Awareness Campaign Communications Kit
Ready-to-adapt messages, posters and intranet copy for recurring campaign themes.
Available soon
- Format
- Word
- Size
- 68 KB
- Length
- 26 pages
- Version
- 1.0
- Updated
What's inside
What changed
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
Purpose and audience
An awareness campaign changes behaviour only if every message asks for one thing, the same thing, in every channel, and tells people how to report. This kit gives the awareness lead the copy for that: one set of messages for each theme of the Annual Security Awareness Plan, and the recurring messages that run the programme around them.
Every theme names the behaviour it is meant to change and the measure that will show the change, before any copy is written (AW-01). Completion of a course shows that it was delivered, never that it worked. Every message ends with the one reporting route (AW-08).
Part | Audience | Use |
|---|---|---|
Writing rules and channels | Awareness lead | Read once; check every new piece of copy against them |
The themes | Everyone with an account, through posters, the intranet, shift briefings and floor terminals | 12 themes, each with its key message, rule, measure and four pieces of copy |
Recurring messages | Everyone; line managers; people who report | 6 messages, each as a template and, where the EXAMPLE has one, as a completed EXAMPLE |
Inputs, campaign record and annual review | Awareness lead | What each month needs, what was done, and whether it worked (AW-16) |
Guidance — delete before approval
Change the wording to your own voice, but keep three things: one behaviour per piece, the key message in the same words in every channel, and the reporting route at the end.
The EXAMPLE is a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, whose plan year runs July 2026 to June 2027. Its executive committee approved the plan on 26 Jun 2026, and it was re-planned twice in its first quarter. The organisation, roles and figures are fictional.
How every message is written
Seven rules apply to every poster, article, briefing and email in this kit. Each rests on a rule of the programme.
Rule | How to write |
|---|---|
AW-01 | One behaviour per piece. Say what to do, in the words a person would use at work, before saying why. |
AW-08 | End with the reporting route, every time, and with the promise that nobody is blamed for a report. Say "report it", never "forward it to IT" or "let us know": one route, named the same way everywhere. |
AW-02 | Where a control has changed, say what changed and what it means for the reader. Never ask people to make up for a control that is missing. |
AW-12 | No fear, no shame and no league tables. Say "practice email", never "test": nobody passes or fails. Never describe a person who clicked, and name the incident, risk or indicator a theme answers, never the person involved. |
AW-13 | Group results only, and only for groups of at least the minimum size. A small team's result can point to a person. |
AW-14 | Never warn that clicking a practice email has consequences. It does not: support comes before any sanction, and a result alone is never a ground for discipline. |
AW-10 | Never use a forbidden lure topic as an example of a scam, even in a poster. A real-looking pay or bonus email in a poster teaches people to distrust real ones. |
Channels and who they reach
Every theme uses several channels, because no one channel reaches everyone. Staff without a desk are reached by the shift briefing, the poster and the floor terminal; the Annual Security Awareness Plan records which channels each month uses.
Channel | Reaches | How it is used |
|---|---|---|
E-learning | Everyone with a work account and a screen | The module behind the theme, five minutes, linked from the month's article. Completion is recorded (AW-17). |
Shift briefing | Warehouse, transport and other staff without a desk, on every shift including nights | A two-minute talk by the team leader at the start of the shift, from the briefing points. Attendance is recorded on the shift sheet. |
Floor terminal | Staff who share a terminal on the floor or in a depot | The one-line screen message at sign-in, and the module, which runs on the terminal. |
Poster and screen | Everyone on site, including visitors' hosts and agency staff | One poster per theme at entrances, canteens, printers and the warehouse floor; the same line on any display screens. |
Intranet and newsletter | Office staff and managers | The month's article, published on the first working day. The newsletter carries its headline and first paragraph. |
Team meeting | Every team, through its manager | Five minutes at the month's first team meeting: the key message and one question to the team. Used for the annual review. |
Simulation | The group whose turn it is that month | The month's practice email, on the theme where it fits (Phishing Simulation Programme Method). Its teaching page repeats the theme's key message. |
Guidance — delete before approval
Check the channels against your own workforce before the first theme: who has no email, who works nights, who reads another language, who works from customer sites. A channel that misses a group shows up later as a gap in completion.
The themes
The 12 themes, each with its behaviour, rule, measure and EXAMPLE month. Each is one behaviour (AW-01), taught by the modules of the Role-Based Security Training Matrix, and judged by a measure of the Human Risk Metrics Dashboard. The month is the EXAMPLE's, after its two re-plans.
Theme | Behaviour | Rule | Measure | EXAMPLE month |
|---|---|---|---|---|
CA-01 Report it | FB-1 | AW-08 | HRM-01 Simulation reporting rate | July 2026 |
CA-02 Fake sign-in pages | FB-3 | AW-08 | HRM-01 Simulation reporting rate | August 2026 |
CA-03 Devices and updates | BB-1 | AW-02 | HRM-04 Incidents with a human factor | January 2027 (PC-1) |
CA-04 Lost and stolen devices | FB-1 | AW-08 | HRM-04 Incidents with a human factor | October 2026 |
CA-05 Money and bank details | FB-4 | AW-06 | HRM-04 Incidents with a human factor | November 2026 |
CA-06 Customer data: check the recipient | FB-5 | AW-02 | HRM-04 Incidents with a human factor | December 2026 |
CA-07 Unexpected attachments | FB-3 | AW-03 | HRM-01 Simulation reporting rate | September 2026 (PC-1) |
CA-08 Phone and message impersonation | FB-4 | AW-06 | HRM-04 Incidents with a human factor | April 2027 (PC-2) |
CA-09 The first minutes of an incident | FB-1 | AW-08 | HRM-02 Time to first report | March 2027 |
CA-10 Sign-in codes and prompts | FB-2 | AW-02 | HRM-01 Simulation reporting rate | February 2027 (PC-2) |
CA-11 Sharing files and cloud storage | FB-5 | AW-01 | HRM-04 Incidents with a human factor | May 2027 |
CA-12 Annual review | — | AW-16 | — | June 2027 |
The behaviours are the five first-month behaviours every joiner is given on day one (New Joiner Security Induction Deck), and BB-1, keep your device as IT set it up, which the baseline course adds. Every theme repeats one of them, so the year reinforces what joiners learn first.
