Annual Security Awareness Plan
Schedules topics, audiences, channels and measures across the year, linked to actual incident and risk data.
Available soon
- Format
- Excel
- Size
- 77 KB
- Length
- 12 sheets
- Version
- 1.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | On the Evidence sheet, list the evidence the plan is built from (incident case log (P09); risk register (P05); key risk indicators (P11); simulation results; exercises, audits and access reviews): one row per incident with a human factor, people risk, indicator, review action or gap, with what it is and the person's part in it. Write what happened, never who. |
| 2 | On the Themes sheet, check the twelve themes. Each names one behaviour (the five first-month behaviours, FB-1 to FB-5, or one the baseline course adds, such as BB-1), a key message, the modules behind it and one measure from the Human Risk Metrics Dashboard. Add your own themes on the yellow rows below; drop a theme that answers no evidence (AW-02). |
| 3 | On the Monthly Plan sheet, place one theme a month, most urgent first, by the method on the Plan Overview (steps 1 to 7). Enter the role groups from the Role-Based Security Training Matrix, the channels that reach them (shift briefings and floor terminals for people without a desk), the group simulated that month, and the evidence it answers. Keep 'Theme as approved' as the plan was approved: it shows what each re-plan moved. |
| 4 | Where a control should stop the harm, the control's owner fixes it first, and the campaign is timed to follow the fix and explain it (AW-02). Name the review action or treatment action in 'Evidence it answers'. |
| 5 | Simulate each group no more than once every two months (AW-11): the Check column flags a group simulated two months running. Clear every Check that does not say OK, and every Evidence row whose Check asks for a theme or a reason. |
| 6 | Agree the themes with the owner of each risk they answer, and take the plan to executive management for approval before the year starts (AW-03). Record the approvals at the foot of the Plan Overview. |
| 7 | When a trigger arises (RP-1 an incident declared at Severity 1 or 2 with a human factor (P09); RP-2 the same human factor causing two incidents within [[3]] months; RP-3 a key risk indicator on a people risk entering amber or red (P11 MR-08); RP-4 a new risk in the register whose cause is people's behaviour (P05)), re-plan within 10 working days. Record the change on the Re-plan Log sheet with the date the trigger arose, change the months on the Monthly Plan sheet, and put the Change ID beside each month it moved. |
| 8 | Set the As-at date on the Plan Overview each month before the measures go to the security and IT leadership team (AW-16). Enter your public holidays at the foot of the Plan Overview so re-plan deadlines skip them. |
| 9 | Delete the EXAMPLE rows before the plan is approved. Rows marked Default are the pack's themes: keep, change or drop them. Do not type over the white calculated columns. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Rule AW-01: "Every awareness activity must name, before its content is chosen, the one behaviour it is meant to change, whose behaviour it is, and the measure that will show the change. Completion of a course shows that it was delivered, never that it worked."
Rule AW-02: "The annual plan must be built from the organisation's own evidence: the root causes in the incident case log (P09), the risks in the register whose cause is people's behaviour (P05), the key risk indicators (P11) and the last year's simulation results. Every theme names the incident, risk or indicator it answers, and a theme that answers none is dropped. Where a control is being fixed, the campaign follows the fix and explains it, never replaces it."
Rule AW-03: "The plan must be proposed by the awareness lead, agreed by the owner of each risk it answers, and approved by executive management before the year starts. It is re-planned within [[10]] working days when there is an incident declared at Severity 1 or 2 with a human factor, when the same human factor causes two incidents within [[3]] months, when a key risk indicator on a people risk enters amber or red (P11 MR-08), or when a new risk whose cause is people's behaviour enters the register (P05). Each change is agreed by the owner of each risk the moved themes answer and the executive sponsor, and recorded with its trigger and what moved."
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. The executive committee, chaired by the Chief Executive approved the plan for July 2026 to June 2027 on 26 Jun 2026, sponsored by the HR Director, the owner of the phishing risk. It has been re-planned twice: PC-1 after INC-2026-014, 14 Aug 2026; PC-2 after INC-2026-017, 30 Sep 2026.
Tailoring — small organisation: one theme a quarter, run by one awareness lead, is enough. Keep the evidence link for every theme, the reporting route in every message and the re-plan triggers.
