Information, Security & Privacy Matters Training (ISPM) eLearning Context and Design
description
Transcript of Information, Security & Privacy Matters Training (ISPM) eLearning Context and Design
Information, Security & Privacy Matters Training (ISPM)eLearning Context and Design
Presentation for STEPMay 2007
2
Legislative and Bank Requirements
The number of reported privacy incidents increasing Estimated that one million dollars of sensitive information is compromised every 90 seconds Policies and controls alone cannot deliver sufficient compliance in practice. Effectiveness depends on the actions of people within the organization
Increased electronic interactivity between banks and their customers has placed public focus on how banks manage information risk
Risk emerges from someone who is trusted and who interacts with sensitive corporate information as part of their everyday job
No integrated standardized enterprise-wide training program for employees to ensure they are aware of their responsibility for security in the use of BMO FG computer assets and networks
Personal Information Protection and Electronic Documents Act (PIPEDA) states: “Organizations shall implement policies and practices to give effect to the principles, including … training staff and communicating to staff information about the organization’s policies and practices”
Governments and regulators have addressed information management threats through the implementation of 18 other North American acts, policies & programs
During the 2005 Annual State of Privacy Report to the Conduct and Review Committee, the Privacy Office identified one gap in controls related to employee training and committed to developing a comprehensive, measurable, mandatory training program across Operating Groups to support privacy requirements in concert with Information Management and Information Security.
Information, Security & Privacy Matters: The Challenge
The Situation
The Problem
3
Integrating Multiple Initiatives
Privacy and compliance training delivered to the entire organization
3 other groups requesting regulatory & policy training
Information Security Information Management Desktop Security
Information Management
Desktop SecurityInformation Security
Privacy
The Request
Leverage Privacy request as a catalyst to drive the integration of all 4 groups
The Opportunity
Single deployment to users across the organization (instead of 4)
Reduction in development and deployment costs
Time savings: 4 initiatives expected 2 hours each > eliminated administration and content duplication
The Benefits
4
No vendor could supply 100% of currently defined content (IM, IS, Privacy) One vendor satisfied 50% of the content
One vendor had applicable elearning content readily available in both English and French Analyzed vendor integration options based on costs, risks and benefits Selected vendor to provide content
Meetings with TD, Scotia and Deloitte all indicated the number of modification to range between 40 and 60%
Implementation of vendor solutions typically require 9-14 month investment Experience from previous projects dealing with licensing results in ownership disputes over
who owns the customization of content and version control
Identified four vendor integration options:
1. Vendor to develop, host, and license total solution
2. License content only from vendor and customize
3. Buy content from vendor and customize
4. BMO to develop, host and build total solution Applied a cost and risk analysis that favored buying content (Option 3) Created a recommendation to buy existing content from vendor and build remaining
content in house.
Purchase the specialized vendor content Customize the content locally and avoid ownership disputes. Explore offshore development capabilities
Build vs. Buy Decision
Options
Vendor Analysis
Decision
External Experiences
5
The Solution
Challenge Solution
Platform: multiple platforms across various business groups & countries
Created 3 versions focused on learner experience: Flash, HTML, and Accessibility in both English & French
Customized: role specific learning required (not all roles have to take all the learning)
Created filtering questions to customize required learning by access to technology
Program Length: original request called for 4 programs, at approximately 2 hours each
Continuously prioritize content to eliminate duplication and decrease impact to Bank employees
Learner focus: reduce periods of time away from customers 15 minute topics allowed learns to complete the learning according to their schedule
Increase awareness: current baseline unknown Establish foundational baseline for futures programs
Customer focus: accommodate each of the Business Groups different business cycles
Deployed over a year, allowing Business Groups the ability to select their start and end dates based on their business demands
Branding: project became know as Compliance Learning CEO endorsed a message supporting the learning initiative as a key component in maintaining “Customer Trust”
Audience 40,000 full-time and contract employees 6 business groups Primarily North America, and also Asia,
Europe and Caribbean
Project objectives: Increase awareness of the importance of managing and protecting
information across the BankHelp mitigate the exposure of privacy, information, reputation, legal and
regulatory risk to the BankComply with IM, IS, and Privacy regulatory requirements
6
ISPM Learning Design
a
Learner Questionnaire: will define the Learning Path (LP)
LP1
No PC,Internet or email
LP 2
LP1 + People Manager
LP3
PC + Internet / email
LP4
LP3 + People Manager
LP5
LP3 + works at home / remote
LP6
LP5 People Manager
Information Security Topics*
• What is Information Security?