The measures: a theme whose behaviour is a report is judged on reporting (HRM-01, HRM-02); a theme whose behaviour prevents harm is judged on the incidents with that human factor (HRM-04).
Guidance — delete before approval
Re-plans. A theme moves when the plan is re-planned (AW-03): RP-1 an incident declared at Severity 1 or 2 with a human factor (P09); RP-2 the same human factor causing two incidents within [[3]] months; RP-3 a key risk indicator on a people risk entering amber or red (P11 MR-08); RP-4 a new risk in the register whose cause is people's behaviour (P05). When a theme moves, its launch message says so, and why, as the EXAMPLE September launch below does.
The closing line
Every poster, article and briefing below ends with the same closing line, marked [[Closing line]]. The screen and floor terminal line ends with the route alone, marked [[Route]]. Set them once:
Marked | Replace with |
|---|---|
[[Closing line]] | Report it: [[the reporting route, e.g. the Report button in email, or security@ and extension 4444]]. Nobody is blamed for a report made in good faith. |
[[Route]] | [[the reporting route, e.g. the Report button in email, or security@ and extension 4444]] |
Report it (CA-01)
The behaviour (FB-1): Report anything odd at once, through the one reporting route, even after clicking.
CA-01 Report it | |
|---|---|
Key message | Not sure? Report it. You will never be blamed for a report, even after clicking. |
Rule and modules | AW-08. The one reporting route, the thank-you and the no-blame promise, including a report after a click. LM-01 Report it |
Measure | HRM-01 Simulation reporting rate, target [[40%]] at the group's current grade, in the Human Risk Metrics Dashboard |
EXAMPLE | July 2026. Evidence: IM-01 (P09), R-09 (P05), R-01 (P05). |
Poster, screen and terminal | We would rather hear it twice. Not sure? Report it. You will never be blamed for a report, even after clicking. [[Closing line]] Screen and floor terminal: Not sure about an email? Report it. Nobody is blamed for reporting. [[Route]] |
Intranet and newsletter | We would rather hear from you twice than not at all Most attacks are stopped because someone noticed something odd and said so. An email you did not expect, a sign-in prompt you did not start, a caller who wants a password: report it at once. You do not need to be sure. The security team would rather look at ten harmless emails than miss one real one, and every report is thanked. If you clicked first and noticed afterwards, report it anyway. That is the right thing to do, and nobody is blamed for a report made in good faith. [[Closing line]] |
Shift briefing, two minutes | • What to report: odd emails, texts and calls; sign-in prompts you did not start; a lost phone or laptop; anything on a screen that looks wrong. • How: the reporting route. If you have no screen to hand, phone it. • Clicked something? Report it anyway. A report after a click is the right thing to do. • [[Closing line]] |
Fake sign-in pages (CA-02)
The behaviour (FB-3): Check before you click a link or open an attachment you did not expect, and never sign in from a link in an email.
CA-02 Fake sign-in pages | |
|---|---|
Key message | Never sign in from a link in an email. Go to the site the way you always do. |
Rule and modules | AW-08. Typing a password into a fake page is reported at once, so the password can be changed before it is used. LM-02 Fake sign-in pages |
Measure | HRM-01 Simulation reporting rate, target [[40%]] at the group's current grade, in the Human Risk Metrics Dashboard |
EXAMPLE | August 2026. Evidence: R-09 (P05), MC-34 (P11). |
Poster, screen and terminal | Is that sign-in page really ours? Never sign in from a link in an email. Go to the site the way you always do. [[Closing line]] Screen and floor terminal: Asked to sign in from an email? Do not. Go the usual way. [[Route]] |
Intranet and newsletter | The sign-in page that was not ours A fake sign-in page looks exactly like the real one. It asks for your password, and sometimes your code, and passes them straight to the attacker. The safe habit is simple: never sign in from a link in an email. Go to the site the way you always do, from your bookmark, the app or [[the staff portal]]. If you have typed your password into a page and then had doubts, report it straight away. The password can be changed in minutes, before anyone uses it. [[Closing line]] |
Shift briefing, two minutes | • A link in an email that asks you to sign in is the most common trick there is. • Go to the site the way you always do, never through the link. • Typed your password and now unsure? Report it now. Changing it takes minutes. • [[Closing line]] |
Devices and updates (CA-03)
The behaviour (BB-1): Keep your device as IT set it up: let updates install and restart when asked, lock the screen when you step away, and get software only through the service desk.
