Explaination of More Personal Safety program designed and delivered by Safety Culture Initiative for public use and filling gap of human resources risk management at nation state and company level. First phase of MPS program is action "From Zero To Hero" delivered during Cybersecurity October to Poland and other countries in Polish and English language.

1. Human factor safety
decomposed

2. Overview Ask questions
• Why we fall with human
factor?
• How to manage human
factor?
Define
• Human factor – what is
about?
• Human factor decomposed
Analyze
• PEAR approach
• Dirty Dozen of human
errors
Simplify
• Focus on commonities
• Build more personal
security approach

3. Why we fail with human factor?
Because:
• Matter is far complex that looks like (you can’t force behavior)
• We are focused on quick remediation (keep incident statistics low)
• We are organizational centric (focused only on job side of life)
• We are self-limited by tools and knowledge (budget limitation)
• We create siloses (separation of topics and domains: real vs cyber,
private vs proffessional, test vs production)
We should decompose problem into smaller, managable components

4. How to manage situation of human factor?
• Learn about human factor from industry where is well described
• Learn the dirt dozen of human factors study for aviation industry *
• Learn to identify human factors presence
• Analyze human factor impact
• Plan the remediation actions
• Measure remediation actions
• Re-analyse human factor impact
* https://www.faa.gov/regulations_policies/handbooks_manuals/aircraft/media/AMT_Handbook_Addendum_Human_Factors.pdf
EASY TO SAY, HARD TO DO IT!

5. Simple answer
Develop human competences supporting process
and position safety responsibility to reduce time
for employee adoption to employer requirements
by continous role based security training and
testing of these competeces.

6. How to find and understand answer?
Define
problem
Analyze
details
Change
perspective
and find
similarities
Build
(synthesis)
conclusions

7. DEFINE PROBLEM

8. Human Factor vs Human Factors
• Human factor is commonly used term to determine impact of human behavior to
the process output
And in details
• Human factors is a term that covers the science of understanding of human
capability, application of this understanding to the desing development,
deployment of systems and services, and the art of ensuring successful
application of human factor principles into the maintenance working
enviroment*
Human factor can be decomposed, understand and managed based on second
definition!
* https://www.faa.gov/regulations_policies/handbooks_manuals/aircraft/media/AMT_Handbook_Addendum_Human_Factors.pdf

9. Human Machine –what determine your activity
List of components that determines Human activity:
• Human factors
• Human limitations
• Human capabilities
• Mental state
• Emotional state
• Physical state
• Enviromental conditions

10. PROBLEM DECOMPOSITION

11. Human Factors decomposed part 1
List of human factors disciplines:
• Clinical psychology
• Experimental psychology
• Educational psychology
• Organization psychology
• Anthropometric science
• Cognitive science
• Medical science
• Computer science
• Safety Engineering
• Industrial Engineering

12. Human factors decomposed part 2
Historical approach:
1487 – Leonardo DiVinci determines human limitation by Vitruvian
Man description
~1900 challenge-response system introduction in medicine: „scalpel” –
doctor request, „scalpel” – nurse response
~1900 human to machine compatibility by trial and error approach
Around World Wars – human limitations and advantage of human
capabilities for equipment/tools suite and controls and displays easier
for operators to use

13. Human factors decomposed part 3
PEAR model:
• People who do the job
• Enviroment in which they work
• Actions they perform
• Resources neccessary to complete the job

14. Human factors decomposed part 4
• Physical
• Physical size
• Sex
• Age
• Strength
• Sensory limitations
• Physiological
• Nutritional factors
• Health
• Lifestyle
• Fatigue
• Chemical dependency
• Psychological
• Workload
• Experience
• Knowledge
• Training
• Attitude
• Mental or emotional state
• Psychosocial
• Interpersonal conflicts
„People who do the job” factors:
Encourage the workers!

15. Human factors decomposed part 5
• Physical
• Weather
• Location inside/outside
• Workspace
• Shift
• Lighting
• Sound level
• Safety
• Organizational
• Personnel
• Supervision
• Labor-management relations
• Pressures
• Crew structure
• Size of company
• Profitabilitiy
• Morale
• Corporate culture
„Enviroment in witch they work” factors:
Create friendly enviroment!

