---

name: security-awareness description: > Design security awareness programs — training curriculum, phishing simulations, metrics, role-based content, and compliance. TRIGGER when: user says /security-awareness or asks about security training programs. argument-hint: "[relevant context]" user-invocable: true

security awareness

Process

Step 1: Define Scope

Identify the boundaries of what to assess, who is involved, and what assets/processes are in scope.

Step 2: Identify Risks/Requirements

Risk/Requirement	Category	Severity	Likelihood
[item]	[category]	H/M/L	H/M/L

Step 3: Assess Current Controls

Control	Effectiveness	Gap
[control]	Strong/Adequate/Weak	[description]

Step 4: Prioritize Actions

Action	Impact	Effort	Priority
[action]	H/M/L	H/M/L	P1/P2/P3

Step 5: Develop Mitigation Plan

Risk	Mitigation	Owner	Timeline
[risk]	[strategy]	[name]	[date]

Step 6: Monitor and Report

Metric	Target	Frequency
[KRI/metric]	[threshold]	Weekly/Monthly/Quarterly

Output Format

## security awareness: [Scope]
### Risk Summary: [Key findings]
### Controls: [Current state assessment]
### Recommendations: [Prioritized actions]
### Monitoring: [KRIs and reporting cadence]

Quality Checklist

• Scope clearly defined
• Risks identified systematically
• Current controls assessed for effectiveness
• Recommendations prioritized by risk level
• Monitoring plan established
• Stakeholders reviewed findings

Edge Cases

• For rapidly changing environments, increase assessment frequency
• If data is limited, use qualitative assessment with expert judgment
• For cross-organizational risks, coordinate with all affected parties
• Adjust methodology based on regulatory requirements