CA-03 Devices and updates | |
|---|---|
Key message | Let updates run, lock your screen, and ask before installing anything. |
Rule and modules | AW-02. The campaign follows the change to the control and explains it: here, everyday accounts losing administrator rights. LM-07 Devices, updates and lost equipment |
Measure | HRM-04 Incidents with a human factor, target [[2]] or fewer a quarter, in the Human Risk Metrics Dashboard |
EXAMPLE | January 2027, moved by re-plan PC-1. Evidence: INC-2026-014 (P09), PIA-01 (P09), R-05 (P05). |
Poster, screen and terminal | Updates protect you. Let them run. Let updates run, lock your screen, and ask before installing anything. [[Closing line]] Screen and floor terminal: Let updates run. Lock your screen. Ask before installing. [[Route]] |
Intranet and newsletter | Why your computer now asks before installing anything [[What changed, e.g. From this month, everyday accounts can no longer install software or change system settings.]] It is one of the most effective protections there is: malware that arrives in an email can do far less on an account that cannot install anything. If you need software for your work, ask [[the service desk]], who will install it the same day where they can. Let updates run when they ask, and restart when told to. Lock your screen when you step away. [[Closing line]] |
Shift briefing, two minutes | • Let updates run, and restart when asked. • Need software? Ask the service desk; do not look for a way round. • Lock your screen whenever you walk away from it. • [[Closing line]] |
Lost and stolen devices (CA-04)
The behaviour (FB-1): Report anything odd at once, through the one reporting route, even after clicking.
CA-04 Lost and stolen devices | |
|---|---|
Key message | Lost a laptop or phone? Report it the same day, wherever you are. |
Rule and modules | AW-08. A lost or stolen device is reported through the same route, the same day, wherever the person is. LM-07 Devices, updates and lost equipment |
Measure | HRM-04 Incidents with a human factor, target [[2]] or fewer a quarter, in the Human Risk Metrics Dashboard |
EXAMPLE | October 2026. Evidence: R-12 (P05). |
Poster, screen and terminal | Lost a device? Every hour counts. Lost a laptop or phone? Report it the same day, wherever you are. [[Closing line]] Screen and floor terminal: Lost a work phone or laptop? Report it the same day. [[Route]] |
Intranet and newsletter | A lost laptop is a data problem, not just a hardware one A laptop or phone left on a train, in a car or at a site can hold customer data and open the door to our systems. Report it the same day, wherever you are and whatever the time. The device can be locked or wiped remotely, and the sooner it is, the less can go wrong. Nobody is blamed for losing a device. The harm comes from waiting. [[Closing line]] |
Shift briefing, two minutes | • Lost a phone, laptop or tablet, or had one stolen? Report it the same day. • Out of hours? Phone the route; it is answered. • Never leave a device in a car or on view. • [[Closing line]] |
Money and bank details (CA-05)
The behaviour (FB-4): Confirm any request for money, bank details or data by calling a number you already hold, not one in the message.
CA-05 Money and bank details | |
|---|---|
Key message | Bank details changed? Call back on the number you already hold. Every time. |
Rule and modules | AW-06. Everyone hears the call-back message; people with payment authority take their role module before using it. LM-05 Money, bank details and urgent requests; LM-09 Payments and supplier bank details. Role module for finance and payment authority (AW-06) |
Measure | HRM-04 Incidents with a human factor, target [[2]] or fewer a quarter, in the Human Risk Metrics Dashboard |
EXAMPLE | November 2026. Evidence: R-02 (P05), INC-2026-015 (P09), TA-02 (P05). |
Poster, screen and terminal | Real email address. Fake request. Bank details changed? Call back on the number you already hold. Every time. [[Closing line]] Screen and floor terminal: New bank details? Call back on the number we hold. Every time. [[Route]] |
Intranet and newsletter | The invoice that looked right Fraudsters take over a supplier's mailbox and send a perfectly normal email asking us to pay to new bank details. Everything looks right, because it comes from the real address. The only check that works is a call back on the number we already hold for that supplier, never on a number in the message. [[Our rule: every change to supplier bank details is confirmed by a call back before it is made.]] The same goes for a request from a manager to make an urgent payment, or to send data outside the usual way. Call them back on the number you know. [[Closing line]] |
Shift briefing, two minutes | • Anyone asking to change bank details or pay urgently: call them back on the number we already hold. • A real email address is not proof: mailboxes get taken over. • Unsure? Do not pay. Report it. • [[Closing line]] |
Customer data: check the recipient (CA-06)
The behaviour (FB-5): Check the recipient before you send customer or personal data, and stop if the warning says it is going outside.
CA-06 Customer data: check the recipient | |
|---|---|
Key message | Check the name before you press Send. If it says External, stop and look again. |
Rule and modules | AW-02. The campaign follows the external-recipient warning and explains it; customer data handlers take their role module. LM-06 Customer and personal data; LM-13 Handling customer data by email. Role module for customer data handlers (AW-06) |
Measure | HRM-04 Incidents with a human factor, target [[2]] or fewer a quarter, in the Human Risk Metrics Dashboard |
EXAMPLE | December 2026. Evidence: INC-2026-016 (P09), R-03 (P05), PIA-06 (P09). |
Poster, screen and terminal | Wrong address, real breach. Check the name before you press Send. If it says External, stop and look again. [[Closing line]] Screen and floor terminal: Sending customer data? Check the recipient. External means stop and look. [[Route]] |
Intranet and newsletter | The warning that says External [[What changed, e.g. Email now warns you when a message is going outside the organisation, and no longer fills in addresses for you.]] It is there because the wrong address is the most common way customer data leaks. Before you send customer or personal data, check every recipient. If the warning says External and you did not expect it, stop and look again. If it does go to the wrong person, report it at once, even if you have asked them to delete it. A misdirected email can be a personal data breach, and there are deadlines for deciding whether to report it. [[Closing line]] |
Shift briefing, two minutes | • Before sending customer data, check every name in the To and Copy lines. • The External warning means it is leaving us. Stop and look. • Sent it to the wrong person? Report it at once. That is the right thing to do. • [[Closing line]] |
Unexpected attachments (CA-07)
The behaviour (FB-3): Check before you click a link or open an attachment you did not expect, and never sign in from a link in an email.