16. Human factors decomposed part 6
• Actions
• Steps to perform a task
• Sequence of activity
• Number of people involved
• Information control requirements
• Knowledge reqirements
• Skill requirements
• Altitude requirements
• Certification requirements
• Inspection requirements
„Actions they perform”, Job Task Analysis (JTA) factors:
Identify & manage job tasks!

17. Human factors decomposed part 7
• Resources
• Procedures, work cards
• Technical manuals
• Other people
• Test equipment
• Tools
• Compuers and software
• Paperwork and signoffs
• Neccesairy equipment
„Resources neccessary to complete the job” factors:
Provide&monitor resources!
• Workplace helpers
• Fixtures
• Aterials
• Task lighting
• Training
• Quality systems

18. So far, so complicated...
IF THIS WILL BE EASY, EVERYONE WILL KNOW THE ANSWER

19. There is not considering the whole
human activity,
There’ s no need to take everything
into equations
Just focus on human errors!

20. ROOT CAUSE – HUMAN ERROR ANALYSIS
EVERYONE MAKE MISTAKES, ONLY FEW LEARN FROM THEM

21. Human factors – human failure types
https://www.energyinst.org/technical/human-and-organisational-factors/human-and-organisational-factors-human-failure-types
Mistakes Lapses Slips
Knowledge-based
Rule-based
Attention
Memory
Competition
Attention
Exceptional
Situational
Organisational benefit
Personal benefit
Routine non-compliance Routine errors
Human failures
Unintended actionsIntended actions
Non-
compliances
Non-compliances - Intended consequences
Unintentional non-
compliances
Reckless
Errors - Unintended consequences

22. PERSPECTIVE CHANGE
LESSONS LEARNED FROM AVIATION INDUSTRY

23. Human factors decomposed – Dirty Dozen
• Lack of communication
• Lack of knowledge
• Lack of teamwork
• Lack of resources
• Lack of assertiveness
• Lack of awareness
• Originated from 1980s-1990s incidents by Transport Canada
• Identified most common 12 factors of human failure (no order):
Identify root cause of human failure incidents!
• Complacency
• Distraction
• Fatigue
• Pressure
• Stress
• Norms
http://www.skybrary.aero/index.php/The_Human_Factors_"Dirty_Dozen"
https://maritimecyprus.com/2016/12/27/the-deadly-dozen-12-significant-human-factors-in-maritime-safety/

24. Dirty dozen – Lack of communication
Issues:
 Poor or non existing communication
 Lost in transmission
 Information reciver can make
assumptions about communicate
 You should know that only 30% of verbal
communication is understood
 You should know that usually begining
and end of message is understood
 Body language is misunderstand or
neglected in person-to-person
communication
Countermeasures:
Write down complex instructions
Use checklists, logbooks, to communicate
work progress
Never assume that the work has been
completed
Ask if not understand
Reconfirm if not sure
Beware of culture effect on message
interpretation
Pay attention to body language
Always repeat most critical part of
message at the end

25. Dirty dozen – Lack of knowledge
Issues:
Acting based on outdated
documentation can create chaos or
error in process
Performing jobs without prior
training could put employee in risk
and damage company reputation
Attempt to solve issue without
knowledge and skills how to do it
efficiently may turn issue into crisis
Countermeasures:
Perform only job you are trained to
Do not try to help if you do not
know how
If you do not know, ask for help
Update your knowledge and
documentation to current state

26. Dirty dozen – Lack of teamwork
Issues:
Single point of failure
Knowledge, power, operations
concentration – creating „bottle neck”
situation
Resource wasting due to lack of
understanding of common goal
Communication degradation due to
social issues or lack of human
resources
Wasting resources due to competence
proving
Countermeasures:
Encourage team playing approach and
communication
All team members need to understad
common goal and way to cope with it
including their duties
Promote co-workers with safety in
mind
Promote disscusion to solve issues
Diverse skills and points of view
Encourage challenge
Celebrate success

