Introduction
Navigating the complexities of cybersecurity compliance is no small feat, particularly for organizations striving to meet the stringent CMMC 2.0 Level 2 requirements. The stakes have never been higher; protecting Controlled Unclassified Information (CUI) is not merely a regulatory obligation - it’s a vital business imperative. This article outlines ten essential steps organizations can take to achieve compliance, bolster their cybersecurity posture, and ultimately secure lucrative government contracts.
But with so many moving parts, how can organizations ensure they are not only compliant but also effectively safeguarding their sensitive information against the ever-evolving landscape of cyber threats? The answer lies in a strategic approach that addresses both compliance and security, ensuring that organizations are well-equipped to face the challenges ahead.
Establish a System Security Plan (SSP)
Creating a System Security Plan (SSP) is not just important; it’s essential for documenting the protective requirements and controls necessary to safeguard Controlled Unclassified Information (CUI) in accordance with federal regulations. This adherence is vital for maintaining eligibility for government contracts and funding opportunities. A comprehensive SSP should encompass the following key elements:
- System Description: Clearly outline the system's purpose and the types of information it processes, providing a foundational understanding of its operational context.
- Protection Measures: Detail the specific protective measures to be implemented, referencing the NIST standards. This ensures alignment with established guidelines and enhances the organization's protective stance, particularly for the security controls, which focus on safeguarding CUI.
- Roles and Responsibilities: Define the individuals or teams accountable for implementing and maintaining these protective measures, fostering accountability and clarity in management.
- Evaluation Processes: Describe the processes for ongoing evaluation of the effectiveness of protective measures, ensuring they adapt to evolving threats and regulatory requirements.
A well-structured SSP not only aids adherence to the CMMC requirements but also significantly enhances the overall security framework of the entity. According to a report by the U.S. Bureau of Labor Statistics, only 27% of entities have a documented SSP, highlighting a critical gap in cybersecurity preparedness. Cybersecurity experts emphasize that a robust SSP is foundational for risk management. By effectively documenting protective measures, companies can demonstrate their commitment to safeguarding sensitive information and mitigating risks associated with cyber threats.
Conduct a Gap Analysis
Conducting a gap analysis is crucial for organizations striving to meet CMMC 2.0 Level 2 requirements. In today’s landscape, where cyber threats are increasingly sophisticated, this process involves a systematic evaluation of current protective practices against established standards.
- Identify Current Practices: Start by documenting existing security measures and controls within your organization. This foundational step sets the stage for a thorough compliance assessment.
- Map to Standards: Next, compare these practices with the CMMC 2.0 Level 2 requirements. This ensures a comprehensive understanding of compliance expectations and highlights the unique challenges faced by many organizations.
- Identify Gaps: It’s essential to pinpoint areas where current practices fall short of the requirements. Recent data reveals that a significant percentage of companies struggle with this aspect, often reporting vulnerabilities in their security frameworks. Are you among them?
- Develop a Plan: Finally, formulate a strategic plan to address the identified gaps. Prioritize actions based on risk assessment and available resources to enhance your security posture.
This structured approach not only clarifies your organization’s adherence status but also outlines a clear path for improvement. Engaging cybersecurity professionals in this process is vital; their insights can illuminate common pitfalls and effective remediation strategies. For instance, organizations that have successfully identified and addressed deficiencies in their cybersecurity measures report improved compliance and reduced risk exposure. This underscores the importance of proactive actions in today’s evolving threat environment.
Implement Ongoing Monitoring and Maintenance
In today’s digital landscape, cybersecurity measures are not just important; they are essential for a robust cybersecurity strategy. Healthcare organizations face unique challenges, and understanding these challenges is crucial for CFOs navigating this complex environment.
- Conducting periodic audits of security controls is vital to ensure they function as intended. These assessments not only help identify gaps but also reinforce compliance with the regulations, supported by industry standards. Are your current practices up to par?
- Implementing automated monitoring significantly enhances security. These tools provide real-time notifications for suspicious activities, enabling organizations to react swiftly to potential threats. In fact, studies show that organizations using automated monitoring experience a 30% quicker detection rate of incidents compared to those relying solely on manual processes. Isn’t it time to upgrade your defenses?
