NZ Customs security awareness

Read on to find out how the partnership between Inspire Group and Customs created an innovative, engaging, impactful and practical solution which combatted the online and e-learning fatigue that existed post COVID-19.

Customs’ purpose is to protect and promote New Zealand across borders which means Customs has a responsibility to protect its people and the information it holds. It is vital Customs gets security right and raising organisational security awareness was the challenge that this learning campaign needed to address.

After the shift to working from home because of COVID-19, lots of Zoom meetings and pretty much all learning being done online, New Zealand Customs’ staff were fatigued and unexcited by the prospect of more e-learning. The level of security awareness around personal, physical and information security across Customs varied from basic to very aware.

The New Zealand Government’s Protective Security Requirements (PSR) assessment identified the need to ‘build security awareness’ across the organisation to meet heightened expectations on government agencies. Alongside the PSR assessment were the results of the internal Customs security survey which highlighted that some staff felt overwhelmed by the number of security expectations. The security awareness level needed raising and staff wanted to do the right thing but felt they didn’t have the knowledge, or they learned, then forgot.

Campaign rollout

A timed and layered approach was used to align with other security-themed events (i.e. Security week, Cyber security week), and the launch of updated security policies.  The two targeted refresher modules meant learners were able to revisit a topic in more detail and keep security awareness front of mind every few months to embed the learning and the habits.

Deliverables

Customs knew the Security Awareness learning needed to appeal to all Customs staff and, bearing in mind the online and e-learning fatigue that existed at the time, a variety of media should be employed to deliver the security awareness message. The Security Awareness learning campaign used types of learning that had not typically been used at Customs before like posters, screensavers and a graphic-novel-type approach in the modules. Customs wanted to change people’s perspective of learning.

The look and feel were kept consistent across all the learning products created so they became identifiable as being a part of the learning campaign.

The following deliverables formed a campaign-style approach to the learning:

• Screensavers designed to build interest for the launch of the training programme.
• A teaser interactive learning module around general security awareness.
• A more in-depth graphic-novel-like interactive module with five customised scenarios.
• A team leader/manager briefing pack to support staff through the training.
• Two further interactive e-learning modules on specific security topics designed as refreshers to keep security awareness alive.

Engaging scenarios

All scenarios used were personalised to Customs employees: relatable and practical.

They deliberately incorporated the simple, everyday things people take for granted.

The Insider Threat module had a ‘whodunnit’ concept giving the learner the ability to step into the world of each character before deciding the answer. The e-learning modules in particular really covered the ‘Why should I care?’ for the learner.

Branching scenarios were used within the e-learning to give the learner control over what they saw; if they selected the correct course of action in a scenario they could then go and see the consequences of having gone in another direction. This style of interactive learning scenarios puts the learner in a real-life situation which they can relate to from their own experience on the job.

It was necessary to use plain English in the modules and keep them short, relevant and non-technical, but also important to incorporate a level of complexity to keep learners engaged.

It was a well-rounded learning campaign that set out to not just to teach something but shift the organisation’s mindset and security culture. Word reached the Central Government Security Agency which ended up asking for access to the Customs modules and taking some of the concepts and content from two of the modules to include in the design of their modules for use across all government agencies.

The graphic-novel style of the modules was completely new to Customs and this really captured the imagination of staff. The concept of melding the comic-style graphics with real pictures in the background was very well received and reinforced the care and customisation of the content for its intended audience.

An evaluation plan was developed before the campaign was launched which was designed to gauge the following:

An increase in security-related reporting

Customs saw a definite shift in security culture/staff being more security aware. There has been a substantial increase in staff reporting security-related matters: increased by 10 times (pre- and post-campaign launch). This is continuing to steadily increase with the first 3 months of 2024 already surpassing 2 entire years pre-campaign.

Better quality data in reporting received

Pre- and post-campaign comparison (particularly in the last 12 months of the learning campaign) saw a noticeable improvement in the quality of security-related reporting. Reporting was seen as being more insightful and gave Customs a better understanding of what their people were experiencing. Time between an incident occurring and the reporting was also noticeably shorter – people were reporting faster.

Security discussions becoming more mainstream and commonplace

Customs wanted to get people talking in their teams as part of evidence of a security culture. This was done by designing a team briefing pack, launched as part of the campaign (Kirkpatrick-based monitoring driver) – team briefing sessions would drive the behaviour of peoples' continuing security awarensss.