Tailoring — regulated entity (NIS2, DORA): the plan shows an awareness programme scheduled over time, covering new employees and tested for effectiveness (Implementing Regulation (EU) 2024/2690, Annex point 8.1). A financial entity under DORA makes it a compulsory part of its staff training, for all employees and senior management (Article 13(6)). Keep each year's approved plan and its Re-plan Log.
Tailoring — IT run by a service provider: the provider's incident reports and phishing statistics are evidence for this plan. Ask for them each quarter, and record them on the Evidence sheet. The plan and its approval stay yours.
Plan Overview
Plan overview
Where the year stands, what the plan is for, how it was made and is changed, and who agreed and approved it. Yellow cells are yours; the EXAMPLE entries show a completed plan.
| As-at date | 30 Sep 2026 | EXAMPLE date (the example quarter end). Type the date you read the plan; never a formula that changes it. |
| The plan year starts | 1 Jul 2026 | EXAMPLE: July 2026 to June 2027. |
| Re-plan within (working days) | 10 | AW-03. The pack's default; set your own. |
| Same human factor twice within (months) | 3 | Trigger RP-2. Judge it from the Evidence sheet's incidents. |
Where we stand
| Measure | Value | What it means | ||
|---|---|---|---|---|
| Themes in the plan | 12 | One theme a month; the last month is the annual review (AW-16). | ||
| Months done | 3 | Months that ended on or before the as-at date. | ||
| Months changed by a re-plan | 4 | Months whose theme differs from the plan as approved. | ||
| Re-plans recorded | 2 | Each on the Re-plan Log sheet with its trigger (AW-03). | ||
| Re-plans made in time | 2 of 2 | Within 10 working days of the trigger arising. | ||
| Months with a simulation | 11 | Each group once every two months (AW-11), under the Phishing Simulation Ethics & Approval Checklist. | ||
| Plan rows to resolve | 0 | Rows on the Monthly Plan sheet whose Check does not say OK. | ||
| Evidence no theme answers | 1 | Each needs a theme, or a recorded reason why not (AW-02). | ||
| Plan status | On plan | On plan when every row checks out, all evidence is answered or explained, and no re-plan is late. | ||
Objectives and measures of success
| Objective | Measure of success | |||
|---|---|---|---|---|
| People report suspicious messages at once, including after a click (AW-08) | HRM-01 simulation reporting rate at [[40%]] at the group's current grade; HRM-02 time to first report [[10]] minutes or less at the group's current grade | |||
| Fewer incidents caused by what people do or fail to do | HRM-04 incidents with a human factor: [[2]] or fewer a quarter; P11 MC-34 in green | |||
| Everyone trained, and roles at higher risk trained for their role | P11 MC-36 at [[95%]]; HRM-05 role training done by its due date: all | |||
| Every theme changes the behaviour it named (AW-01) | At the annual review, each theme kept, changed or dropped on the evidence of its measure (AW-16) | |||
Scope
| Item | Entry | |||
|---|---|---|---|---|
| Who the plan reaches | Every employee, and every non-employee given an account (P13), including suppliers' staff unless the contract shows equivalent training. Themes for roles at higher risk name their role groups (RG-02, RG-03, RG-04, RG-05, RG-06, RG-07, RG-08). | |||
| Not in this plan | The role modules and their due dates (the Role-Based Security Training Matrix); the management body's training (AW-07, the NIS2 pack's training plan); the simulation method itself (the Phishing Simulation Programme Method). | |||
| Period covered | [[e.g. July 2026 to June 2027]] | |||
How the plan is made (AW-01 to AW-03)
| Step | What | How | ||
|---|---|---|---|---|
| 1 | List the behaviours behind last year's incidents and today's people risks | Read the five evidence sources (PS-1 to PS-5). Write each as one action a person takes or fails to take, never as a topic. | ||