CA-07 Unexpected attachments | |
|---|---|
Key message | Not expecting it? Do not open it. Ask the sender another way, or report it. |
Rule and modules | AW-03. A theme moved forward after an incident with a human factor: the plan is re-planned within the window the rule sets. LM-04 Unexpected attachments and links |
Measure | HRM-01 Simulation reporting rate, target [[40%]] at the group's current grade, in the Human Risk Metrics Dashboard |
EXAMPLE | September 2026, moved by re-plan PC-1. Evidence: INC-2026-014 (P09), R-01 (P05), R-04 (P05). |
Poster, screen and terminal | One attachment is all it takes. Not expecting it? Do not open it. Ask the sender another way, or report it. [[Closing line]] Screen and floor terminal: Unexpected attachment? Do not open it. Report it. [[Route]] |
Intranet and newsletter | One attachment is all it takes [[If a recent incident started this way, say so in one sentence, without naming anyone.]] Many ransomware attacks start with a single attachment that looks like a delivery note, an invoice or a shared document. If you were not expecting it, do not open it. Check with the sender another way, using a number or address you already have, or report it. Be most careful with any attachment that asks you to enable content or editing. A genuine document almost never needs that. [[Closing line]] |
Shift briefing, two minutes | • Not expecting an attachment? Do not open it. • Asked to enable content or editing? Stop and report it. • Opened one and now worried? Report it now; it is never too late. • [[Closing line]] |
Phone and message impersonation (CA-08)
The behaviour (FB-4): Confirm any request for money, bank details or data by calling a number you already hold, not one in the message.
CA-08 Phone and message impersonation | |
|---|---|
Key message | A familiar voice or name is not proof. Call back on a number you already hold. |
Rule and modules | AW-06. Executives, their assistants, payment staff and the service desk take role modules on impersonation; everyone hears the key message. LM-05 Money, bank details and urgent requests; LM-11 Executive impersonation; LM-12 Identity checks at the service desk. Role modules for executives and their assistants and service desk (AW-06) |
Measure | HRM-04 Incidents with a human factor, target [[2]] or fewer a quarter, in the Human Risk Metrics Dashboard |
EXAMPLE | April 2027, moved by re-plan PC-2. Evidence: R-02 (P05), JML-13 (P13). |
Poster, screen and terminal | Sounds like the boss? Check. A familiar voice or name is not proof. Call back on a number you already hold. [[Closing line]] Screen and floor terminal: Urgent call or message? Call back on a number you already hold. [[Route]] |
Intranet and newsletter | When the boss calls and it is not the boss A call or message can look and sound like someone you know: a manager, a colleague, a supplier. Voices can be cloned and names copied. If a call or message asks for money, a password, a code or data, and especially if it is urgent, end the conversation and call back on a number you already hold. The service desk does the same for every request to reset a password or a sign-in method: it checks who is asking before it acts. Please expect it, and do not take offence. [[Closing line]] |
Shift briefing, two minutes | • Urgent request by phone or message for money, a password or data? Call back on a number you already hold. • The service desk will check it is you before any reset. That is how it should be. • Unsure? Do not act. Report it. • [[Closing line]] |
The first minutes of an incident (CA-09)
The behaviour (FB-1): Report anything odd at once, through the one reporting route, even after clicking.
CA-09 The first minutes of an incident | |
|---|---|
Key message | Something wrong on your screen? Disconnect, do not switch off, and report it. |
Rule and modules | AW-08. The first minutes of an incident depend on a fast report through the one route. LM-01 Report it |
Measure | HRM-02 Time to first report, target [[10]] minutes or less at the group's current grade, in the Human Risk Metrics Dashboard |
EXAMPLE | March 2027. Evidence: R-01 (P05), IM-01 (P09). |
Poster, screen and terminal | The first five minutes matter most. Something wrong on your screen? Disconnect, do not switch off, and report it. [[Closing line]] Screen and floor terminal: Screen looks wrong? Disconnect, do not switch off, and report. [[Route]] |
Intranet and newsletter | The first five minutes If your screen shows a ransom message, files you cannot open, or programs you did not start, the first minutes matter most. Disconnect from the network: unplug the cable and turn off wireless. Do not switch the computer off, because evidence the response team needs is lost when it powers down. Then report it at once, and tell the people around you. Someone starts looking at every report within minutes. [[Closing line]] |
Shift briefing, two minutes | • Ransom message or strange behaviour on screen? Unplug the network, do not switch off. • Report it at once, then tell your team leader. • Do not try to fix it yourself. • [[Closing line]] |
Sign-in codes and prompts (CA-10)
The behaviour (FB-2): Never give anyone a password or a sign-in code, and approve only sign-ins you started yourself.