27. Dirty dozen – Lack of resources
Issues:
Safety and quality concerns due to
improvised or outdated resources
 Creating pressure on employee
that strenghtened other human
error components
Impact compliance and safety by
employee actions of crossing the
border or forced creativity
Countermeasures:
Plan resource utilization, maintain
resources and assets supply
Manage resources lifecycle
Optimize resources utilization
Request for resource if safety can
be impacted
Don’t agree with safety violations –
probably you will take
responsibility when something will
go wrong

28. Dirty dozen – Lack of assertiveness
Issues:
Suppress the concerns, feelings,
opinions, beliefs and needs
Continue to use culture of fear and
false responsibility
Falsing or failing the communication
and avoid resolving the root cause of
problem
Creating false/fake picture with
generalization
Countermeasures:
Never compromise your standards
Provide clear feedback when a risk or
danger is perceived
Speak up keeping calm, rational and
using specific examples rather
generalisations
Always direct criticism at actions and
their consequences rather than
people and their personalities
Invite feedback
Realize that It’s YOUR duty, your
decision and future

29. Dirty dozen – Lack of awareness
Issues:
Lack of role and impact
understanding can cause serious
damage to the employee or
company
Lack of visibility can lead to tunel
vision and affect actions or
effectiveness
 Lack of foresight can lead to
serious incidents impacting
human life or company brand
Countermeasures:
Use checklists, logbooks, etc.
Don’t assume situation, ask for
clarification, ask for checkup
Constant questioning „what
if...?”
Promote to bexperience by
knowledge sharing and
situational awareness
Promote developing foresight

30. Dirty dozen – Complacency
Issues:
Relay on memory/custom/habit
Have a good faith with tendency
to neglect the obvious message
Overestimate strenghts,
realiability,
Ingore the warning signals, going
rouge in sack of custom
Countermeasures:
Always expect something could
go wrong
Never sign off on something
that you did not fully verify or
provide
Always double check your work
Never put yourself in risky
situation counting on luck or
experience

31. Dirty dozen – Distraction
Issues:
Distracted employee can easly
miss part of the process and
create defect
Can be caused or strenghtened
by other factors like fatique,
stress, complecancy to greatly
impact the productivity
Introduce delays, errors and
mistakes driven by chaotic or
messy job performance
Countermeasures:
Use detailed checklist
Secure your workplace and
tools, keep it safe and clean to
avoid unexpected
If you can’t focus on job, take a
break to remove distraction
Resuming job, go back and
double check what you think is
already completed

32. Dirty dozen – Fatigue
Issues:
Fatigue employee can make
harmful decisions,
When symptoms are ignored can
cause rapid fall down situation that
could be risky for health
Attempts to finish the job for any
cause could seriously damage
process and employee because
error or lost of control over tools
Strenghten negative impact and
probability of occurence when in
conjunction with other factor
Countermeasures:
Take care of yourself, eat healthy,
be active and maintain regular
sleep patern
Put down complex tasks if you
know that you are exhausted
Be aware of the fatigue symptoms
in yourself and coworkers
Manage short breaks to refresh
mind and body muscles

33. Dirty dozen – Pressure
Issues:
Regardles if self induced or
external, pressure can impact
process or product in way that
damage organization reputation
Creating false picture about job
conditions or covered trading
jobs can impact project deadline
or client relations with your
company
Countermeasures:
Ensure that pressure is not self
induced
Ask for extra help if time is an
issue
Communicate if you think you
will need more time to complete
job rather than rush through it

34. Dirty dozen – Stress
Issues:
If demands are too high or not
managed subconscious will
response with stress impacting
overall employee posture
Stress greatly strenghten employee
response to other factors,
increasing risk of damage to the
employee or error to the process
Countermeasures:
Reduce stress level by take time off
or a short break
Ask co-workers to monitor your
work
Excercise, eat healthy and have
sufficient ammount of rest to keep
stress level under control
Know you limits and communicate
this when expectations wil rease

35. Dirty dozen – Norms
Issues:
Crossing the line to the standard
violation in most cases is wrong
idea causes losses and potential
harm to the employee
Keeping wrong norm as standard
operation procedure or silent
employee agreement can harm
employee, impact process or
company in serious way
Countermeasures:
Ensure that everyone follows
the same standard
Even if something looks normal
does not make it correct
The easiest way of
accomplishing something may
not be the standard
Eradicate negative standards by
rising discussion about them

36. What is the common factor for human error?
LOOKING BEHIND THE COURTAIN OF HUMAN BEHAVIOUR

37. Again humans are specific machines, able to adopt
to the changing conditions, but this takes time.

38. Most of the human behaviour can be
explained by set of human abilities.

39. Following this approach allows to define errors as
manifestation of lack of human adoption because
of ability shortage.