| 2 | Fix the control first where one is missing | Where a control should stop the harm (a warning, a second factor, a removed right), its owner fixes it, and the campaign is timed to follow the fix and explain it. | ||
| 3 | Rank the behaviours by risk | Higher first where the linked risk is outside appetite or its indicator is amber, then by how many incidents it caused. | ||
| 4 | Choose who and how for each | Name the role groups, and the channels that reach them: shift briefings and floor terminals for people without a desk, e-learning for others. | ||
| 5 | Set the measure before the content | Each theme names the measure that will show the change (AW-01), from the dashboard. | ||
| 6 | Place one theme a month | Twelve themes, the most urgent first, a simulation in each month where it fits, and the last month for the annual review (AW-16). | ||
| 7 | Agree and approve | Each risk owner agrees the themes for their risks; executive management approves the plan (AW-03). | ||
The evidence the plan is built from (AW-02)
| Source | What it gives the plan | When it is read | ||
|---|---|---|---|---|
| Incident case log (P09) | Root causes with a human factor, and incidents a person stopped or reported early | Every quarter, and after every Severity 1 or 2 incident | ||
| Risk register (P05) | Risks whose cause is people's behaviour, their owners, and how far each is from appetite | Every quarter | ||
| Key risk indicators (P11) | Indicators on people risks, such as phishing compromises (MC-34), and any in amber or red | Every month | ||
| Simulation results | Reporting rate, time to first report and clicks by group and grade, and the repeat-clicker count | After each campaign | ||
| Exercises, audits and access reviews | Findings where people did not know or did not follow a procedure | As each report is issued | ||
What re-plans the year (AW-03): within 10 working days
| Trigger | When it arises | |||
|---|---|---|---|---|
| RP-1 | An incident declared at Severity 1 or 2 with a human factor (P09) | |||
| RP-2 | The same human factor causing two incidents within [[3]] months | |||
| RP-3 | A key risk indicator on a people risk entering amber or red (P11 MR-08) | |||
| RP-4 | A new risk in the register whose cause is people's behaviour (P05) | |||
Review points (AW-16)
| When | Who | What is checked | ||
|---|---|---|---|---|
| Every month | Security and IT leadership team | The human risk measures on the Human Risk Metrics Dashboard; the month's theme done; any trigger arisen | ||
| Every month | Executive management | With the executive committee's monthly report (P11 RL-2): any measure short of target or outside green, the plan's progress and re-plans made; the board sees completion through P03 BM-08 | ||
| Once a year, in the last month | Awareness lead, with the executive sponsor | Whether each theme changed the behaviour it named; the next plan keeps, changes or drops it | ||
Agreement and approval (AW-03)
| Role | Name or body | Date |
|---|---|---|
| Proposed by (Awareness lead) | EXAMPLE: Information Security Manager | [[YYYY-MM-DD]] |
| Agreed by the risk owner | EXAMPLE: HR Director (R-09) | [[YYYY-MM-DD]] |
| Agreed by the risk owner | EXAMPLE: Chief Operating Officer (R-01, R-03) | [[YYYY-MM-DD]] |
| Agreed by the risk owner | EXAMPLE: Head of Logistics (R-04, R-12) | [[YYYY-MM-DD]] |
| Agreed by the risk owner | EXAMPLE: Chief Financial Officer (R-02) | [[YYYY-MM-DD]] |
| Agreed by the risk owner | EXAMPLE: Head of IT (R-05, R-11) | [[YYYY-MM-DD]] |
| Executive sponsor | EXAMPLE: HR Director | [[YYYY-MM-DD]] |
| Approved by executive management | EXAMPLE: The executive committee, chaired by the Chief Executive | 26 Jun 2026 |
Non-working days (public holidays)
| Date | Holiday |
|---|
[[e.g. a public holiday in the plan year]]
Monthly Plan
One theme a month (AW-01, AW-02). Yellow columns are yours; the theme's behaviour, message, measure and modules come from the Themes sheet. Every status is a word; the colour only repeats it.