CA-10 Sign-in codes and prompts | |
|---|---|
Key message | Never share a code. A prompt you did not start is an attack: reject it and report it. |
Rule and modules | AW-02. The campaign follows the move away from text-message codes and explains it; the new sign-in method is the fix, the message never stands in for it. LM-03 Sign-in codes and prompts |
Measure | HRM-01 Simulation reporting rate, target [[40%]] at the group's current grade, in the Human Risk Metrics Dashboard |
EXAMPLE | February 2027, moved by re-plan PC-2. Evidence: INC-2026-017 (P09), R-09 (P05), GAP-06 (P12). |
Poster, screen and terminal | Your code is your key. Never share a code. A prompt you did not start is an attack: reject it and report it. [[Closing line]] Screen and floor terminal: A sign-in prompt you did not start? Reject it. Report it. [[Route]] |
Intranet and newsletter | The code that unlocks your account The code we send you, or the prompt on your phone, is the last lock on your account. If anyone else has it, they are in. Never give a code to anyone, by phone, message or web page. A sign-in prompt you did not start means someone has your password: reject it and report it. [[What changed, e.g. Since [[date]], you sign in with an app that shows a number to match, in place of a text-message code. A prompt or a number you did not ask for is an attack.]] [[Closing line]] |
Shift briefing, two minutes | • Never give anyone a sign-in code, whoever asks. • A prompt you did not start? Reject it and report it. • [[The new sign-in app: what you see when you sign in, and what to do if a prompt appears that you did not start.]] • [[Closing line]] |
Sharing files and cloud storage (CA-11)
The behaviour (FB-5): Check the recipient before you send customer or personal data, and stop if the warning says it is going outside.
CA-11 Sharing files and cloud storage | |
|---|---|
Key message | Share with named people, never with anyone who has the link. |
Rule and modules | AW-01. One behaviour, one measure: sharing with named people only. LM-06 Customer and personal data |
Measure | HRM-04 Incidents with a human factor, target [[2]] or fewer a quarter, in the Human Risk Metrics Dashboard |
EXAMPLE | May 2027. Evidence: R-11 (P05). |
Poster, screen and terminal | Who else has the link? Share with named people, never with anyone who has the link. [[Closing line]] Screen and floor terminal: Share with named people. Never with anyone who has the link. [[Route]] |
Intranet and newsletter | Who else can open that link? A link that anyone can open is passed on, forwarded and found. Once it is out, it cannot be called back. Share files with the named people who need them. Set an end date where you can, and remove access when the work is done. If you find a file shared more widely than it should be, change it, and report it if customer or personal data was in it. [[Closing line]] |
Shift briefing, two minutes | • Share files with named people, never with anyone who has the link. • Remove access when the job is done. • Customer data shared too widely? Report it. • [[Closing line]] |
Annual review (CA-12)
No behaviour of its own (AW-16). Its key message is carried by the annual review note below, and by a five-minute item at every team meeting that month: "Thank you for every report. Which themes continue next year, which change, and why."
Guidance — delete before approval
Replace the placeholders in the articles with what changed in your own controls, and the EXAMPLE rows with your own month, audiences and evidence. A theme with no evidence behind it is dropped from the plan (AW-02).
Recurring messages
Six messages run the programme around the themes: programme announcement, monthly theme launch, thank-you for a report, campaign close note, note to line managers and annual review note. Each has a template with placeholders, and an EXAMPLE where the distributor's first quarter has one.
Guidance — delete before approval
Send from a named person, never from a no-reply address: people answer a person, and a question about the programme deserves an answer.
Keep every message sent, with its date and recipients, with the plan's records. They show that the programme was delivered as planned and that staff were told in advance what is recorded (Phishing Simulation Ethics & Approval Checklist, ET-08).
Programme announcement
Sent once, before the first practice email, and again when the method changes. Staff must be told, before the first campaign, that simulations happen, what is recorded, who sees it and how support works, but not when (AW-13; Phishing Simulation Ethics & Approval Checklist, ET-08). It goes from the executive sponsor, so it is read as the organisation's commitment.
Template | Programme announcement |
|---|---|
When | Once, after the ethics checklist is signed and before the first simulation; again when the method changes |
To | Everyone with an account |
From | Executive sponsor |
Subject | Practice phishing emails: what they are, what we record, and who sees it |
Message | Dear colleagues, From this month, you will now and then receive a practice email from the security team that looks like phishing. Everyone gets one about every [[2]] months. We will not tell you when. New starters get none in their first [[30]] days. What we want you to do: report it, through the reporting route, as you would any suspicious email. Reporting is what we measure. A report after a click is just as welcome. If you click: you will see a short page showing what you could have spotted and how to report next time. Nobody else will see that you clicked. There is no score, no test and no warning. What we record: when the email was sent, and whether and when you clicked it, typed anything into its sign-in page, or reported it. We never record what you typed, or whether you opened the email. Who sees it: you see your own results. The awareness lead sees results by name, only to send teaching and to offer help. Managers see their team's figures only for teams of at least [[10]] people. Results are never published or ranked, and names are removed after [[12]] months. If you click more than once: you will be offered a short private coaching session, and if it keeps happening, more support and stronger protection for your account. A practice email result is never on its own a reason for disciplinary action. Why we can do this: [[the lawful basis the Data Protection Officer recorded]]. [[the works council or staff representatives were consulted on [[date]] / delete if not required]]. We will never use emails about pay, bonuses, health, redundancy or real emergencies. Questions: [[Name]], Awareness lead. Report it: [[the reporting route, e.g. the Report button in email, or security@ and extension 4444]]. Nobody is blamed for a report made in good faith. Thank you, [[Name]], Executive sponsor |
EXAMPLE: sent by the HR Director, the executive sponsor and owner of the phishing risk, on Wednesday 1 July 2026: after the ethics checklist was signed on 24 Jun 2026 by Head of Information Security, HR, Data Protection Officer and Legal, and before the first practice email on 14 Jul 2026. Its "why we can do this" line read: "Legitimate interests (GDPR Art 6(1)(f)), with the assessment recorded by the Data Protection Officer. The staff representatives were consulted on 17 Jun 2026."
