Sandvikens municipality
Since spring 2022, Sandvikens Municipality has been using NanoLearning to increase awareness around IT and information security. Niclas Berglund, the municipality’s Head of IT Security, already sees that the lessons sent out every third week have become a habit.– There’s more talk about IT security today, he says.
Previously, Niclas Berglund organized his own thematic trainings on topics such as phishing and password management, including follow-up quiz questions. And while participation in those sessions was higher than the number of people who have completed their NanoLearning lessons so far, Berglund notes that those were still one-off efforts.
– What we want is to create awareness that lasts over time—something that feels relevant in everyday life, both as a municipal employee and as a private individual.
To further strengthen employee attentiveness, Sandvikens Municipality has also added a small banner to all emails from external addresses, reminding recipients to pause and think before taking action. The banner is designed to change color a few times per year to prevent users from ignoring it out of habit.
– Many of our employees are already good at reporting things that seem suspicious, but we’ve seen that awareness increase thanks to the regular NanoLearning lessons.
Manager engagement is key
Even though the recurring NanoLearning lessons are starting to become a routine, that alone isn’t enough to build a sustainable security culture. Sandvikens Municipality ensures that all department and company heads receive regular reports so they can track how their employees are progressing through the training. One of the challenges is getting leaders to find the time and see the importance of IT and information security.
– We work hard to help managers understand how IT security is connected to information security. The war in Ukraine definitely pushed these issues higher up on the agenda, says Niclas Berglund.
IT security is a high priority for Sandvikens Municipality. The long-term challenge is maintaining high awareness and attentiveness. Niclas Berglund sees the upcoming phishing simulations as an effective method for that.
– Phishing tests are something we’ve considered for a long time, and the fact that they’re included as part of Junglemap’s information security course is a major benefit.
Three takeaways
Repetition
Turn IT security training into a recurring habit
Follow-up
Make it easier for managers to track their employees’ progress.
Context
Increase understanding of the connection between IT and information security.