Role-based security training
Role-based security training teaches the security knowledge and skills people need for their actual responsibilities, using the tasks, procedures, and tools involved in their work.
Start with the work
A help-desk agent who can reset MFA needs different practice from an employee who only needs to report an unexpected request. Someone who approves supplier bank changes has another set of decisions to make.
NIST SP 800-50 Revision 1 describes identifying relevant work roles and developing learning around their tasks. NIST’s AT-3 control covers the policies, procedures, tools, and methods people need to fulfill their security and privacy responsibilities. The approach includes management and operational work, not just technical administration.
A department name is only a starting point. Two people in finance may have different authority: one enters a requested change, while another approves it. Training should reflect what each can actually do.
Teach the decision, including the difficult version
For a help desk, that might mean practicing the approved verification steps and what to do when a caller cannot complete them. For a payment approver, it might mean checking new bank details through an established contact before authorizing a change.
Use the real procedure and the tools available to the learner. If the lesson says to escalate, make sure the employee knows where to send the case and what to do while waiting. A missing escalation route needs an operational fix as well as an explanation.
Completion records show who took the training. Practice can show whether they can perform the task under the conditions tested. Update the lesson when responsibilities, procedures, or relevant threats change.
Help-Desk Verification and Supplier Bank-Detail Changes cover two workflows where the details of the job matter more than a generic warning to be careful.