40. Desired answer to the question:
How to limit human errors?
Is following:
By developing abilities supporting human adoption.

41. Any awareness program or training
will be effective only if auditorium has
developed specific subset of human abilities
required to understand, remember and use
learned skils and knowlede.

42. Ideal awareness program should help
developing relevant human abilities for
increasing effectivenes of skills or knowledge
adoption, and ultimately reduce the chance
for errors or mistakes occurence.

43. Mapping Dirty Dozen of human errors to the
human abilities set underlying safe behaviour
12 human error causes
countermeasured with 36
advises expresed in
language of 46 human
abilities related to safe
behaviour creates
matrix of human error
cause – countermeasure
human abilities
DirtyDozencomponent
Advise1
Advise2
Advise3
Identify
Protect
Detect
React
Recover
Respect
Privacy
Prudence
Assertiveness
Exemplar
altruism
assertiveness
thebalance
intransigence
vigilance
inquisitiveness
flexibility
empathy
individualism
communication
leaderhip
loyalty
wisdom
independence
responsibility
care
confidence
planning
senseofownership
havingapersonalculture
sacrifice
Respectforsomeoneelse'sproperty
lawfully
rationally
prudence
reliability
self-improvement
self-reliance
self-control
self-consciousness
meticulousness
effectiveness
observation
justice
awarenessoftheconsequences
awarenessoftheenvironment
resourceawareness
technicalskills
credibility
cooperation
imagination
perseverance
management
Lack of communication
Use checklists,
logbooks, to
communicate work
progress
Never assume that the
work has been
completed
Ask if not understand x x x x x x x x x x x x x x x x x x x x
Lack of knowledge
Perform only job you
are trained to
Do not try to help if you
do not know how
If you do not know, ask for help x x x x x x x x x x x x x x x x x x x x x
Lack of teamwork
Encourage team play
and communication
All team members need
to understad common
goal and way to reach it
including their duties
Promote disscusion to solve
issues
x x x x x x x x x x x x x x x x x x x x x x x x
Lack of resources
Plan resource
utilization, maintain
resources and assets
supply
Manage resources
lifecycle
Don’t agree with safety
violations – probably you will
take responsibility when
something goes wrong
x x x x x x x x x x x x x x x x x x x x x x x
Lack of assertiveness
Never compromise
your standards
Provide clear feedback
when a risk or danger is
perceived
Invite feedback x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x
Lack of awareness
Use checklists,
logbooks, etc.
don’t assume situation,
ask for clarification, ask
for checkup
Constant questioning „what if...?” x x x x x x x x x x x x x x x x x x x x x x x x
Complecency
Always expect to find
something wrong
Never sign off on
something that you did
not fully check or
provide
Always double check your work x x x x x x x x x x x x x x x x x x x x x x x x x
Distraction
Secure your
workplace and tools,
keep it safe and
clean to avoid
unexpected
If you can’t focus on job,
take a break to remove
distraction
Ressuming job, go back and
double check what you think is
already completed
x x x x x x x x x x x x x x x x x x x x x x x x x x x
Fatigue
Forefeit complex
tasks if you know
that you are
exhausted
Take care of yourself, eat
healthy, be active and
maintain regular sleep
patern
Be aware of the symptoms and
look for them in yourself and co-
workers
x x x x x x x x x x x x x x x x x x x x x x x x x
Pressure
Ensure that pressure
is not self induced
Ask for extra help if time
is an issue
Communicate if you think you
will need more time to
complete job rather than rush
through it
x x x x x x x x x x x x x x x x x x x x x x x x x x
Stress
Reduce stress level
by take time off or a
short break
Ask co-workers to
monitor your work
Excercise, eat healthy and have
sufficient ammount of rest to
keep stress level under control
x x x x x x x x x x x x x x x x x x x x x x x
Norms
Erradicate negative
standards by rising
discussion about
them
Even if something looks
normal does not make it
correct
Ensure that everyone follows
the same standard
x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x