- Drills: Regularly testing incident response plans through drills ensures that teams are prepared to act effectively in the event of a breach. These exercises not only enhance response strategies but also boost overall preparedness, aligning with advanced safety protocols necessary for higher levels of certification adherence. How ready is your team?
- Updates and Patching: Keeping software and systems up to date is crucial for cybersecurity. Organizations that prioritize updates can reduce their risk of exploitation by up to 60%, ensuring eligibility for lucrative government contracts. Are you prioritizing updates in your strategy?
Promoting a culture of ongoing enhancement in security practices is vital for upholding regulations and protecting sensitive information. With ongoing monitoring and management, navigating the complexities of certification becomes manageable. Take action now to fortify your cybersecurity posture.
Performing a self-assessment is essential for organizations seeking to meet and enhance their compliance. This process involves several key steps:
- Reviewing Controls: Assess the implementation of each control against established requirements, ensuring that all necessary measures are in place.
- Documenting Findings: Accurately record the results for each control, highlighting any deficiencies. Notably, a staggering 61% of companies have either not implemented or only partially implemented these controls, underscoring the need for improvement.
- Developing a Plan: Formulate a Plan of Action and Milestones (POA&M) to address any identified gaps. This is crucial for reducing risks and improving overall safety.
- Engaging Stakeholders: Involve relevant personnel throughout the assessment process to ensure comprehensive coverage and understanding of the safety environment.
Organizations that conduct self-evaluations not only prepare themselves for regulations but also strengthen their defenses against potential threats. For instance, a manufacturing company reported a 60% reduction in accidental data leaks within six months of implementing a peer-led 'Security Champions' program. This demonstrates the effectiveness of proactive measures. By prioritizing these steps, businesses can navigate the complexities of cybersecurity regulations and safeguard their critical assets.
Develop and Maintain Documentation
Effective documentation is essential for organizations striving to secure lucrative federal contracts by meeting CMMC 2.0 Level 2 requirements. In today’s landscape, where cybersecurity threats are ever-present, having a robust documentation strategy can be a game-changer. Here are the key components that every entity should prioritize:
- System Security Plan (SSP): This comprehensive document outlines the security controls and practices in place. It serves as a foundational element for compliance and enhances overall security, effectively mitigating risks.
- Policies and Procedures: These formalized documents detail the implementation and maintenance of protective measures. They ensure consistency and accountability throughout the organization, which is crucial for fulfilling mandatory requirements.
- Incident Response Plan: Clear procedures for addressing incidents, including defined roles and responsibilities, are vital. Organizations with documented incident response plans can reduce breach costs by an average of $1.49 million. This statistic underscores the importance of preparedness and the necessity of structured protocols to protect Controlled Unclassified Information (CUI).
- Training Records: Documenting employee training on safety practices and awareness is critical. Companies that conduct monthly safety training can reduce breach likelihood by 60%. This proactive strategy not only strengthens defenses but also ensures that entities are ready to respond effectively to incidents, minimizing potential disruptions and financial losses.
To maintain and enhance security, organizations must routinely review and update their documentation. This ensures that it reflects changes in operations, technology, and regulatory requirements. By adopting this proactive approach, entities can fortify their defenses and ensure they are prepared to respond effectively to incidents, ultimately supporting their ability to secure federal contracts.
Organizations must take decisive action to manage Controlled Unclassified Information (CUI) effectively. The importance of CUI management cannot be overstated, especially as organizations face increasing scrutiny under the new FAR CUI Rule. This begins with:
- Identifying CUI: Clearly determining which information qualifies as CUI within operations is crucial for compliance with the latest regulations. Are you aware of what constitutes CUI in your organization?
- Implementing Safeguards: Establishing security measures. This includes adopting multi-factor authentication, encryption, and continuous risk monitoring, all of which align with the updated GSA framework. How secure is your current system?
- Training Employees: Comprehensive training programs. Recent studies indicate that effective training reduces risks. Ensuring that all personnel understand the importance of CUI and how to handle it appropriately is critical for mitigating risks associated with data breaches. Are your employees equipped with the necessary knowledge?
- Documenting Handling Procedures: Clear procedures for the storage, transmission, and destruction of CUI must be created and maintained. This documentation not only supports adherence to regulations but also strengthens a culture of security within the entity. Is your organization prepared with the right protocols?
