that affect customers and service availability.
TECHNOLOGY ALLIANCES
Technologies we deploy for this service
What we cover
Scope options
Exercises
- Tabletop exercises
- Incident simulations
- Crisis coordination exercises
Response skills
- Incident response training
- Role and escalation practice
- Lessons learned facilitation
How we deliver
Delivery starts with an agreed scope, named asset owners, access permissions, evidence requirements and a communication plan. For this service, the discussion includes Cybersecurity awareness sessions, Role-based awareness content, Human risk awareness, Tabletop exercises. Observations are connected to their source and business context, and assumptions are checked with the relevant owners. Work outside the agreement is raised explicitly rather than silently added. Review points and escalation arrangements help your team understand what has been completed, what remains uncertain and which actions depend on information or authorisation from you.
01
Discover
Understand audience, current readiness and learning objectives.02
Design
Shape sessions and exercises around agreed roles and scenarios.03
Deliver
Facilitate the training or exercise with relevant participants.04
Reinforce
Share observations and actions to strengthen future readiness.Deliverables
Deliverables connect the findings to the agreed business objective rather than simply export tool output. Recommendations identify rationale, relative priority, proposed ownership and dependencies on other teams or technologies. We distinguish verified observations from items requiring further evidence, and explain limitations that affect confidence. Sensitive material is handled under the agreed arrangements. A readout gives your team an opportunity to challenge conclusions and clarify next steps. Implementation, retesting and continued oversight are included only where the proposal explicitly defines them.
- Training plan and materials
- Facilitated awareness sessions
- Exercise observations
- Readiness improvement actions
Timeline
Timing is agreed after scoping and checking evidence readiness, system access and stakeholder availability. A bounded assessment may take several weeks; implementation or ongoing support needs a separate phased plan. The proposal identifies assumptions, dependencies and review points. Changes to assets, permissions or access can change the schedule. An indicative duration is not a universal delivery promise or a substitute for confirming your actual environment.
Frequently asked questions
How should awareness effectiveness be measured?
Agree measures that connect to the learning objective, such as scenario decisions, reporting quality or completion of a practical task. Attendance and quiz scores can help but do not capture every aspect of behaviour. Measurements should be proportionate and respect privacy. We distinguish training results from broader security outcomes, which also depend on usable processes, management support and technical controls.
What should we prepare before the engagement?
Prepare asset and service ownership details, relevant policies, available records and an approved way to share evidence. We discuss Cybersecurity awareness sessions, Role-based awareness content, Human risk awareness, Tabletop exercises. Access must be authorised before any intrusive or privileged activity begins. Missing information is recorded as a limitation and prioritised with your team, rather than automatically interpreted as proof that a control either exists or has failed.
How does the team turn findings into practical actions?
Findings should connect the observation, relevant risk and required control to a proposed owner and verifiable outcome. Management resolves competing priorities and decides whether to treat or accept risk within its authority. Closing a ticket alone does not prove that an issue has been removed. We explain suitable verification, with retesting or continued tracking included only when explicitly agreed in scope.
How long does delivery take, and is the schedule guaranteed?
Timing is agreed after scoping and checking evidence readiness, system access and stakeholder availability. A bounded assessment may take several weeks; implementation or ongoing support needs a separate phased plan. The proposal identifies assumptions, dependencies and review points. Changes to assets, permissions or access can change the schedule. An indicative duration is not a universal delivery promise or a substitute for confirming your actual environment.
Does this service guarantee compliance or prevent every incident?
No. The service supports assessment, improvement and evidence within an agreed scope; it cannot prevent every incident or confer regulatory approval. Applicable obligations depend on your activities, supervising authority and the requirements in force. Management retains responsibility for implementation, risk decisions and any formal submission. We describe what was and was not assessed so that a scoped finding is not mistaken for an organisation-wide guarantee.
Related services
Explore SAMA regulatory compliance guidance for this service
Request a proposal
Fill out the form and we'll get back to you soon
We reply within one business day.