Today we've released an updated version of our business case for a security awaeness program. I wrote the first complete version of this paper a few years ago, developing a set of ideas I'd had and written into budget applications and investment proposals over previous years. It gets updated every year or so to reflect the state of the art and remains one of the most popular white papers on our website.
I'm currently working on an ENISA project developing advice for organizations on building the business case for security awarness. The project team members represent a variety of experiences and backgrounds so it will be fascinating to see how things work out. I'm sure the end result of our work will be a useful and worthwhile document but, as is so often the way with collaborative projects of this nature, a productive team gets even more value from the writing process - sharing thoughts and methods, discussing common issues, explaining things and illuminating the topic as we go.