Understanding CUI is essential for achieving and safeguarding sensitive information. As entities navigate the complexities of compliance, it’s imperative to take these steps seriously. The implications of neglecting CUI management can be severe, making it essential for all government contractors to prioritize training and incident reporting obligations.
Conduct a Comprehensive Risk Assessment
Conducting a comprehensive risk assessment is not just a best practice; it’s essential for organizations striving to meet CMMC 2.0 Level 2 requirements. In today’s landscape, where cyber threats loom large, understanding and addressing these risks is paramount. This process should encompass the following key components:
- Identify assets: Start by cataloging all assets that process or store Controlled Unclassified Information (CUI). This crucial step ensures that all key elements are considered, allowing for focused protection strategies in line with advanced safety protocols.
- Identify threats: Identify potential threats to these assets, which may include cyberattacks, insider threats, and natural disasters. Understanding the threat environment is vital; in fact, 32% of enterprise risk management experts cite cyber threats as their primary concern. Are you prepared to face these challenges?
- Evaluate measures: Evaluate existing protective measures to determine their effectiveness against the identified threats. Regular assessments are critical, as only 8% of organizations conduct monthly assessments, while 40% do so annually. This gap underscores the urgent need for more proactive measures.
- Develop strategies: Develop tailored strategies to address identified risks, which may involve implementing additional security controls or policies. Effective risk management not only safeguards sensitive data but also enhances operational resilience. Moreover, preparing detailed documentation is essential to demonstrate adherence during audits.
Organizations must regularly update their risk assessments to reflect changes in the threat landscape and operational dynamics. This continuous vigilance is crucial for upholding regulations and protecting against emerging risks. Are you ready to take action and fortify your defenses?
Implement Access Control Measures
Access control measures are vital for protecting sensitive information and ensuring compliance with regulations. Here are the key components:
- Role-Based Access Control (RBAC): This method assigns access rights based on user roles, effectively limiting exposure to sensitive information. Organizations implementing RBAC have reported improved security by ensuring that only authorized personnel can access critical data, which is essential for meeting Level 1 requirements for safeguarding Federal Contract Information (FCI).
- Multi-Factor Authentication (MFA): The implementation of MFA significantly enhances security. Studies indicate that MFA can decrease the likelihood of account compromise by up to 99.9%. This layered defense requires users to provide multiple forms of verification, making unauthorized access considerably more difficult, aligning with the intermediate cybersecurity measures outlined in Level 2.
- Regular Access Reviews: This practice helps organizations identify and eliminate unnecessary access, further enhancing security, which is essential for maintaining compliance and protecting sensitive federal information.
- Audit Logs: These logs track user activity and ensure accountability. These logs provide valuable insights into user activity and can be instrumental in identifying potential risks, supporting the necessary documentation and reporting strategies required for compliance audits.
Implementing these measures not only fortifies the protection of sensitive information but also plays a crucial role in meeting compliance requirements, particularly the CMMC standards. Furthermore, organizations can gain from expert guidance and support during the official CMMC assessment to secure their certification.
Develop an Incident Response Plan
In today's digital age, cybersecurity is not just a necessity; it's a critical component of healthcare operations. An effective incident response plan is essential for safeguarding sensitive information and maintaining trust. Here’s how to ensure your organization is prepared:
- Team: Designate a dedicated team responsible for managing security incidents. This team should be supported by Cyber Solutions' 24/7 monitoring service, which detects suspicious activities before they escalate into serious threats.
- Roles and Responsibilities: Clearly define the roles of each team member during an incident. This clarity ensures that everyone understands their part in the response process, fostering a coordinated effort.
- Steps: Outline the necessary steps during an incident, including detection, containment, eradication, and recovery. Leverage comprehensive firewall and network protection solutions to enhance your defense against ransomware and phishing attacks.
- Reviews: Conduct thorough reviews after incidents to identify lessons learned and improve future response efforts. Ensure that documentation is meticulous and compliant with industry standards through incident response tabletops.
Regularly testing and updating your incident response plan is crucial. This practice ensures its effectiveness and relevance in the face of evolving threats. Are you ready to fortify your organization against potential cyber threats?
Implement Training and Awareness Programs
Implementing effective training and awareness programs is essential for cultivating a robust protective culture within organizations. In today’s digital landscape, where threats are increasingly sophisticated, the need for comprehensive training has never been more critical.