44. Lack of
communication
communication
wisdom
responsibility
care
planning
having a personal culture rationally
prudence
reliability
self-reliance effectiveness
awareness of the consequences
awareness of the environment
resource awareness
cooperation
inquisitiveness
LOW MEDIUM HIGH
RISK SCALE
https://openclipart.org/detail/23762/scale-01
Example of abilities usefull for countermeasure the lack of communication issue

45. But this approach is too robust to be useful

46. Employee responsibilities can be expressed also
in the context of:
• Process the employee supports
• Possition the employee occupies
And these responsibilities are also supported by
human abilities defined previously.
From other hand

47. Describing human support for process
knowledge
about role in the
process and impact
to environment
knowledge
about usage and
limitation of tools
used in process
knowledge
about predictable
process execution and
readiness to
notification any
deviations
ability
to signal the
concerns about
unexpected
changes
in process
ability
to sustain or
recovery of process
in case of
unexpected
disorder
Symbols are based on icons https://materialdesignicons.com/ according to license conditions https://github.com/Templarian/MaterialDesign/blob/master/license.txt
More about More Personal Security can be found here https://sci-ikb.blogspot.com
BASED ON NIST CYBSERSECURITY FRAMEWORK CORE
PROFFESSIONALCOMPETENCES

48. Describing human support for role
ability to
limited trust
behaviour and
awareness of
emotion influence
ability to
know information
value and to restrain
from information
sharing
ability to
assess of the
situation and
estimate
performed actions
ability to
independent
decision-making
and take care of
own life space
ability to
act and overcome
any adversities
resulting from
habits
Symbols are based on icons https://materialdesignicons.com/ according to license conditions https://github.com/Templarian/MaterialDesign/blob/master/license.txt
More about More Personal Security can be found here https://sci-ikb.blogspot.com
BASED ON NETIQUETTE QUIDANCES
PERSONALCOMPETENCES

