Level 1 of 5Aligned to NIST CSF 2.0
Comply
NIST CSF 2.0 Implementation Tier: Tier 1 · Partial The NIST CSF 2.0 Implementation Tier this level maps to. The crosswalk
The program meets the training requirement and counts activity: training completion and simulation clicks.
-
Level 1 · You are here
NIST CSF 2.0 Implementation Tier: Tier 1 · Partial
The program meets the training requirement and counts activity: training completion and simulation clicks.
-
Level 2
NIST CSF 2.0 Implementation Tier: Tier 2 · Risk Informed
The program observes behavior across several risk domains and knows who reports.
-
Level 3
NIST CSF 2.0 Implementation Tier: Tier 3 · Repeatable
Threat, access and behavior are joined per person, and the riskiest cohorts are ranked and targeted first.
-
Level 4
NIST CSF 2.0 Implementation Tier: Tier 4 · Adaptive
Playbooks orchestrate controls across the stack as risk changes, and the program proves its lift.
-
Level 5
NIST CSF 2.0 Implementation Tier: Beyond Tier 4
AI predicts which attack sequences are forming, and the program acts before the next step, at machine speed, for people and AI agents on one risk model.
Level 1 · Comply
What a level 1 program looks like.
The program complies: it measures what it delivers to meet a requirement. Training completion and phishing simulation click rate are the only numbers, collected from one platform and reported as organization-wide averages. Nobody in the program knows who attackers target or who holds sensitive access.
Day to day, the program sees training completion and simulation click rates from one awareness platform. It decides by calendar: every person gets the same annual course and the same monthly simulation, and a click earns a remedial module. It reports a completion percentage to auditors once a year. The security awareness lead owns it alone, with a budget for content and simulation licenses.
- Typical owner
- Security awareness lead
- What great looks like
- Training completion at or above the target the program set, for example 95%, and repeat clickers tracked by name.
Headline metrics to track
- 01Training completion rate
- 02Phishing simulation click rate
- 03Phishing simulation coverage
- 04Program reach and volume
Observable criteria
The six practices at level 1.
Criteria a security leader could confirm in a meeting, with the evidence to ask for and what moves each practice up.
- 01
See
One source, two numbers: training completion and simulation clicks.
- Training completion and phishing simulation click rate are the only numbers the program collects.
- All data comes from one platform: the awareness and simulation tool.
- Who holds privileged or sensitive access is unknown to the program, or lives in a spreadsheet that is rarely refreshed.
- Real attack targeting data from email security never reaches the program.
Evidence to ask for
The latest program report · The list of data sources the program reads
To level 2
Count reported simulations and reported real emails per person. Pull MFA enrollment per person from the identity provider. Ask email security for a monthly list of targeted people. Record the source and refresh date of every number the program reports.
- 02
Understand
Organization-wide averages; everyone gets the same attention.
- Results are reported as organization-wide averages.
- Every person receives the same training and simulation schedule.
- No person, team or cohort is ranked by risk.
- SOC incidents play no part in setting the program’s priorities.
Evidence to ask for
The latest program report · The training and simulation schedule
To level 2
Compute a per-person and per-team score from simulation and reporting results. List repeat clickers (three or more clicks in 180 days) by name. Ask the SOC for the count of human-related incidents by type over the last 12 months.
- 03
Act
The same training and simulations for everyone; no response changes a control.
- Every person completes the same annual training and the same simulation schedule.
- A simulation click triggers a remedial module at most.
- No response changes a control such as MFA, access or data loss prevention.
- There is no agreed time from a risky signal to an action.
Evidence to ask for
The training calendar · The simulation schedule · The rule that runs after a click
To level 2
Send a nudge inside 24 hours of a risky action. Pick two behaviors that trigger follow-up content. Agree a manual MFA reset path with the identity team for confirmed compromise.
- 04
Prove
Completion percentage for auditors.
- The program reports training completion and simulation click rate.
- The audience is the auditor or the compliance owner.
- No reported number connects program activity to incidents.
- Reports are produced once a year or on request.
Evidence to ask for
The last report sent outside the team
To level 2
Report the report rate next to the click rate, and the ratio between them. Report trends quarter over quarter per team. Send a one-page report to the CISO each quarter.
- 05
Govern
The awareness lead alone, with a training mandate.
- Human risk is owned by the security awareness lead alone.
- The program’s written mandate, where one exists, is training completion.
- Budget covers content and simulation licenses only.
- No policy names human risk or AI use.
Evidence to ask for
The program’s charter or mandate, where one exists · The budget line
To level 2
Write a one-page charter naming owner, scope, partners and reporting cadence. Add the GRC lead to the program review. Publish an AI acceptable-use policy.
- 06
Culture
Culture unmeasured; attendance is the only engagement number.
- Culture is unmeasured; event attendance is the only engagement number.
- Reports of suspicious activity are rare and uncounted.
- There is no channel to ask security for help before building something.
- Friction complaints reach security by chance.
Evidence to ask for
The engagement numbers in the last report · The intake channel, where one exists
To level 2
Count reports of suspicious activity each month. Open a help channel and log requests. Run a three-question pulse on NPS, friction and confidence.
Crosswalk
NIST CSF 2.0: Tier 1 · Partial
SANS: Level 2 · Compliance Focused
Risk is handled case by case and the program answers to audit findings; this is the nearest CSF tier.
The full crosswalk is in the methodology.
"Level 1: Comply", Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/maturity-model/level-1
HRM Maturity Assessment
Where does your program stand?
An initial assessment: 18 questions, about 4 minutes. Your level, six practice scores and a 90-day roadmap, shown immediately.
- Questions
- 18
- Minutes, about
- 4