| Row | Month | Theme as approved | Theme ID | Theme (calc) | Behaviour to change (calc) | Key message (calc) | Measure (calc) | Modules (calc) | Role groups | Channels | Simulation group | Evidence it answers | Changed by | Status (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | 1 Jul 2026 | CA-01 | CA-01 | Report it | Report anything odd at once, through the one reporting route, even after clicking. | Not sure? Report it. You will never be blamed for a report, even after clicking. | HRM-01 Simulation reporting rate | LM-01 | RG-01 | E-learning, Shift briefing, Floor terminal, Poster and screen | Group A | IM-01, R-09, R-01 | Done | OK | |
| EXAMPLE | 1 Aug 2026 | CA-02 | CA-02 | Fake sign-in pages | Check before you click a link or open an attachment you did not expect, and never sign in from a link in an email. | Never sign in from a link in an email. Go to the site the way you always do. | HRM-01 Simulation reporting rate | LM-02 | RG-01 | E-learning, Shift briefing, Floor terminal, Poster and screen | Group B | R-09, MC-34 | Done | OK | |
| EXAMPLE | 1 Sep 2026 | CA-03 | CA-07 | Unexpected attachments | Check before you click a link or open an attachment you did not expect, and never sign in from a link in an email. | Not expecting it? Do not open it. Ask the sender another way, or report it. | HRM-01 Simulation reporting rate | LM-04 | RG-01 | E-learning, Shift briefing, Floor terminal, Poster and screen | Group A | INC-2026-014, R-01, R-04 | PC-1 | Done | OK |
| EXAMPLE | 1 Oct 2026 | CA-04 | CA-04 | Lost and stolen devices | Report anything odd at once, through the one reporting route, even after clicking. | Lost a laptop or phone? Report it the same day, wherever you are. | HRM-04 Incidents with a human factor | LM-07 | RG-01 | E-learning, Shift briefing, Floor terminal, Poster and screen | Group B | R-12 | Planned | OK | |
| EXAMPLE | 1 Nov 2026 | CA-05 | CA-05 | Money and bank details | Confirm any request for money, bank details or data by calling a number you already hold, not one in the message. | Bank details changed? Call back on the number you already hold. Every time. | HRM-04 Incidents with a human factor | LM-05, LM-09 | RG-01, RG-03, RG-06 | E-learning, Shift briefing, Floor terminal, Poster and screen | Group A | R-02, INC-2026-015, TA-02 | Planned | OK | |
| EXAMPLE | 1 Dec 2026 | CA-06 | CA-06 | Customer data: check the recipient | Check the recipient before you send customer or personal data, and stop if the warning says it is going outside. | Check the name before you press Send. If it says External, stop and look again. | HRM-04 Incidents with a human factor | LM-06, LM-13 | RG-01, RG-08 | E-learning, Shift briefing, Floor terminal, Poster and screen | Group B | INC-2026-016, R-03, PIA-06 | Planned | OK | |
| EXAMPLE | 1 Jan 2027 | CA-07 | CA-03 | Devices and updates | Keep your device as IT set it up: let updates install and restart when asked, lock the screen when you step away, and get software only through the service desk. | Let updates run, lock your screen, and ask before installing anything. | HRM-04 Incidents with a human factor | LM-07 | RG-01, RG-07 | E-learning, Shift briefing, Floor terminal, Poster and screen | Group A | INC-2026-014, PIA-01, R-05 | PC-1 | Planned | OK |
| EXAMPLE | 1 Feb 2027 | CA-08 | CA-10 | Sign-in codes and prompts | Never give anyone a password or a sign-in code, and approve only sign-ins you started yourself. | Never share a code. A prompt you did not start is an attack: reject it and report it. | HRM-01 Simulation reporting rate | LM-03 | RG-01, RG-02 | E-learning, Shift briefing, Floor terminal, Poster and screen | Group B | INC-2026-017, R-09, GAP-06 | PC-2 | Planned | OK |
| EXAMPLE | 1 Mar 2027 | CA-09 | CA-09 | The first minutes of an incident | Report anything odd at once, through the one reporting route, even after clicking. | Something wrong on your screen? Disconnect, do not switch off, and report it. | HRM-02 Time to first report | LM-01 | RG-01 | E-learning, Shift briefing, Floor terminal, Poster and screen | Group A | R-01, IM-01 | Planned | OK | |
| EXAMPLE | 1 Apr 2027 | CA-10 | CA-08 | Phone and message impersonation | Confirm any request for money, bank details or data by calling a number you already hold, not one in the message. | A familiar voice or name is not proof. Call back on a number you already hold. | HRM-04 Incidents with a human factor | LM-05, LM-11, LM-12 | RG-01, RG-03, RG-06, RG-07 | E-learning, Shift briefing, Floor terminal, Poster and screen | Group B | R-02, JML-13 | PC-2 | Planned | OK |
| EXAMPLE | 1 May 2027 | CA-11 | CA-11 | Sharing files and cloud storage | Check the recipient before you send customer or personal data, and stop if the warning says it is going outside. | Share with named people, never with anyone who has the link. | HRM-04 Incidents with a human factor | LM-06 | RG-01, RG-04 | E-learning, Shift briefing, Floor terminal, Poster and screen | Group A | R-11 | Planned | OK | |
| EXAMPLE | 1 Jun 2027 | CA-12 | CA-12 | Annual review | None: the annual review looks back over the year | Thank you for every report. Which themes continue next year, which change, and why. | None: the review uses every measure | RG-01 | Team meeting | None | AW-16 | Planned | OK |
Themes
The theme library: each theme is one behaviour (AW-01), with the key message the Awareness Campaign Communications Kit builds on, the modules behind it and the measure that will show the change. Rows marked Default are the pack's twelve.