- Employees must be educated on identifying phishing attempts, social engineering tactics, and other prevalent threats. With human error accounting for over 90% of cybersecurity incidents and 70-85% of breaches caused by human conduct, this training is vital for organizational security. How can organizations expect to defend against cyber threats if their first line of defense—employees—aren’t adequately prepared?
- Customizing training to particular job functions ensures that employees obtain pertinent knowledge that corresponds with their duties. This targeted approach enhances engagement and effectiveness, as employees can relate the training to their daily tasks. Isn’t it more effective to equip staff with knowledge that directly applies to their roles?
- Training materials should be continuously refreshed to reflect the latest threats and protective practices. With cybercrime projected to cost the global economy $12.2 trillion annually by 2031 and the average cost of a data breach rising, staying current is crucial for maintaining resilience against evolving threats. Are organizations truly prepared to face these escalating costs without up-to-date training?
- Conducting regular drills is necessary to evaluate employee preparedness in responding to incidents. Approximately 78% of organizations experienced significant impacts from cybersecurity incidents in the past year, highlighting the need for preparedness. How can organizations ensure they are ready for the unexpected?
By integrating these elements into training programs, organizations can significantly enhance their security posture and foster a proactive security environment. The time to act is now—don’t wait for a breach to realize the importance of robust training.
Conclusion
Achieving compliance with CMMC 2.0 Level 2 requirements is not just a regulatory obligation; it’s a strategic necessity for organizations handling Controlled Unclassified Information (CUI). In today’s landscape, where cyber threats are increasingly sophisticated, organizations must take decisive action. By following ten key steps, they can build a robust cybersecurity framework that not only meets compliance standards but also strengthens defenses against evolving cyber threats.
Critical actions include:
- Establishing a comprehensive System Security Plan (SSP)
- Conducting thorough gap analyses
- Implementing ongoing monitoring and maintenance
Each step is vital for identifying vulnerabilities, enhancing security measures, and ensuring preparedness for potential incidents. Moreover, fostering a culture of training and awareness among employees is essential for minimizing risks associated with human error, a significant factor in cybersecurity breaches.
Organizations cannot afford to be complacent. Proactive measures, continuous assessments, and a commitment to compliance are essential for safeguarding sensitive information and maintaining eligibility for government contracts. By prioritizing these steps, organizations not only enhance their cybersecurity posture but also position themselves as trustworthy partners in an increasingly digital world. Taking decisive action today will pave the way for a more secure and resilient future.
Frequently Asked Questions
What is a System Security Plan (SSP) and why is it important?
A System Security Plan (SSP) is essential for documenting the protective requirements and controls necessary to safeguard Controlled Unclassified Information (CUI) in accordance with CMMC 2.0 level 2 requirements. It is crucial for maintaining eligibility for government contracts and protecting sensitive federal data.
What key elements should be included in a comprehensive SSP?
A comprehensive SSP should include the following key elements: 1. System Description: Outlining the system's purpose and the types of information it processes. 2. Protection Measures: Detailing specific protective measures aligned with the 110 controls in NIST SP 800-171. 3. Roles and Responsibilities: Defining individuals or teams accountable for implementing and maintaining protective measures. 4. Continuous Monitoring: Describing processes for ongoing evaluation of the effectiveness of protective measures.
What is the significance of conducting a Gap Analysis?
Conducting a Gap Analysis is crucial for organizations striving to meet CMMC 2.0 Level 2 requirements. It involves evaluating current protective practices against established standards to identify areas where practices fall short, ultimately leading to the development of a remediation plan to enhance cybersecurity posture.
What are the steps involved in performing a Gap Analysis?
The steps involved in performing a Gap Analysis include: 1. Identify Current Practices: Document existing security measures and controls. 2. Map to Compliance Requirements: Compare these practices with the 110 controls in NIST SP 800-171. 3. Identify Gaps: Pinpoint areas where current practices do not meet CMMC 2.0 Level 2 requirements. 4. Develop a Remediation Plan: Formulate a strategic plan to address identified gaps based on risk assessment.
Why is ongoing monitoring and maintenance essential for cybersecurity?
Ongoing monitoring and maintenance are essential for a robust cybersecurity strategy as they help ensure security controls function as intended, enhance threat detection capabilities, and prepare teams for effective incident response. This proactive approach is vital for compliance with CMMC 2.0 level 2 requirements and for protecting sensitive information.
