Short · Education and training · 1 min read
A Cybersecurity Course Is Not a Learning Program
By Dr. Lin Clark
A full training calendar proves that classes happened. It does not prove an analyst can recognize compromised access, a manager can authorize containment, or a developer can spot a dangerous trust assumption. I want to know what people can do differently afterward.
The operational question
NIST SP 800-50 Rev. 1 recommends a lifecycle approach to cybersecurity and privacy learning, including evaluation and improvement (Merritt et al., 2024). I would define the job behavior first, then choose the course, exercise, or platform.
What the guidance actually says
Incident response requires coordinated activity across organizational functions (Nelson et al., 2025). A useful learning program includes people who approve disruption, communicate with customers, restore systems, and own business services, not just the security team.
Where the plan breaks
CSF 2.0 offers a structure for cybersecurity outcomes (Pascoe et al., 2024). I would build scenarios around decisions that actually arise: revoke access, isolate a service, approve a release, or accept an exception. A quiz may help, but it is not the final evidence.
The evidence I would ask for
Awareness, training, assessment, and monitoring are connected security concerns (Joint Task Force, 2020). Satisfaction surveys can show whether people liked a class. They cannot prove somebody will perform a critical action correctly under pressure.
The decision that matters
Trustworthy systems engineering considers the full operational lifecycle (Ross et al., 2022). Learning should change after incidents, architecture changes, and observed failures. Otherwise the curriculum becomes a museum of yesterday’s assumptions.
If you need a cybersecurity education program that changes what people actually do, I can help design it.
References
- Merritt, M., Hansche, S., Ellis, B., Sanchez-Cherry, K., Nethery Snyder, J., & Walden, D. (2024). Building a cybersecurity and privacy learning program (NIST SP 800-50 Rev. 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-50r1
- Nelson, A., Rekhi, S., Souppaya, M., & Scarfone, K. (2025). Incident response recommendations and considerations for cybersecurity risk management: A CSF 2.0 community profile (NIST SP 800-61 Rev. 3). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-61r3
- Pascoe, C., Quinn, S., & Scarfone, K. (2024). The NIST cybersecurity framework (CSF) 2.0 (NIST CSWP 29). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.CSWP.29
- Joint Task Force. (2020). Security and privacy controls for information systems and organizations (NIST SP 800-53 Rev. 5). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-53r5
- Ross, R., Winstead, M., & McEvilley, M. (2022). Engineering trustworthy secure systems (NIST SP 800-160 Vol. 1 Rev. 1). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-160v1r1