| Row | Theme ID | Theme | Behaviour ID | Behaviour to change (calc) | Key message | Modules behind it | Measure ID | Measure (calc) | Months planned (calc) |
|---|---|---|---|---|---|---|---|---|---|
| Default | CA-01 | Report it | FB-1 | Report anything odd at once, through the one reporting route, even after clicking. | Not sure? Report it. You will never be blamed for a report, even after clicking. | LM-01 | HRM-01 | HRM-01 Simulation reporting rate | 1 |
| Default | CA-02 | Fake sign-in pages | FB-3 | Check before you click a link or open an attachment you did not expect, and never sign in from a link in an email. | Never sign in from a link in an email. Go to the site the way you always do. | LM-02 | HRM-01 | HRM-01 Simulation reporting rate | 1 |
| Default | CA-03 | Devices and updates | BB-1 | Keep your device as IT set it up: let updates install and restart when asked, lock the screen when you step away, and get software only through the service desk. | Let updates run, lock your screen, and ask before installing anything. | LM-07 | HRM-04 | HRM-04 Incidents with a human factor | 1 |
| Default | CA-04 | Lost and stolen devices | FB-1 | Report anything odd at once, through the one reporting route, even after clicking. | Lost a laptop or phone? Report it the same day, wherever you are. | LM-07 | HRM-04 | HRM-04 Incidents with a human factor | 1 |
| Default | CA-05 | Money and bank details | FB-4 | Confirm any request for money, bank details or data by calling a number you already hold, not one in the message. | Bank details changed? Call back on the number you already hold. Every time. | LM-05, LM-09 | HRM-04 | HRM-04 Incidents with a human factor | 1 |
| Default | CA-06 | Customer data: check the recipient | FB-5 | Check the recipient before you send customer or personal data, and stop if the warning says it is going outside. | Check the name before you press Send. If it says External, stop and look again. | LM-06, LM-13 | HRM-04 | HRM-04 Incidents with a human factor | 1 |
| Default | CA-07 | Unexpected attachments | FB-3 | Check before you click a link or open an attachment you did not expect, and never sign in from a link in an email. | Not expecting it? Do not open it. Ask the sender another way, or report it. | LM-04 | HRM-01 | HRM-01 Simulation reporting rate | 1 |
| Default | CA-08 | Phone and message impersonation | FB-4 | Confirm any request for money, bank details or data by calling a number you already hold, not one in the message. | A familiar voice or name is not proof. Call back on a number you already hold. | LM-05, LM-11, LM-12 | HRM-04 | HRM-04 Incidents with a human factor | 1 |
| Default | CA-09 | The first minutes of an incident | FB-1 | Report anything odd at once, through the one reporting route, even after clicking. | Something wrong on your screen? Disconnect, do not switch off, and report it. | LM-01 | HRM-02 | HRM-02 Time to first report | 1 |
| Default | CA-10 | Sign-in codes and prompts | FB-2 | Never give anyone a password or a sign-in code, and approve only sign-ins you started yourself. | Never share a code. A prompt you did not start is an attack: reject it and report it. | LM-03 | HRM-01 | HRM-01 Simulation reporting rate | 1 |
| Default | CA-11 | Sharing files and cloud storage | FB-5 | Check the recipient before you send customer or personal data, and stop if the warning says it is going outside. | Share with named people, never with anyone who has the link. | LM-06 | HRM-04 | HRM-04 Incidents with a human factor | 1 |
| Default | CA-12 | Annual review | None: the annual review looks back over the year | Thank you for every report. Which themes continue next year, which change, and why. | None: the review uses every measure | 1 |
Evidence
The incidents, risks, indicators and actions the plan answers (AW-02). Write what happened, never who. The count shows how many months answer each one.