What practices should organizations implement for ongoing monitoring and maintenance?
Organizations should implement the following practices for ongoing monitoring and maintenance: 1. Regular Audits: Conduct periodic audits of security controls. 2. Automated Monitoring Tools: Use automated tools for real-time threat detection. 3. Incident Response Drills: Regularly test incident response plans through drills. 4. Updates and Patching: Keep software and systems up to date to protect against vulnerabilities.
List of Sources
- Establish a System Security Plan (SSP)
- Top Cybersecurity Statistics: Facts, Stats and Breaches for 2025 (https://fortinet.com/resources/cyberglossary/cybersecurity-statistics)
- Key Cyber Security Statistics for 2026 (https://sentinelone.com/cybersecurity-101/cybersecurity/cyber-security-statistics)
- 110 security and compliance statistics for tech leaders to know in 2025 (https://vanta.com/resources/compliance-statistics)
- madsecurity.com (https://madsecurity.com/madsecurity-blog/system-security-plan-ssp-cmmc-nist-800-171-guide)
- upguard.com (https://upguard.com/blog/cybersecurity-metrics)
- Conduct a Gap Analysis
- CMMC Gap Analysis (https://coalfirefederal.com/resource/cmmc-gap-analysis)
- infosecinstitute.com (https://infosecinstitute.com/resources/security-awareness/powerful-security-awareness-quotes)
- The Top 20 Expert Quotes On Cyber Risk and Security (https://surtech.co.za/20-expert-quotes-on-cyber-risk-and-security)
- CyberSheath finds only 1% of defense contractors fully prepared for CMMC audits, warns of compliance gaps across DIB - Industrial Cyber (https://industrialcyber.co/reports/cybersheath-finds-only-1-of-defense-contractors-fully-prepared-for-cmmc-audits-warns-of-compliance-gaps-across-dib)
- Report finds large gap in CMMC readiness among defense industrial base (https://defensescoop.com/2025/01/28/redspin-report-cmmc-readiness-gap-2025-defense-industrial-base)
- Implement Ongoing Monitoring and Maintenance
- upguard.com (https://upguard.com/blog/cybersecurity-metrics)
- 205 Cybersecurity Stats and Facts for 2026 (https://vikingcloud.com/blog/cybersecurity-statistics)
- Five things to watch in cybersecurity for 2026 | Federal News Network (https://federalnewsnetwork.com/cybersecurity/2026/01/five-things-to-watch-in-cybersecurity-for-2026)
- jit.io (https://jit.io/resources/appsec-tools/continuous-security-monitoring-csm-tools)
- 45 Cybersecurity Statistics and Facts [2025] (https://onlinedegrees.sandiego.edu/cyber-security-statistics)
- Perform a NIST 800-171A Self-Assessment
- A Quiet Policy Shift Just Redefined Entire Federal Cybersecurity Landscape (https://forbes.com/sites/emilsayegh/2026/02/07/a-quiet-policy-shift-just-redefined-entire-federal-cybersecurity-landscape)
- 70 Cybersecurity Quotes Every Leader Should Know (https://deliberatedirections.com/cybersecurity-quotes)
- Reality Check: Defense Industry’s Implementation of NIST SP 800-171 (https://cybersecurityventures.com/reality-check-defense-industrys-implementation-of-nist-sp-800-171)
- Develop and Maintain Documentation
- Documentation: The Cornerstone of Cybersecurity (https://galacticadvisors.com/research/why-documentation-is-critical-to-your-cybersecurity)
- A Quiet Policy Shift Just Redefined Entire Federal Cybersecurity Landscape (https://forbes.com/sites/emilsayegh/2026/02/07/a-quiet-policy-shift-just-redefined-entire-federal-cybersecurity-landscape)
- How 2026 Will Reshape Data Privacy and Cybersecurity (https://founderslegal.com/how-2026-will-reshape-data-privacy-and-cybersecurity)
- 205 Cybersecurity Stats and Facts for 2026 (https://vikingcloud.com/blog/cybersecurity-statistics)
- Incident Response Statistics to Know in 2025 (https://jumpcloud.com/blog/incident-response-statistics)
- Understand Controlled Unclassified Information (CUI)
- A Quiet Policy Shift Just Redefined Entire Federal Cybersecurity Landscape (https://forbes.com/sites/emilsayegh/2026/02/07/a-quiet-policy-shift-just-redefined-entire-federal-cybersecurity-landscape)