• Entry Control
• Classifying Information
• Clear Desk Policy
• Secure Disposal
• Password Control
• Systems Integrity
• Virus Control
• Electronic Communication
• Email: Open with Care
• Internet Security
• Securing Your Home PC
• Remote Access
• Security Out of the Office
• Social Engineering
• Incident Reporting
•Management and IT Responsibilities
Introduction (Information Management)
BMO Information Challenge
Privacy Topics*• Privacy at BMO• The Legislation• The Key Principles• Rules of Disclosure
Awareness Assessment
Avg. 2-3 hours depending on Learning Path 2hrs 3 hrs
*Avg. topic length = 7 min.
1
2
4
5
3
7
ISPM Learning
8
ISPM Learning
9
Reporting and Tracking
Organizational and Managerial Reporting:
Summary reports to meet legal requirements
Managers can view entire managerial hierarchy
Managers can change only direct reports
Existing User Database:
World-wide employee feeds, with multiple inputs into HR databases
Anomalies include frequency of updates resulting in accuracy issues
Sufficient for internal reporting for employee training records
Insufficient for the rigor of compliance
Reengineered Database:
Collectively leveraged best practices from previous deployments and addressed each anomaly to maximize accuracy
Reduced administration service calls by giving mangers local access and quality controls
Direct linkage to HR system to correct anomalies (i.e. leaves of absence, seasonal employees, etc)
Solution can be used for other deployments
The Problem
The Solution
Legislative And Bank
Requirement
10
ISPM Reporting
11
Off Shoring: Challenges and Solution
Pros Cons Learnings
Time Difference Full use of 24hrs during hand-offs improved workflow
Synchronous communication limited or not possible when required for immediate issue resolution
Required additional planning in order to leverage 24 hour efficiencies
Adjusted schedules in order to increase available meeting times
“On-call” process established at both ends
Culture & Working Relationship
“Yes” Willingness to please and offer flexibility in both work effort and expertise
Reluctance to say “no”, even if work effort was to impact priorities (eventually impacting timelines)
Emphasized that they not only had permission, but were expected to say “No” if for the benefit of the project
Language Forced complete and succinct documentation
Added increased complexity to communication
Often caused misunderstanding which required time to resolve
Change speech pattern (ie. Talk slower)
Continuously test for understanding
Holidays Worked through most of our holidays (ie. Christmas, Easter, etc.)
Required additional planning to leverage holidays efficiently
Distance No physical presence: Took longer to establish a strong
working relationship Missing body language
increased communication issues Took longer for them to
understand our business culture Impromptu idea collaborations was
difficult
Key members of each project team should meet at the beginning of the project (and at key points there after)
Exchanged team pictures Increased the frequency of
interactions through emails, conference calls and WebEx sessions
Create an approach to celebrate success
12
Questions
Questions
13
Appendix
Appendix
14
Breakdown of the content purchased vs. built including DSP overlap.
Buy Build
DSP Build
BMO Modifications required
Vendor content
50%
IS/DSP + Privacy
IM
20%
IS 26%
Privacy 4%
Content Comparison:
Preliminary analysis shows significant overlap between the content in the DSP awareness project and the IM awareness project.
DSP new content build
15
ISPM Learning Program Overview
There are five sections to the Information, Security and Privacy Matters learning program. The completion time is estimated between 2 to 3 hours in total, dependant on learner’s familiarity with the content, speed and number of required modules. The learning can be completed over several sessions.
Learner Questionnaire: Initially users complete a brief learner questionnaire about their role, their location, and the technology they use. This will determine which learning topics are applicable.
Information Management Scenarios (BMO Information Challenge): Next, users work through a series of 13 situations, providing advice on managing information appropriately. Their responses to these situations will give a measure of their information awareness and feedback on specific issues.
Privacy Topics: The third section of the training focuses on privacy legislation and appropriate privacy practices. If users work in the US, their four privacy topics will reflect the US privacy legislation. If they work in Canada or any other location than the US, their four privacy topics will reflect the Canadian privacy legislation.
Information Security Topics: In the fourth section, users work through a variety of topics focused on aspects of information security. The number of topics required depends on each user’s role and technology environment but they will always have access to both applicable and optional topics.
Awareness Assessment: Finally, users complete an awareness assessment covering content from the information management, privacy, and information security sections of the program. To successfully complete this training users must achieve a score of 80% on this assessment. If they do not reach the 80% mark, they can review the topics and then try the assessment again until they achieve a score of 80%. There is no limit to the number of assessment attempts.
1
2
3
4
5
16
ISPM Learning