Monthly theme launch
Sent on the first working day of each month. It names the theme's behaviour, why it was chosen, and the five-minute module. When a theme has moved because of a re-plan, it says so.
Template | Monthly theme launch |
|---|---|
When | The first working day of each month |
To | Everyone with an account; team leaders for the shift briefing |
From | Awareness lead |
Subject | This month: [[Theme]] |
Message | Dear colleagues, This month's theme is [[Theme]]. [[The theme's key message]] Why now: [[Why this theme, this month: the incident, risk or indicator it answers, in one sentence, naming no one]] What is changing: [[What changed in the control this theme follows, and when, or delete]] Five minutes: [[Module title, and where to find it]]. Team leaders will run a two-minute briefing at the start of every shift this week. Report it: [[the reporting route, e.g. the Report button in email, or security@ and extension 4444]]. Nobody is blamed for a report made in good faith. [[Name]], Awareness lead |
EXAMPLE: Tuesday 1 September 2026 | Monthly theme launch |
|---|---|
When | The first working day of each month |
To | Everyone with an account; team leaders for the shift briefing |
From | [[Name]], Information Security Manager |
Subject | This month: unexpected attachments |
Message | Dear colleagues, This month's theme is unexpected attachments. Not expecting it? Do not open it. Ask the sender another way, or report it. Why now: In August, ransomware on 14 office PCs at Warehouse 2 started with one phishing attachment that looked like ordinary work. We had planned to talk about devices and updates this month; that moves to January 2027, once everyday accounts can no longer install software, so that it can explain the change. Five minutes: Unexpected attachments and links, five minutes, [[in the learning system]]. Team leaders will run a two-minute briefing at the start of every shift this week. Report it: [[the reporting route, e.g. the Report button in email, or security@ and extension 4444]]. Nobody is blamed for a report made in good faith. [[Name]], Information Security Manager |
Thank-you for a report
Every report is thanked and, where the person asks, told what happened next (AW-08). The automatic reply goes at once; the other three are sent by hand. The reply times are the triage times of the incident management pack (P09 IM-02).
Template | Thank-you for a report |
|---|---|
When | Automatic reply at once; a personal reply when the person asks what happened |
To | The person who reported |
From | Awareness lead |
Subject | Thank you for your report |
Message | Automatic reply, at once: Thank you for reporting this. Someone starts looking at every report within 30 minutes in working hours, and 60 outside them. If you clicked a link or typed a password, say so in a reply or phone [[the reporting route, e.g. the Report button in email, or security@ and extension 4444]]: it is the right thing to do, and nobody is blamed for it. If it was a practice email: Well spotted: this was our practice email [[Campaign ID]]. Reporting it is exactly right, and it is what we count. If it was real: You were right. It was a real phishing email, and we have [[removed it from every mailbox and blocked the sender]]. Your report protected your colleagues. If it was harmless: Thank you. This one was genuine, and you were right to check. Please keep reporting. [[Name]], Awareness lead |
EXAMPLE: as the template, with SIM-2026-09 as the practice email, sent on 17 Sep 2026. In September 2026 staff also reported 83 suspicious emails, 16 of them real phishing; every one had the automatic reply.
Campaign close note
Sent to the send group simulated within [[3]] working days of the campaign closing. It carries the cues the practice email left and a thank-you to those who reported. No figure, by name, by team or for the organisation: results are never published, ranked or announced (AW-12), and everyone outside the people listed in the results access table sees nothing (AW-13).
Template | Campaign close note |
|---|---|
When | Within [[3]] working days of the campaign closing ([[5]] working days after it is sent) |
To | Everyone in the send group simulated |
From | Awareness lead |
Subject | Last week's practice email: the cues, and thank you |
Message | Dear colleagues, Last week some of you received a practice email: "[[What the practice email said, in one line]]". The cues: [[The two or three cues, e.g. a sender you do not deal with; a link whose address did not match its text]]. Thank you to everyone who reported it. Reporting is what keeps a real attack short. If you clicked, you have already seen the teaching page; nothing more happens. We do not publish results, by name or by team. Report it: [[the reporting route, e.g. the Report button in email, or security@ and extension 4444]]. Nobody is blamed for a report made in good faith. [[Name]], Awareness lead |
EXAMPLE: Tuesday 29 September 2026 | Campaign close note |
|---|---|
When | Within [[3]] working days of the campaign closing ([[5]] working days after it is sent) |
To | Everyone in the send group simulated |
From | [[Name]], Information Security Manager |
Subject | Last week's practice email: the cues, and thank you |
Message | Dear colleagues, Last week some of you received a practice email: "A delivery note from a pallet carrier, with a link to the attached document". The cues: it came from a pallet carrier we do not use; the link's address did not match the carrier's name; a delivery note asked you to sign in before you could see it. Thank you to everyone who reported it. Reporting is what keeps a real attack short. If you clicked, you have already seen the teaching page; nothing more happens. We do not publish results, by name or by team. Report it: [[the reporting route, e.g. the Report button in email, or security@ and extension 4444]]. Nobody is blamed for a report made in good faith. [[Name]], Information Security Manager |
Note to line managers
Sent only to the managers of teams of at least [[10]] people (AW-13). It gives the team's group result and asks the manager to thank the team, never to find out who clicked.
