ISMS awareness
ISMS Awareness Training — Because Information Security Is Everyone's Responsibility
Five missions. Futuristic format. ISO 27001 compliant.
Built for the employee who thinks cyber security is IT's problem — and needs to understand why it isn't.
Quick answer
The Problem With Most Security Awareness Training
Most information security training is written for the person who already understands why it matters. Long policy documents, dense compliance modules, and a final quiz that tests whether employees can reproduce definitions rather than whether they'll actually behave differently when they receive a suspicious email.
The result is predictable. Employees complete the module. They pass the quiz. And six months later the organisation has a phishing incident because somebody clicked a link they should have recognised.
Security awareness training works when it changes behaviour. That requires scenarios employees recognise, decisions with realistic consequences, and a format that holds attention long enough for the learning to stick. Tryitowl's ISMS programme is built on that principle — five mission-based modules, each covering a specific security domain in a futuristic, gamified format designed to be the information security training employees actually remember.
The Mission Structure
The programme is built as five standalone missions — each covering a distinct information security domain. Missions can be deployed individually as targeted interventions or as a complete programme for ISO 27001 awareness compliance.
Mission 1 — Data Privacy
Protecting personal information under information security and data privacy frameworks. Covers: what constitutes personal data, how to handle it correctly, what the risks of mishandling look like, and what employees are required to do when they encounter personal data in the course of their work.
Mission 2 — Password Management
The single most exploited vulnerability in most organisations is also the most preventable. Covers: what makes a password strong versus weak, credential hygiene practices, multi-factor authentication, and the specific behaviours that turn password management from a policy into a habit.
Mission 3 — AI Management & Security (AIMS)
Generative AI is now embedded in everyday work — but most employees have never been trained on data exposure, policy compliance, or verifying outputs before they act. Covers: what happens to information entered into AI tools, organisational AI use policy, verification habits, IP and disclosure when AI assists content, and prompt security.
Mission 4 — Vulnerability Awareness
Recognising and reporting the security vulnerabilities that human behaviour creates or enables. Covers: phishing and social engineering, insecure data sharing, weak access control practices, and the reporting behaviours that turn individual awareness into organisational security.
Mission 5 — Cloud Security
How information is protected in cloud environments — the risks specific to cloud storage, collaboration tools, and remote access that most employees interact with daily. Covers: what can go wrong with cloud-stored data, what safe cloud behaviour looks like, and the specific practices that reduce exposure.
Delivery Options
Hosted online
Employees access missions through a dedicated online link. No LMS required. Compliance teams get a dashboard showing completion rates and assessment scores per mission. Completion certificates generated automatically.
Custom SCORM
Branded SCORM packages for upload into your existing LMS. Each mission is available as a separate SCORM file or as a combined programme. Includes your organisation's branding. Completion and score data captured by your LMS.
Missions can be deployed individually — for targeted refreshers or incident-response training — or as a full programme for ISO 27001 annual awareness compliance.
ISO 27001 and ISMS Compliance
ISO 27001 requires organisations to ensure that all personnel who handle information understand the organisation's information security policies, their own responsibilities, and how to respond to security incidents. Clause 7.3 of the standard specifically requires awareness of the information security policy, contribution to the effectiveness of the ISMS, and the implications of not conforming with requirements.
Tryitowl's five-mission programme covers all of these requirements across specific, scenario-based modules — with completion documentation that supports the audit evidence your ISO 27001 certification requires.
FAQs
What is the problem with most security awareness training?▼
Much of it is written for people who already care — long policies, definition quizzes, and little change in real behaviour. Tryitowl’s missions use recognisable scenarios, meaningful choices, and a gamified format so non-technical employees actually remember what to do when something suspicious arrives in their inbox.
How is the ISMS programme structured?▼
Five standalone missions cover data privacy, password management, asset information management (AIMS), vulnerability awareness, and cloud security. Deploy all five for annual ISO-aligned awareness or run single missions after incidents or policy shifts.
What delivery options are available?▼
Hosted online gives employees a direct link, dashboards for compliance teams, and auto-generated certificates. Custom SCORM packages slot into your LMS with branding; missions can be purchased separately or as a full path, and completion data stays in your system.
How does this support ISO 27001 / ISMS compliance?▼
ISO 27001 Clause 7.3 expects demonstrable awareness of the information security policy, each person’s contribution to the ISMS, and consequences of non-conformity. The missions translate those obligations into scenario-based learning with completion evidence you can show auditors.
Can individual missions be run on their own?▼
Yes. Each mission stands alone so you can push a targeted refresher — for example vulnerability awareness after phishing — without rerunning the entire curriculum.