Education and Training on Information System Security Awareness: Vital Factor in Improving Office Information Management and Mitigating Vulnerability and Data Breaches in Federal Colleges of Education in North-West, Nigeria

ABSTRACT This study examined the vital role of education and training in information system security awareness as a factor for mitigating vulnerability and data breaches in Federal Colleges of Education in North West Nigeria. Growing dependence on digital technologies in educational institutions has increased exposure to cyber security threats, thereby making human factors such as awareness, knowledge, and training essential for effective information security management. The study adopted a quantitative approach using a descriptive survey design. The population consisted of 1,950 staff across seven Federal Colleges of Education, in the North West zone of Nigeria, including academic, administrative, and information technology personnel. Krejcie and Morgan (1970) sample size determination table was used to arrive at 375 respondents; the respondents were also selected using disproportionate stratified sampling, valid responses were analyzed using descriptive statistics and Pearson correlation. Data were collected using a self-designed questionnaire validated by three experts in the area of the study. The date was also gathered with the help of assistance of three briefed research assistants. The findings revealed that education and training have a moderate but statistically significant influence on employees’ awareness of information security policies. Employees also demonstrated a moderate level of awareness regarding information security management practices and data breach issues. However, notable gaps were identified in the frequency of training programs, knowledge of incident reporting procedures, and awareness of technical risks associated with unsecured devices and networks. The study further revealed that while employees possess general awareness of security issues, the practical application of security measures remains limited. It was concluded that education and training are critical to enhancing information security awareness, but their effectiveness depends on consistency, relevance, and practical orientation. The study recommends the implementation of continuous, structured, and practical training programs to strengthen employees’ awareness, improve compliance behavior, and reduce vulnerabilities and data breaches in educational institutions.