Template | Note to line managers |
|---|---|
When | With the campaign close note |
To | Line managers of teams of at least the minimum size |
From | Awareness lead |
Subject | Your team's result: practice email [[Campaign ID]] |
Message | Dear [[Line manager]], Your team, [[Team]], received practice email [[Campaign ID]] at [[Grade n]]. Of its [[n]] people, [[n%]] reported it, and the first report came in after [[n]] minutes. Across the organisation, [[n%]] reported it. Please: thank your team for reporting, and remind them of the reporting route. Use the month's briefing points if you have a team meeting. Please do not: ask who clicked, compare people or teams, or treat the result as a performance matter. The figures are for your team only and must not be shared. You see this only because your team has at least [[10]] people. [[Name]], Awareness lead |
EXAMPLE: not drawn. The distributor's team results are not part of the EXAMPLE. The access a line manager has is: "Their team's group result, if the team has at least [[10]] people; a name only at the third support stage, with the person told first".
Annual review note
Sent in the last month of the plan year, once the annual review has judged each theme (AW-16). It tells staff which themes continue next year, which change and why, and a thank-you for every report. It carries no simulation figure: results are never announced (AW-12).
Template | Annual review note |
|---|---|
When | In the last month of the plan year, after the annual review (AW-16) |
To | Everyone with an account |
From | Executive sponsor |
Subject | A year of awareness: thank you, and what next |
Message | Dear colleagues, [[One sentence for each theme that continues next year, and why: the incident, risk or indicator it still answers. No figures: results are never announced (AW-12).]] [[One sentence for each theme that changes or stops, and why.]] [[Next year's first three themes, and the incident, risk or indicator each answers.]] Thank you for every report. Report it: [[the reporting route, e.g. the Report button in email, or security@ and extension 4444]]. Nobody is blamed for a report made in good faith. [[Name]], Executive sponsor |
EXAMPLE: not yet sent. The distributor's first annual review falls in June 2027.
Required inputs with owners
What must be ready before each month's theme is launched, and who supplies it.
Input | Needed for | Owner |
|---|---|---|
The approved plan: each month's theme, its audiences and its channels | Every theme launch | Awareness lead |
The reporting route, with its phone number for people without a screen | Every piece of copy (AW-08) | Incident manager |
What changed in the control the theme follows, and the date | Themes that follow a fix (AW-02) | [[the control's owner, e.g. Head of IT]] |
The signed ethics checklist, the lawful basis and what is recorded | Programme announcement (AW-09, AW-13) | Data Protection Officer |
Shift patterns and team leaders for every site, including nights | Shift briefings | [[e.g. Head of Logistics]] |
Each campaign's group results, with its grade | Note to line managers (AW-13) | Awareness lead |
Team sizes, so that no result goes to a team below the minimum size | Note to line managers | HR |
Suspicious emails reported each month, and how many were real | Campaign record; annual review | Incident manager |
Module completions for the theme's modules | Campaign record (AW-17) | HR Learning Lead |
Translations, large print and audio versions where staff need them | Every theme | [[e.g. HR Business Partner]] |
Campaign record
One row a month: what ran, what it reached and what was decided. It is the record the annual review reads, and the evidence that the plan was delivered (AW-16, AW-17). The simulation figures are the Phishing Simulation Programme Method's; the real reports are the incident manager's count of suspicious emails staff reported.
Month and theme | Channels used | Practice email | Reported | First report | Real reports | Decisions and actions |
|---|---|---|---|---|---|---|
[[Month]] [[Theme]] | [[Channels]] | [[Campaign ID, group, grade]] | [[n% (n of n)]] | [[n min]] | [[n (n real)]] | [[What was decided, by whom, and by when]] |
July 2026 CA-01 Report it EXAMPLE | E-learning; Shift briefing; Floor terminal; Poster and screen; Simulation | SIM-2026-07, Group A, Grade 1 | 22% (98 of 444) | 9 min | 41 (9 real) | None |
August 2026 CA-02 Fake sign-in pages EXAMPLE | E-learning; Shift briefing; Floor terminal; Poster and screen; Simulation | SIM-2026-08, Group B, Grade 1 | 26% (116 of 446) | 6 min | 57 (12 real) | Re-plan PC-1 on 14 Aug 2026 (RP-1): Severity 1 ransomware started with a phishing attachment. |
September 2026 CA-07 Unexpected attachments EXAMPLE | E-learning; Shift briefing; Floor terminal; Poster and screen; Simulation | SIM-2026-09, Group A, Grade 2 | 28% (124 of 441) | 4 min | 83 (16 real) | Re-plan PC-2 on 30 Sep 2026 (RP-1): A mailbox was taken over after a password and a text-message code were given to a fake page, declared at Severity 2. Lure "Your September bonus statement is ready to view" rejected by HR on 8 Sep 2026 (FL-1). 11 repeat clickers offered coaching on 28 Sep 2026. |
Reporting rates are compared only at the same grade (AW-15). In the EXAMPLE, September's 28% at Grade 2 is not compared with August's 26% at Grade 1: the Human Risk Metrics Dashboard marks it as a break in series.
Annual review of the themes
Once a year the awareness lead reviews whether each theme changed the behaviour it named, and the next plan keeps, changes or drops it on that evidence. Fill in one row per theme, then decide. A theme is kept only if its behaviour moved, or if it has not yet had a fair chance.