| Row | Evidence ID | Kind | What it is | People's part in it | Owner | Position or status | Months that answer it (calc) | If no theme answers it, why | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | IM-01 | Rule | P09 IM-01: Everyone must report a suspected security event at once through the reporting route; nobody is blamed for a report made in good faith. | In force | 2 | OK | |||
| EXAMPLE | R-09 | Risk (P05) | Staff account taken over through phishing | HR Director | Within appetite | 3 | OK | ||
| EXAMPLE | R-01 | Risk (P05) | Ransomware takes online ordering offline for more than 2 days | Chief Operating Officer | Outside appetite, within tolerance | 3 | OK | ||
| EXAMPLE | MC-34 | Indicator (P11) | Phishing compromises: Incidents in the last 3 calendar months whose root cause was a phishing email: an account taken over, or malware run from an attachment or link. | Head of Information Security | Amber: 2 in 3 months (INC-2026-014, INC-2026-017) | 1 | OK | ||
| EXAMPLE | INC-2026-014 | Incident (P09) | Ransomware on 14 office PCs at Warehouse 2 | Opened a malicious attachment or link: A warehouse office user opened a phishing attachment. | Information Security Manager | Severity 1; closed 21 Aug 2026 | 2 | OK | |
| EXAMPLE | R-04 | Risk (P05) | Ransomware spreads from warehouse office PCs to warehouse systems | Head of Logistics | Within appetite | 1 | OK | ||
| EXAMPLE | R-12 | Risk (P05) | Customer data on an unencrypted laptop at the smaller warehouse site is lost or stolen | Head of Logistics | Within appetite | 1 | OK | ||
| EXAMPLE | R-02 | Risk (P05) | Payment fraud through a compromised supplier email account | Chief Financial Officer | Outside appetite, within tolerance | 2 | OK | ||
| EXAMPLE | INC-2026-015 | Incident (P09) | Request to change a supplier's bank details from its compromised mailbox | Stopped or first reported by staff: The accounts payable clerk called the supplier back on the number on file and stopped the change. | Information Security Manager | Severity 3; closed 4 Sep 2026 | 1 | OK | |
| EXAMPLE | TA-02 | Treatment action (P05) | Call-back verification of every change to supplier bank details, and a payment verification service | Chief Financial Officer | In progress; due 30 Nov 2026 | 1 | OK | ||
| EXAMPLE | INC-2026-016 | Incident (P09) | Customer order spreadsheet sent to the wrong business customer | Sent data to the wrong person: A customer service agent sent a customer spreadsheet to the wrong business customer, and reported it at once. | Information Security Manager | Severity 2; closed 16 Sep 2026 | 1 | OK | |
| EXAMPLE | R-03 | Risk (P05) | Customer data exposed through the ordering service | Chief Operating Officer | Within appetite | 1 | OK | ||
| EXAMPLE | PIA-06 | Review action (P09) | Turn on the warning for external recipients in email, and stop address autocomplete for customer service | Head of IT | In progress; due 15 Oct 2026 | 1 | OK | ||
| EXAMPLE | PIA-01 | Review action (P09) | Remove local administrator rights from all office PCs | Head of IT | In progress; due 31 Oct 2026 | 1 | OK | ||
| EXAMPLE | R-05 | Risk (P05) | Critical weaknesses on internet-facing systems exploited before they are fixed | Head of IT | Within appetite | 1 | OK | ||
| EXAMPLE | INC-2026-017 | Incident (P09) | Staff mailbox taken over after a phishing email | Gave away a password or code: A sales administrator entered a password and a text-message code into a fake sign-in page. | Information Security Manager | Severity declared 2, final 3; closed 24 Sep 2026 | 1 | OK | |
| EXAMPLE | GAP-06 | Readiness gap (P12) | Second factors sent by text message can be phished. Move email and remote access to an authenticator app or security keys. | Head of IT | Open; due 29 Dec 2026 | 1 | OK | ||
| EXAMPLE | JML-13 | Rule | P13 JML-13: The service desk resets a password or a multi-factor authentication factor only after checking the caller's identity independently of the call, by one of the identity checks the Joiner-Mover-Leaver Operating Procedure sets. | In force | 1 | OK | |||
| EXAMPLE | R-11 | Risk (P05) | Cloud storage misconfigured and customer files exposed | Head of IT | Within appetite | 1 | OK | ||
| EXAMPLE | AW-16 | Rule | P16 AW-16: The measures must go monthly to the security and IT leadership team, and monthly to executive management in the metrics programme's executive report, which shows any measure short of target or outside green with the plan's progress (P11). | In force | 1 | OK | |||
| EXAMPLE | R-07 | Risk (P05) | Administrator misuses privileged access | Head of IT | Within appetite | 0 | Answered by the privileged access module (LM-08) on the training matrix and by P14's controls, not by a campaign for everyone. | No theme: reason recorded |
Re-plan Log
One row per change to the approved plan (AW-03). The deadline counts 10 working days from the day the trigger arose, skipping the holidays on the Plan Overview.