49. Expressing the competences in ability language
Szacunek Prywatność Rozwaga Asertywność Wzór Poznaj Ochroń Wykryj Reaguj Odzyskaj
Cecha+A4:A4:B47 Definicja
zdolność do
ograniczonego
zaufania i
rozpoznawania
wpływu emocji
zdolność do
powściągliwości
w ujawnianiu
informacji i
ocenie jej
wartości - choć
ogólnie dotyczy
dowolnej
czynności
zdolność
do oceny
sytuacji i
oszacowan
ia
konsekwen
cji
podjętych
akcji
zdolność do
samodzielneg
o
podejmowani
a decyzji i
dbania o
swoją
przestrzeń
życiową
zdolność
do
działania i
pokonywan
ia
trudności
wynikający
ch z
przyzwycza
jeń
wiedza na
temat swojej
roli w
procesie i
wpływu na
otoczenie
znajomość
ograniczeń
narzędzi
stosowanych
w procesie
znajomość
przewidywaneg
o toku procesu i
gotowość do
odnotowania
odchyleń do
normy
zdolność do
przekazania
uwag
związanych z
niespodziewa
nymi
zmianami w
procesie
zdolność do
utrzymania lub
odtworzenia
procesu w
wyniku
niespodziewan
ego zaburzenia
altruizm umiejętność realizacji własnych planów w sposób przynoszący korzyść większej grupie społecznej x
asertywność odporność na wpływy zewnętrzne z uszanowaniem obcych wyborów x x
balans umiejętność optymalizacji efektów pracy w funkcji czasu x
bezkompromisowość spełnienie własnych założeń przed wymogami innych x
czujność umiejętność zachowania koncentracji pomimo niesprzyjających okoliczności, spostrzegawczość połączona z wyciąganiem wniosku i reakcją x
dociekliwość umiejętność uzyskania satysfakcjonującej odpowiedzi bez kompromisów x x x x x x
elastyczność umiejętność dostosowania się do sytuacji lub wymagań x
empatia zdolność do uzyskania perspektywy kogoś innego, bez stosowania założeń i uproszczeń x x
indywidualizm promowanie własnej perspektywy i utrzymywanie dystansu w celu podkreślenia występujących różnic x
komunikatywność łatwość nawiązywania relacji z innymi oraz swoboda w komunikacji x
przywództwo postawa mająca na celu poprzez własny przykład zaangażowanie innych do realizacji wskazanego celu x
lojalność umiejętność tworzenia relacji zaufania, zachowania tajemnicy x
mądrość posiadanie doświadczenia życiowego, znajomość schematów społecznych x
niezależność
cecha określająca minimalny wpływ czynników zewnętrznych na podejmowane decyzje i brak konieczności uwzględnienia zasobów
zewnętrznych przy wykonywanych akcjach
x
odpowiedzialność zdolność do konsekwentnego postępowania w reakcji na wcześniej podjęte decyzje i wykonane działania x x x x
ostrożność
w relacjach z innymi: umiejętność rozpoznawania intencji rozmówcy, stosowanie ograniczonego zaufania w kontaktach z innymi ludzmi
w przypadku ogólnym: umiejętność stopniowego wykonywania czynności z możliwością minimalizacji strat własnych w przypadku
x x x
pewność siebie przekonanie o słuszności podjętych decyzji, wartości posiadanej wiedzy i umiejętności, wykonanych czynnościach x x x
planowanie umiejętność efektywnego wykorzystania posiadanych zasobów w szerszym horyzoncie czasowym x x x
poczucie własności potrzeba posiadania zasobów na wyłączność lub w ograniczonym dla innych dostępie x
posiadanie kultury osobistej umiejętność zachowania się zgodnie z normami społecznymi x
poświęcenie zdolność do zaakceptowania strat własnych w celu osiągnięcia większej korzyści x
poszanowanie cudzej własności respektowanie ograniczeń wynikających z istnienia zasobów poza własnym zasięgiem x x
praworządność postępowanie zgodne z ustalonymi zasadami x x
rozsądek minimalizacja strat własnych poprzez umiejętność planowania i wykonywania czynności ze świadomością ich konsekwencji x x x x
roztropność planowanie uwzględniające elementy krytycznego myślenia i odpowiedzialności za podjęte decyzje x x x
rzetelność wykonywanie czynności w sposób oczekiwany, powtarzalny x x x x
samodoskonalenie umiejętność eliminowania nieporządanych cech charakteru, rozwój oczekiwanych umiejętności, zachowanie samokontroli x
samodzielność zdolność do niezależnego podejmowania decyzji i przeprowadzania czynności x
samokontrola umiejętność kontrolowania własnych emocji, świadomość ich wpływu na podejmowane decyzje x x
samoświadomość znajomość własnych zalet, wad, potrzeb i ograniczeń x x x x x
skrupulatność
umiejętność zapewnienia rozliczalności (kto,gdzie,kiedy,jak,po co,z kim) do poziomu pojedynczego zasobu/detalu, szczegółowe
analizowanie problemu
x x x x x x
skuteczność umiejętność osiągania celu pomimo występujących problemów i przeszkód x
spostrzegawczość
w relacjach z ludzmi: umiejętność odczytywania niewerbalnych form komunikacji
w przypadku ogólnym: umiejętność uwzględnienia większej liczby pozornie nie mających znaczenia czynników wpływających na decyzję
x x x x
sprawiedliwość wydawanie osądu w oparciu o fakty bez preferowania perspektywy jednej ze stron sporu x
świadomość konsekwencji wiedza i doświadcznienie dotyczące potencjalnych i możliwych skutków podjętych decyzji czy wykonanych czynności, wnioskowanie x x x x
świadomość otoczenia wiedza dotycząca czynników wpływających na wykonywanie czynności x x x
świadomość zasobów umiejętność oceny wartości i wzajemnej relacji informacji, zasobów x x x x
umiejętności techniczne
umiejętność zrozumienia języka technicznego (czytania ze zrozumieniem instrukcji obsługi), zdolności manualne i koordynacja niezbędna
do obsługi urządzeń, swoboda w przyswajaniu obsługi urządzeń i technologii
x x
wiarygodność dotrzymywanie danego słowa x x
współpraca umiejętność wspólnej pracy i współdzielenia zasobów x
wyobraźnia
zdolność do abstrakcyjnego myślenia, pozwalająca na symulację potencjalnych scenariuszy w oparciu o posiadaną wiedzę, pozwala wyjść
poza ramy rzeczywistych schematów i uwzględnić rzadko występujące zjawiska
x x x x
wytrwałość
koncentracja na osiągnięciu założonego celu, konsekwentne podejmowanie decyzji lub wykonywanie czynności w dążeniu do oczekiwanego
skutku, odporność na czynniki zakłócające i rozpraszające, determinacja
x x x
zarządzanie umiejętność organizowania dostępnych zasobów, monitorowania i planowania ich zużycia x x x x
Osobiste Wspierające proces
Przypisanie cech
Each of process (5) and role
(5) human competences
are defined in the subset of
46 abilities allowing to
define „macro” human
requirements -
competences

