< Back - Energy & Utilities

Challenge 

ScottishPower required specific awareness and training activities to mitigate risks. It was crucial to provide targeted reinforcement activities, including awareness communications and training, to ensure employees in high-risk roles could effectively protect assets and information and could confidently model positive security behaviours in their job role.

Additional inhibitors were:
Role pressures: Fast-paced job roles can make it challenging to prioritise cyber security.

Business Insights: Employees may not understand how security applies to their specific roles, viewing training as outdated.

Cyber Knowledge: Lack of role specific cyber security knowledge can lead to unintentional mistakes.

Regulatory Compliance: Employees may not grasp the importance of regulatory compliance in their roles.

Insight or assessment

Before the development of the interactive role-based resources, TSC had a series of meetings with key stakeholders to understand the objectives and ensure the materials aligned with corporate plans and expectations, as well as complementing the overall context of ongoing training and development. The high-risk groups were identified based on:

• Threat intelligence: By analysing the types of threat actors targeting organisations like ScottishPower, we identified user groups more likely to be targeted by cyber-attacks.
• System and information access: Employees with access to sensitive information or systems, or those with authority to make or approve changes, were identified as a higher risk if their accounts are compromised.
• Authority to influence: Individuals in senior roles who influence the behaviour of others were identified as critical in championing security and secure behaviours.

Solution 

Based on the discussions, TSC designed two separate resources for eight different role types. The roles were:

1. Senior Management
2. Personal/Executive Assistants
3. Personal Data Processors
4. IT – Developers, Infrastructure and Desktop Admin
5. HR and Payroll
6. Finance and procurement
7. Field Engineers & Control Room Engineers
8. OT Technical Team

The desired outcome was for people in these roles to model positive security behaviours and strengthen cyber habits, including:

• Learning how to embed cyber security into strategic decision-making.
• Being able to identify and report phishing emails and security incidents.
• Understanding the importance of removing ID badges when leaving the office.
• Having knowledge of security policies and the steps to follow them.
• Knowing the importance of using strong, unique passwords.
• Understanding the common threats they will most likely face and how to act.

Approach 

Relevant

The content developed reflected ScottishPower’s high-risk user roles, real-time threats and organisational policies and procedures.

Measurable

Baseline data from threat analysis and incident reporting provided evidence of improved security behaviours and reporting levels.

Sustainable

As the resources are digital PDFs, they can be easily updated and aligned with policy changes or shifts in threat intelligence.

Result 

The interactive PDFs were distributed to the relevant audiences, who found the focused materials to be succinct and highly relevant.

“The brief was achieved as each guide was tailored to the daily tasks and challenges faced by the respective HRG. The flexibility of making last minute changes was appreciated.”

Services provided  

— Role-based content

— Bespoke communications

< Back - Energy & Utilities