| Row | Change ID | Trigger ID | Trigger (calc) | Cause (evidence ID) | Trigger arose on | Re-plan due (calc) | Re-planned on | What moved, and why | Agreed by | In time (calc) |
|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | PC-1 | RP-1 | An incident declared at Severity 1 or 2 with a human factor (P09) | INC-2026-014 | 12 Aug 2026 | 26 Aug 2026 | 14 Aug 2026 | Unexpected attachments (CA-07) moved to Sep 2026; Devices and updates (CA-03) to Jan 2027. Severity 1 ransomware started with a phishing attachment. Devices and updates waits until local administrator rights are removed (P09 PIA-01), so the campaign explains the change. | Head of IT and Chief Operating Officer and Head of Logistics and HR Director | Yes |
| EXAMPLE | PC-2 | RP-1 | An incident declared at Severity 1 or 2 with a human factor (P09) | INC-2026-017 | 22 Sep 2026 | 6 Oct 2026 | 30 Sep 2026 | Sign-in codes and prompts (CA-10) moved to Feb 2027; Phone and message impersonation (CA-08) to Apr 2027. A mailbox was taken over after a password and a text-message code were given to a fake page, declared at Severity 2. The fix comes first: email and remote access move to an authenticator app (P12 GAP-06). Sign-in codes follows it in February and explains the new app. | Chief Financial Officer and HR Director | Yes |
Lists
| BehaviourID | BehaviourText | MeasureID | MeasureName | RoleGroup | RoleGroupName | Channel | Simulation | TriggerID | TriggerText | Kind | MonthStatus |
|---|---|---|---|---|---|---|---|---|---|---|---|
| FB-1 | Report anything odd at once, through the one reporting route, even after clicking. | HRM-01 | Simulation reporting rate | RG-01 | Everyone with an account | E-learning | Group A | RP-1 | An incident declared at Severity 1 or 2 with a human factor (P09) | Incident (P09) | Done |
| FB-2 | Never give anyone a password or a sign-in code, and approve only sign-ins you started yourself. | HRM-02 | Time to first report | RG-02 | Privileged users | Shift briefing | Group B | RP-2 | The same human factor causing two incidents within [[3]] months | Risk (P05) | This month |
| FB-3 | Check before you click a link or open an attachment you did not expect, and never sign in from a link in an email. | HRM-03 | Repeat clickers | RG-03 | Finance and payment authority | Floor terminal | None | RP-3 | A key risk indicator on a people risk entering amber or red (P11 MR-08) | Indicator (P11) | Planned |
| FB-4 | Confirm any request for money, bank details or data by calling a number you already hold, not one in the message. | HRM-04 | Incidents with a human factor | RG-04 | Developers | Poster and screen | RP-4 | A new risk in the register whose cause is people's behaviour (P05) | Review action (P09) | ||
| FB-5 | Check the recipient before you send customer or personal data, and stop if the warning says it is going outside. | HRM-05 | Role training done by its due date | RG-05 | Management body | Intranet and newsletter | Treatment action (P05) | ||||
| BB-1 | Keep your device as IT set it up: let updates install and restart when asked, lock the screen when you step away, and get software only through the service desk. | MC-36 | Staff security training completion (P11) | RG-06 | Executives and their assistants | Team meeting | Readiness gap (P12) | ||||
| MC-34 | Phishing compromises (P11) | RG-07 | Service desk | Simulation | Rule | ||||||
| RG-08 | Customer data handlers |
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Awareness | Knowing what the risks are and what to do about them, shown in what people do at work. In this pack it is measured by behaviour, not by attendance. |
| Behaviour | One observable action at work, such as reporting a suspicious email, calling a supplier back on the number on file, or checking a recipient before sending customer data. |
| Theme | The subject of a campaign, stated as the one behaviour it is meant to change. |
| Campaign | One month's awareness activity on one theme: messages, briefings and, where planned, a simulation. |
| Simulation | A harmless email, written to look like phishing, sent to people who know simulations happen but not when, to practise spotting and reporting it. |
| Baseline course | The short course everyone with an account completes every 12 months, made of the baseline modules. It can be taken in pieces across the year. |
| Role module | Training for a role at higher risk, on top of the baseline course, set by the training matrix. |
