Level 2 of 5Aligned to NIST CSF 2.0
Observe
NIST CSF 2.0 Implementation Tier: Tier 2 · Risk Informed The NIST CSF 2.0 Implementation Tier this level maps to. The crosswalk
The program observes behavior across several risk domains and knows who reports.
-
Level 1
NIST CSF 2.0 Implementation Tier: Tier 1 · Partial
The program meets the training requirement and counts activity: training completion and simulation clicks.
-
Level 2 · You are here
NIST CSF 2.0 Implementation Tier: Tier 2 · Risk Informed
The program observes behavior across several risk domains and knows who reports.
-
Level 3
NIST CSF 2.0 Implementation Tier: Tier 3 · Repeatable
Threat, access and behavior are joined per person, and the riskiest cohorts are ranked and targeted first.
-
Level 4
NIST CSF 2.0 Implementation Tier: Tier 4 · Adaptive
Playbooks orchestrate controls across the stack as risk changes, and the program proves its lift.
-
Level 5
NIST CSF 2.0 Implementation Tier: Beyond Tier 4
AI predicts which attack sequences are forming, and the program acts before the next step, at machine speed, for people and AI agents on one risk model.
Level 2 · Observe
What a level 2 program looks like.
The program measures behaviors, with reporting first among them. Signals come from two or more risk domains and are shown per person and per team on a scorecard. A risky action earns a nudge or follow-up content, and trends are reported quarter over quarter.
Day to day, the program sees reported simulations, reported real emails, MFA enrollment and password manager adoption next to clicks. It decides from per-person and per-team scorecards refreshed on a fixed cadence, and it lists repeat clickers and non-reporters by name. A risky action triggers a nudge or follow-up content within days; a control change such as an MFA reset happens by manual request, case by case. It reports behavior trends quarter over quarter to the CISO. The security awareness lead owns it under a written charter, with the GRC lead as co-owner.
- Typical owner
- Security awareness lead with the GRC lead
- What great looks like
- Report rate above click rate across the workforce, and every team scorecard refreshed on the cadence the program set.
Headline metrics to track
- 01Report rate against click rate
- 02Phishing-resistant MFA coverage
- 03Share of behavior-triggered content
- 04Nudge volume
Observable criteria
The six practices at level 2.
Criteria a security leader could confirm in a meeting, with the evidence to ask for and what moves each practice up.
- 01
See
Behaviors from two or more domains, reporting counted, scorecards per team.
- Reported simulations and reported real emails are counted per person and per team.
- Behaviors from at least two risk domains are measured, for example simulation clicks and MFA enrollment.
- Privileged and sensitive access is listed from directory groups and refreshed at least quarterly.
- Every reported number has a named source and a refresh date.
Evidence to ask for
A per-team behavior scorecard with its refresh date · The directory export of privileged accounts with the date it was pulled · The source inventory with refresh cadence
To level 3
Connect email security so real phishing targeting is known per person. Join every source on the HR system’s person identifier. Sync privileged accounts from the identity provider on a schedule. Add a third and a fourth domain, for example endpoint and data handling.
- 02
Understand
Scorecards per person and team; repeat clickers named; incidents shared after major events.
- Each person and team has a behavior scorecard refreshed on a fixed cadence.
- Repeat clickers and non-reporters are listed as named groups.
- Priorities are set from simulation results and report rates.
- The SOC shares human-related incidents with the program after major events.
Evidence to ask for
A team scorecard · The repeat clicker list with dates · The last incident summary the SOC shared
To level 3
Define cohorts that combine two signals, for example targeted people who click, or risky people who hold payment authority. Rank the breach scenarios by last year’s incident counts. Agree a monthly review of human-related incidents with the SOC.
- 03
Act
Nudges and follow-up content after risky actions; control changes by manual request.
- A risky action (a click, weak MFA, an unsanctioned app) triggers a nudge or follow-up content inside a set number of days.
- Control changes such as an MFA reset or an access review are made by manual request, case by case.
- Behavior-triggered content is a measured share of all content delivered.
- Each nudge is logged per person with a timestamp.
Evidence to ask for
The nudge log for the last quarter · The share of behavior-triggered content · The list of manual control requests and their outcome
To level 3
Target campaigns at named cohorts and cut the whole-workforce schedule. Write the first three playbooks: trigger, audience, action, owner, time limit. Agree with the identity team which cohort gets step-up MFA.
- 04
Prove
Behavior trends quarter over quarter to the CISO.
- Behavior trends are reported quarter over quarter per team.
- Report rate is reported next to click rate.
- The CISO receives the report on a fixed cadence.
- Program reach (people, content, nudges) is reported.
Evidence to ask for
The last two quarterly reports · The distribution list
To level 3
Report stage 3+ people per priority breach scenario with a trend. Report cohort sizes against targets the CISO set. Map the program’s metrics to the control framework the organization follows.
- 05
Govern
A charter, GRC as co-owner, an AI policy, exceptions with expiry dates.
- A written charter names the owner, scope and reporting cadence.
- The GRC lead co-owns the program and maps it to the control framework.
- An AI acceptable-use policy is published and acknowledged by the workforce.
- Policy exceptions are recorded with an owner and an expiry date.
Evidence to ask for
The charter · The AI acceptable-use policy with its acknowledgment rate · The exception register
To level 3
Move ownership to CISO staff with the SOC as a standing partner. Start a monthly review with IT and HR and record decisions. Set a target per priority cohort and have the CISO approve it.
- 06
Culture
An annual survey; reports counted; a help channel; recognition for reporters.
- An annual survey measures attitudes to security.
- Reports of suspicious activity are counted per month, and the report rate is below the click rate.
- A help channel exists and each request is logged.
- People who report are recognized.
Evidence to ask for
The last survey results · The monthly report count · The help channel log
To level 3
Run a quarterly pulse on security NPS, perceived friction and confidence with a participation target. Name a security champion in each business unit. Set the target: report rate above click rate.
Crosswalk
NIST CSF 2.0: Tier 2 · Risk Informed
SANS: Level 3 · Promoting Awareness and Behavior Change
Leadership approves risk priorities and the program measures behavior, while practices still vary by team.
The full crosswalk is in the methodology.
"Level 2: Observe", Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/maturity-model/level-2
HRM Maturity Assessment
Where does your program stand?
An initial assessment: 18 questions, about 4 minutes. Your level, six practice scores and a 90-day roadmap, shown immediately.
- Questions
- 18
- Minutes, about
- 4