Theme | Measure | Before | After | Same grade? | Moved? | Keep, change or drop | Reason |
|---|---|---|---|---|---|---|---|
[[CA-nn Theme]] | [[HRM-nn]] | [[value, date]] | [[value, date]] | [[Yes / No / n.a.]] | [[Yes / No / Too soon]] | [[Keep / Change / Drop]] | [[Why, in one line]] |
Keep a theme whose behaviour moved, or which has not run long enough to tell. Change the channel, audience or copy where the behaviour did not move but the risk remains. Drop a theme whose evidence has gone. Tell staff the result in the annual review note, and take the decisions into next year's plan.
Related documents
Document | Relationship |
|---|---|
Annual Security Awareness Plan | Which theme runs in which month, with its audiences, channels and evidence (AW-02, AW-03) |
Role-Based Security Training Matrix | The modules each theme links to, and the role groups (AW-04, AW-06) |
Phishing Simulation Programme Method | The practice emails that run with the themes, and the teaching page (AW-11, AW-12) |
New Joiner Security Induction Deck | The five first-month behaviours every theme repeats (AW-05) |
Training Completion & Evidence Register | Completions of the modules each theme links to (AW-17) |
Phishing Simulation Ethics & Approval Checklist | What staff must be told before the first practice email (ET-08), and the forbidden lures (AW-10) |
Human Risk Metrics Dashboard | The measures each theme names (AW-15) |
Security Incident Management Policy (P09) | The reporting route every message ends with (IM-01) |
Incident Case & Action Log (P09) | The incidents and human factors the themes answer |
Information Security Risk Register (P05) | The people risks the themes answer |
Security KPI & KRI Catalogue (P11) | Training completion and phishing compromises, imported unchanged |
Adapting this template
Guidance — delete before approval
Small organisation: one theme a quarter is enough, from the four that answer your own incidents. Keep the reporting route in every message and the thank-you reply; the manager note can go when no team reaches the minimum size.
Staff without desks: the shift briefing and the poster carry the theme. Brief team leaders on all shifts, nights included, and record attendance on the shift sheet: it is how their completion is counted.
Several languages: translate the key message, the poster and the briefing points, not only the article. Keep the reporting route in the same words in every language.
Works council or staff representatives: share the programme announcement with them before it goes out, and say in it that they were consulted.
Regulated entity: NIS2 Implementing Regulation (EU) 2024/2690 expects an awareness programme scheduled over time, covering new employees, threats, the measures in place and contact points (Annex, point 8.1.2). The plan, this kit's themes and the reporting route in every message are that programme. It binds only the digital providers its Article 1 names; for others it shows what a regulator expects.
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR).
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Annex A 6.3 — Information security awareness, education and training | The themes and recurring messages: awareness for everyone, kept up to date |
ISO/IEC 27001:2022 | Clause 7.4 — Communication | Recurring messages: what is communicated, when, to whom and by whom |
NIST CSF 2.0 | PR.AT-01 — “Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind” | The themes: everyone given the awareness to do their job with security in mind |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(g) — “basic cyber hygiene practices and cybersecurity training” | The themes: basic cyber hygiene practices, as messages people act on |
NIS2 — Implementing Regulation (EU) 2024/2690 | Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers | Who the Implementing Regulation binds |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 8.1.1 — “the relevant entities shall ensure that their employees, including members of management bodies, as well as direct suppliers and service providers are aware of risks, are informed of the importance of cybersecurity and apply cyber hygiene practices.” | Channels and who they reach: employees, management and suppliers' staff |
NIS2 — Implementing Regulation (EU) 2024/2690 | Annex, point 8.1.2 — an awareness raising programme, which shall “(a) be scheduled over time, so that the activities are repeated and cover new employees; (b) be established in line with the network and information security policy, topic-specific policies and relevant procedures on network and information security; (c) cover relevant cyber threats, the cybersecurity risk-management measures in place, contact points and resources for additional information and advice on cybersecurity matters, as well as cyber hygiene practices for users.” | The themes and channels: an awareness programme repeated over time, covering threats, measures in place and contact points |
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.
Definitions
Term | Meaning in this pack |
|---|---|
Awareness | Knowing what the risks are and what to do about them, shown in what people do at work. In this pack it is measured by behaviour, not by attendance. |
Behaviour | One observable action at work, such as reporting a suspicious email, calling a supplier back on the number on file, or checking a recipient before sending customer data. |
Campaign | One month's awareness activity on one theme: messages, briefings and, where planned, a simulation. |
Channel | A way a message reaches people: e-learning, a shift briefing, a floor terminal, a poster or screen, the intranet, a team meeting or a practice email. |
Cue | A sign in an email that it is not genuine: an unexpected sender, a mismatched link, urgency, a request for a password or payment. |
Group result | A simulation result for a group of at least the minimum size, with no name in it. |
Human factor | A person's action or omission that was one of an incident's causes in the case log's root cause, recorded as what happened, never as who. |
Key message | The one sentence a theme asks people to remember, used in the same words in every channel. |
Lure | The story a simulated email tells to get a click: a parcel, a shared document, an invoice. |
Practice email | A simulation, as staff are told about it. A harmless email, written to look like phishing, sent to people who know simulations happen but not when, to practise spotting and reporting it. |
Reported | The person used the reporting route for the simulated email. This is the behaviour the programme exists to build. |
Reporting route | The one way to report anything suspicious (P09 IM-01), named the same way in every message. |
Teaching page | The page a person sees at once after clicking a simulation: the cues they missed and how to report next time. No score and no warning. |
Theme | The subject of a campaign, stated as the one behaviour it is meant to change. |
AW-nn | Rule numbers of the Security Awareness Programme pack, set in its guide and quoted by every document in it. |