50. Expressing the Dirty Dozen in Competences
language
Dirty Dozen
Lack of communication Identify Recover Respect Prudence
Lack of knowledge Protect Detect Respect Prudence
Lack of teamwork Identify Protect Respect Exemplar
Lack of resources Detect React Privacy Prudence
Lack of assertiveness Protect React Prudence Assertiveness
Lack of awareness Identify Detect Respect Assertiveness
Complecency Protect Detect Privacy Assertiveness
Distraction Protect Recover Privacy Prudence
Fatigue Detect React Prudence Assertiveness
Pressure Detect React Respect Assertiveness
Stress Detect React Respect Assertiveness
Norms Identify React Assertiveness Exemplar
Process related Position related
Countermeasure competences

51. And now final step is required:
add all the ingredients to the safety culture recipie:
• DEFINE SET OF REQUIRED PERSONAL COMPETENCES
• DEFINE SET OF REQUIRED SKILS FOR COMPANY PROCESS
• ASSIGN THE REQUIREMENTS LEVEL TO EACH OF COMPETENCE FOR
SPECIFIC ROLE IN COMPANY
• LABEL TRAINING MATERIALS TO HELP DEVELOP DEFINED
COMPETENCES
• BUILD TEST FOR RISING THE LEVEL OF COMPETENCE(S)
• DEFINE TIME FRAME FOR REACHING REQUIREMENTS LEVEL PER
COMPETENCE
• DEFINE TIME FRAME FOR REACHING REQUIREMENTS LEVEL FOR
WHOLE SET OF COMPETENCES

52. To not overburn with effort and lose audience
attention focus on short, simple tasks:
+Micro learning
+Micro tests.

53. If you don’t have knowledge database ready for
that step use SCI-IKB collection of SANS Institute
Tip of a Day for solid fundation with cybersecurity
basic practices and knowledge.

54. Release one tip, each working day and the same,
or next day provide microtest to evaluate the
knowledge adoption – competence rise.
If anyone is able to finish the test – reward with
competence points.

55. Allow audience to monitor their progress with
building security posture by increasing the
competence values, each microtest, one by one.
Monitor points to go/compliance with
requirements.

56. Don’t spoil the gamification with forcing to react
with content or granting prizes at early stage.
Remember – culture growth requires time – like
tree – take care of it at begining, then will be
strong later.

57. Always stay open to feedback. This
program/approach is global, can’t be limited to
work enviroment or public domain only.
If required, create the same Identities in both
programs, summing the competences in both for
each Identity.

58. Make a lot of content – short, simple steps, even
for complicated or advanced knowledge.
Make it usefull – ask about solving the real
situation/issue/problem in microtest – this is a lot
of job, but great fun too.

59. Enhance your knowledge database with metadata
about competences – allow people who
understand the model/framework to mark the
articles, communication, almost everything that is
relevant to program (you may find that this will be
everythink you have)

60. Imagine that after few years, and global approach,
you may use this framework for recruting, carreer
planning, organization change, people risk
management as well as privatelly for your children
career advisory or your own self development.
This is about culture shift – remember the goal.

61. Good luck
And have fun
Stayng safe