Begin with roles and the behaviours to improve
A training programme should identify what people need to do differently. MMC UAE scopes awareness, technical development and exercises around audience, risk and operational responsibilities. Office users, administrators, developers and executives need different content and evidence of progress. Start with a bounded objective rather than a large catalogue of courses.
Discovery should capture roles, existing training, languages, locations and the incidents or control gaps that motivate the programme. Agree how progress will be measured. Attendance shows participation, but a practical exercise or decision record can provide better evidence that a skill or process has improved.
Awareness and phishing simulation with a response path
Awareness content should reflect the communication and workflows people encounter. Cover how to report suspicious activity, what information to preserve and where users can ask for help. A phishing simulation needs approval, an appropriate audience and a plan for handling user responses. It should connect to learning and reporting behaviour rather than simply producing a failure percentage.
Define the treatment of personal results, reporting access and retention before launching a campaign. Avoid a punitive design that discourages people from reporting a real mistake. Use results to identify confusing processes or weak reporting paths as well as knowledge gaps.
Technical skills and platform-based learning
Technical programmes should map labs and courses to the work the team performs. A security analyst may need evidence triage and escalation practice; an administrator may need secure configuration and recovery; a developer may need application-specific remediation. Confirm prerequisite knowledge, lab access and the time available for practice.
Training platforms should be compared against content relevance, role mapping, administration and reporting. A broad course library is useful only if the learning plan makes it usable. State whether the project includes platform access alone, facilitated instruction, learning-path design or assessment. Vendor certification examinations and instructor credentials require explicit confirmation if they are procurement requirements.
Tabletop exercises and cyber crisis simulation
A tabletop exercise rehearses decisions and coordination through an agreed scenario. Define participants, objectives, assumptions and the level of technical detail. The facilitator should know which decisions are being observed: escalation, service continuity, external communication or recovery authority. Do not present the exercise as a real incident or trigger unplanned operational actions.
Capture the sequence of decisions, missing information and unresolved responsibilities. An action plan should assign owners and review dates. A later exercise can test whether those actions changed the response. For operational teams, technical exercises need a separate authorised environment and safety boundary.
Portfolio, UAE delivery and handover
The directory includes Infosec and Immersive references, alongside Fortra-related training options. MMC’s Fortra partnership is confirmed; other directory listings do not establish instructor accreditation or a separate partnership. Confirm the selected content, access model and delivery credentials in the proposal.
For UAE teams, agree language, work patterns, branch participation and the handling of individual results. Government or sector requirements may influence audience and evidence; the customer’s authorised team should identify those obligations. Handover should include the learning plan, attendance or assessment records as agreed, reporting permissions and the exercise improvement register. Send audience counts, roles, languages, desired behaviours and delivery dates to begin a scope.
An exercise scenario with a reviewable outcome
An illustrative tabletop can begin with a report of suspicious access to a shared business application. Give participants enough information to decide who should investigate, what service impact is possible and who can authorise containment. Introduce uncertainty gradually rather than assuming the cause is known from the first message. Observe how the team asks for evidence and distinguishes a technical finding from a communication decision.
The exercise should end with a recorded decision sequence, unresolved ownership questions and an improvement register. Do not require participants to make live system changes or contact external parties as part of an unannounced simulation. Agree the boundaries, data handling and participants in advance. A later review should check whether procedures and contact information have changed. This is an example of an exercise brief, not an assertion that MMC has delivered a particular customer scenario.
Make programme reporting useful for improvement
Training reports should answer whether the intended audience was reached and whether the programme exposed a process or knowledge gap. Segment results only where the audience size and privacy rules make that appropriate. Individual results should have agreed access and retention, and managers should understand the limits of the measurement. A quiz score or simulation click is one observation, not a complete assessment of a person’s security behaviour.
Use the findings to update the next learning step. If users do not know how to report a suspicious message, simplify and rehearse the reporting path. If administrators struggle to identify an escalation owner during a lab, fix the operating procedure as well as assigning another course. This keeps the programme connected to daily work rather than repeating content without checking its effect.
Plan continuing ownership before the initial engagement ends. Identify who updates audience lists, schedules learning, approves simulations and tracks exercise actions. New joiners and role changes should enter the programme through a defined process. Handover should leave the customer with a learning and review schedule that can be maintained, with any facilitated sessions or ongoing platform access stated in the commercial scope.
Capabilities included in this solution
These specific requirements are consolidated into this guide. Use the relevant brief to identify the systems and deliverables for your project.
Cyber Skills Development
Create a role-based security skills programme.
Define practical outcomes for each role and use approved lab exercises to measure progress.
Scope inputs: Team roles; Current skills; Learning priorities.
Security Awareness and Phishing Simulation
Plan employee learning and controlled phishing exercises.
Coordinate simulations with internal stakeholders and measure reporting behaviour alongside completion.
Scope inputs: Learner groups; Languages; Reporting channels.
Cybersecurity Training Platforms
Plan how training is assigned, delivered and reported.
Test onboarding, course assignment and manager reporting before opening the programme to all staff.
Scope inputs: Identity integration; Learner count; Reporting needs.
Tabletop Exercises and Cyber Crisis Simulation
Rehearse decisions and coordination during security incidents.
Agree exercise objectives and evaluate decisions and communication against the existing response plan.
Scope inputs: Business scenarios; Participants; Response plans.
UAE control requirements: establish applicability first
Ask your authorised security, privacy and sector advisers which requirements apply to your entity and service. Use their control and evidence decisions in the design, acceptance plan and operating procedures.
- UAE Information Assurance Regulation (often referenced as NESA / UAE IA)
- DESC Information Security Regulation: Dubai government control requirements
- DoH AAMEN and ADHICS resources for Abu Dhabi healthcare
- UAE Government overview of personal data protection laws
These official resources help establish the source of requirements. A product, project guide or completed installation does not by itself establish compliance or certification.