Protection through Threat Scenario-led Risk Assessments
| Client: | Standard Chartered Bank |
| Sector: | Financial |
| Organisation reach: | 50 geographic locations, with a particularly strong presence in Asia and the Middle East |
| Audience | Managers, people in specific roles and an all employee (82,000) eLearning course |
| Programme type | Bespoke |
| Services | eLearning, webinars and campaign content |
| Delivery scale | Three webinars with 300 attendees; two eLearning courses for different audiences; crib sheets and interactive PDFs. |
| Programme timeframe | 12 months |
TSC delivered an all-employee eLearning course for 82,000 employees located in 50 countries. The course was delivered over a 12-month period. This was supplemented with a manager-specific eLearning course and the delivery of 3 webinars for people in specific roles. The pre-webinar survey and post webinar evaluation demonstrated that confidence and knowledge levels rose dramatically following the webinar.
Challenge
Standard Chartered Bank needed to introduce a new risk management approach that was more thorough and accounted for the ever-changing threat landscape. The new approach required changes to roles, responsibilities and specific working practices and methodologies.
Standard Chartered Bank required a programme that contained learning for all employees, supplemented with specific role-based training for managers and people in risk management roles. The change team also required a bank of physical and digital resources that would act as reference guides for people in critical roles.
Insight or assessment
Before the development of the training and associated resources TSC had a series of meetings with key stakeholders to understand the organisational context, the programme objectives and the main challenges. There was also a desktop analysis of the current risk management process and review of the documentation for the new Threat Scenario-led Risk Assessments (TSRA).
Solution
Based on the findings, TSC designed a bespoke programme combining a 15-minute eLearning module for all employees, a 30-minute eLearning role-specific module, and a series of role-specific webinars. The resource pack also included role-based crib sheets for first line of defence, second line of defence, CISO’s and ISRO’s. There were also interactive PDFs on risk management and governance and threat scenario-based risk assessment processes. The programme was tailored to the organisation’s risks, policies, audiences and brand.
Approach
Why this approach was different:
Relevant
The content across all deliverables was reflective of SCBs employee roles, real-time threats and organisational policies and procedures.
Measurable
The programme established baseline data in relation to knowledge and confidence of risk management procedures.
Sustainable
This programme provided point-in-time training, which was supplemented with a suite of resources acting as a permanent reference guide with role-specific requirements.
Services provided
— Security awareness training
— Bespoke learning content
— Role-based training and reference guides
Results
Training was delivered with a 92% completion rate. Webinars reached 300 critical stakeholders across the organisation in 50 global locations. The new threat scenario-led risk assessment was successfully introduced and continues to provide assessment practices which minimise the threat level that the bank faces.
Outcome summary
The successful delivery of the programme gave the security team clearer evidence of risk reduction and improved employee capability. The outputs of TSRA also produced more meaningful reporting to the senior leadership team.
“The TSRA methodology helps the Group have an holistic ICS threat management picture. Very valuable.”
Standard Chartered Bank