Operational Security Rules That Actually Work
A Practical Security Program for Mid-Sized Companies
For management and information security officers who need more than an attendance list: how to combine technical measures, security policy and employee training into a demonstrably effective protection system.
Why an Attendance List Does Not Protect You
An attendance list proves who was in the room—nothing more. What the German BSI Act (Section 38(3) BSIG) and ISO/IEC 27001 (Clauses 7.2 and 7.3) actually require is real security competence in everyday work.
The reason: damage only arises through actions. A phishing email does no harm as long as no one clicks. Payment fraud only succeeds when bank details are changed without verification or a payment is approved. Attendance prevents none of these errors—the right procedures do.
Rules That Work Even When No One Recognizes the Attack
It is not enough to impart knowledge and hope that employees will apply it correctly in an emergency. More effective are clearly defined rules and procedures that function even when someone does not recognize a threat or is uncertain.
Two long-term studies in organizations with more than 33,000 employees combined (IEEE Symposium on Security and Privacy 2022 and 2025) support this: annual mandatory training and training notices after an erroneous click made the handling of simulated phishing emails no safer, or barely so. A reporting button in the mail client, by contrast, sharply increased reporting. This leads to three principles:
- Default secure pathways: procedures where secure behavior is the normal and simplest path.
- Low-friction reporting: mechanisms that enable simple, constructive action in case of doubt.
- Operational metrics: measurements that show what actually happens in operations rather than merely documenting attendance.
The limit of the concept: it does not replace technical measures such as mail gateways, phishing-resistant MFA or EDR. These remain the responsibility of IT.
Questions the Whitepaper Answers
- What do we need to prove about training, and what does a record actually show?
- Which group in the company needs which rules and which training, in which format and for how long?
- How do we protect ourselves against fraud that no one can recognize?
- How do we know whether a rule is followed in operations, and where is the cause if it is not?
- How do we measure without bypassing data protection and the works council?
The Working Example: Four Target Groups, Four Formats
Muster Antriebstechnik GmbH is a fictional mechanical engineering company in East Hesse with 250 employees. Every rule stems from a risk the company has assessed, not from a catalog of topics. The concept divides the program into four tailored modules:
- Management (M1): a 90-minute briefing in Q1 and a 60-minute decision-making exercise in Q4, including the rule that payment instructions are never approved based solely on a phone call.
- Office workstations (M2a): a 60-minute session and four short modules over the year. Focus: reporting suspicious emails and using only approved AI tools.
- Production and logistics (M2b): 15-minute shift briefings led by supervisors, supported by concise reference sheets.
- Finance, HR and purchasing (M3): a 150-minute workshop with role-playing. Bank details and salary records are only changed when confirmed via stored contact details, documented and approved by a second person.
The Complete Whitepaper
In the full whitepaper, you can read what the studies show in detail, how a company protects itself against fake phone calls and how it checks whether its rules are followed in daily operations.
The Full Working Example
The full working example spans 165 pages, comprising the training concept and all documents for modules M1, M2a, M2b and M3, from the trainer guides to the assessment forms. It is available on request.
About the Author
Derek Carson—AI governance and information security, Künzell near Fulda, Germany. Passed the Lead Implementer exams for ISO/IEC 42001 and ISO/IEC 27001 · ISC2 Certified in Cybersecurity. Native English speaker, working in English and German. More about me
More whitepapers: Implementing NIS-2 on the Basis of ISO 9001 · Managing AI Risk in Your Enterprise