- Proposed Rule Would Impose Government-Wide Controlled Unclassified Information (CUI) Handling Requirements - ConsensusDocs (https://consensusdocs.org/news/proposed-rule-would-impose-government-wide-controlled-unclassified-information-cui-handling-requirements)
- Fortinet Report Finds Nearly 70% of Organizations Say Their Employees Lack Fundamental Security Awareness (https://fortinet.com/corporate/about-us/newsroom/press-releases/2024/fortinet-report-finds-70-percent-of-organizations-lack-fundamental-security-awareness-for-employees)
- GSA Introduces a New Framework for Protecting CUI in Contractor Systems (https://natlawreview.com/article/gsa-introduces-new-framework-protecting-cui-contractor-systems)
- Security Awareness Training: USA 2025 Statistics | Infrascale (https://infrascale.com/security-awareness-training-statistics-usa)
- Conduct a Comprehensive Risk Assessment
- Risk Management Statistics 2025 — 45 Key Figures (https://procurementtactics.com/risk-management-statistics)
- 50+ Risk Management Statistics to Know in 2026 (https://secureframe.com/blog/risk-management-statistics)
- Top 12 Cyber Security Risk Assessment Tools For 2026 (https://sentinelone.com/cybersecurity-101/cybersecurity/cyber-security-risk-assessment-tools)
- The Top Cybersecurity Threats in 2026 & How to Prevent Them | Prime Secured (https://primesecured.com/top-cybersecurity-threats-2026-and-prevention)
- jdsupra.com (https://jdsupra.com/legalnews/new-cybersecurity-standards-will-impact-8102871)
- Implement Access Control Measures
- Eight Benefits of Multi-Factor Authentication (MFA) (https://pingidentity.com/en/resources/blog/post/eight-benefits-mfa.html)
- cisa.gov (https://cisa.gov/topics/cybersecurity-best-practices/multifactor-authentication)
- Industry News 2025 Will MFA Redefine Cyberdefense in the 21st Century (https://isaca.org/resources/news-and-trends/industry-news/2025/will-mfa-redefine-cyberdefense-in-the-21st-century)
- HIPAA TIP: The Importance of Multi-Factor Authentication - Anatomy IT (https://anatomyit.com/blog/hipaa-tip-the-importance-of-multi-factor-authentication-2)
- Why your business needs multi-factor authentication (https://sherweb.com/blog/security/multi-factor-authentication)
- Develop an Incident Response Plan
- Incident Response Statistics: How Do You Compare? | FRSecure (https://frsecure.com/blog/incident-response-statistics-how-do-you-compare)
- An Analysis of the Major Security Incidents and Cybersecurity News of 2025 - Hornetsecurity – Next-Gen Microsoft 365 Security (https://hornetsecurity.com/en/blog/cybersecurity-incidents)
- Incident Response Statistics to Know in 2025 (https://jumpcloud.com/blog/incident-response-statistics)
- CISA Shares Lessons Learned from an Incident Response Engagement | CISA (https://cisa.gov/news-events/cybersecurity-advisories/aa25-266a)
- cisa.gov (https://cisa.gov/news-events/news/cisa-announces-new-town-halls-engage-stakeholders-cyber-incident-reporting-critical-infrastructure)
- Implement Training and Awareness Programs
- Cybersecurity Awareness Training Trends for 2026 - Keepnet (https://keepnetlabs.com/blog/top-trends-in-cybersecurity-awareness-training)
- Why Cybersecurity Awareness Training is No Longer Optional in 2026 and Beyond (https://visiontechme.com/blog/why-cybersecurity-awareness-training-is-no-longer-optional-in-2026-and-beyond)
- What Every Company Needs To Know About Cybersecurity In 2026 (https://forbes.com/sites/chuckbrooks/2025/12/31/what-every-company-needs-to-know-about-cybersecurity-in-2026)
- Why Cybersecurity Training is the Smartest Investment for Organization in 2026 (https://uscsinstitute.org/cybersecurity-insights/blog/why-cybersecurity-training-is-the-smartest-investment-for-organization-in-2026)
- How Security Awareness Training Is Evolving (https://shrm.org/topics-tools/news/technology/how-security-awareness-training-is-evolving)
