Security Awareness Programme — Guide

Security Awareness Programme

A completion rate tells you who sat a course. It does not tell you whether anyone will report the next convincing email, or call a supplier back before changing their bank details. This pack runs awareness as behaviour change: each campaign names one behaviour, is chosen from your own incidents and risks, and is judged on whether that behaviour moves.

Is this for you?

This pack is for you if:

• your awareness programme is one annual course, and success is the completion rate;
• your topics come from a vendor’s calendar instead of your own incidents;
• people are named, shamed or disciplined after a phishing test;
• nobody could say who needs more than the standard course.

Who needs what

Everyone with an account takes a short baseline course every 12 months, in pieces across the year. Roles where one mistake does serious harm take a module of their own, before they use that access or authority unsupervised:

Joiners get five behaviours at first sign-in, on the day their account is enabled, and finish the induction within 10 working days, alongside their policy acknowledgements.

Simulations that teach

Phishing simulations are graded from 1 (many cues) to 4 (tailored to one role), and a group moves up only when its reporting and click rates allow. Reporting is the success measure, including a report after clicking. A click leads to a teaching page and nothing else. Results by name go only to the person and the awareness lead; managers see groups of at least 10. Lures about pay, bonuses, health, redundancy or real emergencies are never used, and HR, Legal, the Data Protection Officer and, where required, the works council approve the programme before it starts. Someone who clicks twice in a year is offered private coaching; a third click brings support and stronger protection for their account. A simulation result is never on its own a ground for discipline.

How it runs in practice

Take a distributor with 900 staff. In June its executive committee approved a plan built from its own risks, and redefined training completion, so June’s 88% cannot be compared with September’s 92%. Simulations started in July at Grade 1 and moved to Grade 2 in September, when the rule allowed it. Reporting rose from 22% to 28% at the harder grade, and the first report now arrives within 4 minutes. HR rejected a proposed lure about bonus statements. Eleven people clicked twice, and each was offered private coaching two working days after the campaign closed.

Three of the quarter’s five incidents had a human factor. After ransomware started from a phishing attachment, September’s theme became unexpected attachments. After a mailbox was taken over through a phished text-message code, the move to an authenticator app came first, and the sign-in codes theme was brought forward to February to follow it and explain it. The 72 staff short of the 95% target work night shifts, and the course goes to each shift by 30 November.

Start with these three

1. Annual Security Awareness Plan: twelve themes, each tied to an incident, risk or indicator of yours.
2. Role-Based Security Training Matrix: who needs which module, and by when.
3. Phishing Simulation Ethics & Approval Checklist: the approvals and safeguards to put in place before the first simulation.

Your first month

What to report

Report these every month to the security and IT leadership team, and every month to executive management in the metrics programme’s executive report, which shows any that are short of target:

• simulation reporting rate, at its grade;
• time to first report, at its grade;
• repeat clickers, as a share, never as names;
• incidents with a human factor, beside those staff stopped or reported;
• role training done by its due date;
• training completion and phishing compromises, as the metrics pack defines them.

Everything in the pack

Adapting it

• Small organisation: one awareness lead and one theme a quarter is enough. Keep the reporting route, the role modules and the ethics checklist.
• Staff without desks: use shift briefings and shared terminals, and count completion the same way.
• Works council or staff representatives: check what national law or your collective agreement requires before the first simulation, not after.
• Financial entity: DORA makes awareness and resilience training compulsory for all staff and senior management, at a depth that fits each role. The role matrix is built for that.

Where it maps

• ISO/IEC 27001:2022: Annex A 6.3.
• NIST CSF 2.0: PR.AT-01.
• NIS2: Article 20(2) and Article 21(2)(g).
• DORA: Article 13(6).
• GDPR: Article 39(1)(b).