TDNet Discover

The purpose of this phenomenological study using content analysis was to investigate the articulation and implementation of mandatory cybersecurity awareness for higher education institutions (HEIs) by examining and comparing publicly available mandates and directives, such as policies and guidelines. For the utility of this study, the articulation and implementation of cybersecurity awareness will be generally defined as the extent to which HEIs convey cybersecurity awareness within their publicly published materials, as well as the identification of common themes and gaps in these documents to highlight recurring patterns, strengths, and weaknesses in the defined practices. The theoretical framework was the SANS Security Awareness Maturity Model. This analysis evaluated publicly posted cybersecurity directive documentation from selected American HEIs. The primary research question was: How do higher education institutions articulate and implement mandatory cybersecurity awareness training as required by legal and regulatory mandates in their publicly available policies and guidelines? The study setting was American educational institutions listed on the Carnegie Classifications list. Data collection involved the retrieval and analysis of relevant publicly posted institutional documents. Inductive thematic analysis aligned with the SANS Security Awareness Maturity Model identified recurring themes, coverage gaps, and maturity levels among institutional practices. While institutions largely met compliance requirements and communicated cybersecurity awareness, they often lacked engagement strategies and demonstrated limited progress in improving security culture. The findings provided practical recommendations for expanding security awareness efforts within HEIs, including improving audience targeting and focusing content.