Which statement below most accurately describes the difference between security awareness,
security training, and security education?

A.
Security education is required for all system operators.

B.
Security training is more in depth than security education.

C.
Security training teaches the skills that will help employees to perform their jobs more securely.

D.
Security awareness is not necessary for high-level senior executives.

Explanation:
Awareness is used to reinforce the fact that security supports the mission of the organization by
protecting valuable resources. The purpose of training is to teach people the skills that will enable
them to perform their jobs more securely. Security education is more in depth than security training
and is targeted for security professionals and those whose jobs require expertise in security.
Management commitment is necessary because of the resources used in developing and
implementing the program and also because the program affects their staff. Source: National
Institute of Standards and Technology, An Introduction to Computer Security: The NIST Handbook
Special Publication 800-12.