I've observed that several of our users are ignoring messages sent from IT Security managers, and also the system generated "You just sent a virus" notifications.

The problem seems to be among people who are not computer savvy, who are in no way hostile to IT SEC.  They are simply not "computer" people.

What guidance is there to ensure that the IT Managers and System Notifications are understood, and acted upon?  I'd like to craft a single message for the entire user base, and not take on responsibility for hand-holding the "special" folks.

My hope is that I can develop a set of email best practices that are used when communicating with all end users, for the purpose of sending IT Security user notifications through email.    


How should I lay out the thoughts behind the message?  
Are HTML messages more effective?  How so?   
Are there any cut-and-paste samples?  
Does the "From" address matter?  
What should the subject say?


Examples of notifications include (but not limited to):


Automatic Email Messages from Antigen or Forefront AV systems
Revisions to IT security policy
General notifications that are simply informative


"Maintenance will be performed at 11pm-6am.  Expect a disruption in service"

General notifications that are meant to be read and acted upon.  They do apply to the end user.


"Close all applications and log off for patching"

Other notifications that may or may not apply to the end user.


SPAM Quarantine Summary Emails: "Enclosed is a list of quarantined messages..."
"A security patch for an old version of software that might not be installed"




  This question was IT Security Question of the Week.
  Read the Aug 26, 2011 blog entry for more details or submit your own Question of the Week.


A small trick I learned years ago - lay your email out like this:


  Short Version
  
  
  Small number of very short succinct points
  If X, then you need to do this
  Else, then you need to do that (or don't need to do anything)
  
  
  Long Version or Full Details
  
  ...and here you lay out whatever full version you want.


97% of your users will never read the long version, so make the short version count. However, the key here is that most users will read the short version if they're given a choice between that and the long version.  When you put that "Short Version" section header in, you're enticing them to read that because they feel like they can "get away" with just reading the short version.  It's, like, psychology or something.

Many of your users still won't read messages no matter what you do.  I've gotten better hit rates with this method than not, though.
