Human Factors // AQT Operating Company
Meridian Shield Assurance Security Awareness & Human Factors Governance Program
An enterprise security-awareness and control-design case study for Meridian Shield Assurance (MSA), a fictional operating subsidiary of Aegis Quantum Trust, focused on human factors, policy governance, continuous monitoring, insider-risk reduction, and executive communication.
Case overview
The project placed me in the role of CISO for Meridian Shield Assurance (MSA), a fictional Aegis Quantum Trust subsidiary with a low-maturity security environment where technical weaknesses, human behavior, and organizational practices were reinforcing one another. The objective was to design a security-awareness program that could improve posture without treating every failure as an employee problem.
Security posture
MSA’s posture, as an operating subsidiary within Aegis Quantum Trust, was low and reactive. The environment lacked visibility, consistent vulnerability review, formal change control, and sufficient data-protection practices.
Technical exposure
- No centralized collection or analysis of security event logs
- No IDS/IPS capability
- Weak encryption and integrity controls
- No formal configuration change-management process
- Inadequate removable-media controls
Human + organizational exposure
- Successful phishing and social-engineering incidents
- No annual awareness program
- High turnover and low morale
- Weak separation of duties and insider-risk controls
- Readiness, workload, fatigue, and role-clarity concerns
Control architecture
The design combined technical and organizational controls rather than treating awareness as a once-a-year training event.
| Control Domain | What Was Designed | Evidence |
|---|---|---|
| Security Awareness | Onboarding + annual training, phishing simulations, role-specific learning | Training records, simulation results, assessments |
| Change Management | Approval, testing, rollback planning, post-implementation validation | Change records, approvals, test results |
| Monitoring | Centralized logging, IDS/IPS, alert tuning, documented escalation | SIEM configuration, logs, tuning records, tickets |
| Data Protection | Encryption, integrity validation, media controls, classified data flows | Encryption reports, flow diagrams, exceptions |
| Identity + Insider Risk | Least privilege, access reviews, separation of duties, mandatory leave | Access matrices, reviews, revocation records |
| Vulnerability Management | Quarterly assessment, monthly review, remediation and rescanning | Scan reports, remediation tickets, retest evidence |
Evidence-driven governance
A control is not finished when the policy is written. The organization has to be able to show that the control operated, was reviewed, and was improved when it failed.
↓
EXECUTION
↓
EVIDENCE
↓
REVIEW
↓
IMPROVEMENT
Monitoring cadence
Human factors
One of the strongest lessons from the project was that human error is not solved by telling people to “be more careful.” The control environment has to account for how work is actually performed.
Use defined procedures, readiness checks, and supervisory review.
Tune alerts, distribute workload, maintain backup staffing.
Use nonpunitive good-faith reporting and clearer expectations.
Separate duties, monitor access, preserve evidence, investigate.
Executive communication
Leadership view
- Operational risk and business continuity
- Financial exposure and customer trust
- Policy implementation and unresolved risk
- Decisions requiring executive approval
- Concise Jira / SharePoint reporting
Workforce view
- Short, practical micro-learning
- Nonpunitive phishing remediation
- Inquiry mailbox for questions
- Lunch and Learn sessions
- Town halls and bidirectional feedback
Project artifacts
The portfolio includes both detailed governance deliverables and the executive communication layer.
Final Security Awareness Program Proposal
Integrated security posture, human-factor analysis, organizational risk, control recommendations, monitoring, and communication.
Open Word artifact10-Policy Control Package
Ten policies mapped to identified gaps and supported by evidence requirements.
Open artifactContinuous Monitoring Plan
Open artifactCommunication Plan
Open artifactExecutive Presentation
Open PPTXCapabilities demonstrated
GRC
Gap analysis, policy design, control evidence, governance, risk-based review frequency.
Human-factor security
Awareness, social engineering, fatigue, workload, readiness, morale, reporting culture.
Executive communication
Translating technical weaknesses into business, financial, operational, and trust impacts.
Portfolio context
This is an academic case study developed for IT-552: Human Factors in Security. MSA is presented here as a fictional operating subsidiary of Aegis Quantum Trust. The work is presented as a portfolio example of security-awareness program design, GRC analysis, control development, continuous monitoring, human-factor risk evaluation, and executive communication.