Building competences for employee behavior enhancing Information Technology Security (ITS) is crucial. While cybersecurity attacks are rising in numbers and sophistication, deficient knowledge and behaviors of employees present greater weaknesses in companies than insufficient hardware/software components such as firewalls. However, ITS trainings are time-consuming and often only temporarily effective. We address these shortcomings and model the required competences for ITS behavior in everyday work, identify their qualification needs, and recommend needs-based training programs. In this paper, we examine to which extent available ITS trainings cover the dimensions of our competence model. We pursue the question on which specific dimensions of ITS competence are addressed/omitted. Results show that especially the implication of the important dimension of justification needs to be improved.

This work was supported by the German Federal Ministry for Economics and Climate Action (Grant number 01MS20008B).