| Human factor | A person's action or omission that was one of an incident's causes in the case log's root cause, recorded as what happened, never as who. |
| Evidence | An incident, risk, indicator, review action or gap the plan answers (AW-02), from the pack that owns it: P09 incidents and review actions, P05 risks and treatment actions, P11 indicators, P12 gaps. |
| Theme as approved | The theme the month held when executive management approved the plan. A month whose theme differs was moved by a re-plan, and names it in 'Changed by'. |
| Re-plan | A change to the approved plan after a trigger (RP-1, RP-2, RP-3, RP-4), made within 10 working days and recorded with what moved (AW-03). |
| Simulation group | The half of staff simulated that month. Each person is simulated once every two months, so groups alternate (AW-11). |
| Status: Done | The month has ended, as at the as-at date. |
| Status: This month | The as-at date falls in this month. |
| Status: Planned | The month has not started. |
| FB-n, LM-nn, RG-nn, HRM-nn | The first-month behaviours, modules and role groups of the Role-Based Security Training Matrix, and the human risk measures of the Human Risk Metrics Dashboard. MC-34 and MC-36 are the metrics pack's (P11), used unchanged. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Delete before approval. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 6.3 — Information security awareness, education and training | The plan as a whole: the year's awareness and training activity for everyone, from the organisation's own risks |
| ISO/IEC 27001:2022 | Clause 7.3 — Awareness | Themes and Monthly Plan: what people are made aware of, month by month, and what it asks of them |
| NIST CSF 2.0 | PR.AT-01 — “Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind” | The plan as a whole: awareness provided to everyone so they can perform their tasks with cyber risks in mind |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(g) — “basic cyber hygiene practices and cybersecurity training” | The plan as a whole: cybersecurity training as a risk-management measure |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Whom the Implementing Regulation binds: for other entities it shows what a supervisor expects |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 8.1.2 — an awareness raising programme, which shall “(a) be scheduled over time, so that the activities are repeated and cover new employees; (b) be established in line with the network and information security policy, topic-specific policies and relevant procedures on network and information security; (c) cover relevant cyber threats, the cybersecurity risk-management measures in place, contact points and resources for additional information and advice on cybersecurity matters, as well as cyber hygiene practices for users.” | Monthly Plan: a programme scheduled over time, repeated, covering new employees, threats and contact points |
| NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 8.1.3 — “The awareness raising programme shall, where appropriate, be tested in terms of effectiveness. The awareness raising programme shall be updated and offered at planned intervals taking into account changes in cyber hygiene practices, and the current threat landscape and risks posed to the relevant entities.” | Re-plan Log and review points: the programme tested for effectiveness and updated with the threat landscape and risks |
| DORA — Regulation (EU) 2022/2554 | Article 13(6) — “Financial entities shall develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. Those programmes and training shall be applicable to all employees and to senior management staff, and shall have a level of complexity commensurate to the remit of their functions. Where appropriate, financial entities shall also include ICT third-party service providers in their relevant training schemes in accordance with Article 30(2), point (i).” | Tailoring for financial entities: awareness as a compulsory part of staff training, for all employees and senior management |
| GDPR — Regulation (EU) 2016/679 | Article 39(1)(b) — the data protection officer’s task “to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits” | Themes on personal data (CA-06, CA-11): the Data Protection Officer monitors staff awareness-raising |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR)
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.