Rewards:

• Cash Bonus– Everyone loves money to some extent. And what better way to have people strive to follow the rules than offer a cash incentive. This could either be a $100 bonus to the best policy follower, or something more like a $50 monthly bonus to anyone who didn’t get sanctioned.

• Early Release/Late Arrival– Tired of getting penalized for being just a few minutes late? Good news! If you follow your cybersecurity training well, you could gain the privilege of having a 15-25 minute grace period applied at the beginning or ending of your work day, depending on what you choose. This could either be for a month or could be earned and individually applied.

• Earn Leave– Out of sick days, but just not feeling it today? You’re in luck! Because you followed cybersecurity rules so well these last few weeks, you’ve earned yourself an extra sick day! This could also be substituted as unpaid leave, or the like.

Sanctions:

• Fine– Just as gaining money is fun, losing money is not. Paying fines, perhaps a fixed percentage of what the mistake cost the company, might care even the sloppiest user straight.

• Retraining seminars– Perhaps the employee is making the same small mistakes over and over? Maybe a retraining is in order. Mandatory retraining seminars may be all a person needs to brush up on their security protocols.

• Loss of privileges– Loss of privileges makes sense if someone has earned them, but starts to lose focus. Privileges are not a right. Besides, they can always get them back easily, by going back to their previous conduct!