Phishing Simulation Ethics & Approval Checklist
Confirms simulations avoid harmful lures, have HR and works-council clearance where required, and protect individual results.
Available soon
- Format
- Excel
- Size
- 73 KB
- Length
- 12 sheets
- Version
- 1.0
- Updated
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Before the first campaign, take the programme through the Programme Approval sheet with Head of Information Security, HR, Data Protection Officer, Legal (AW-09). For each item, look at the evidence, record where it is, the signer's name, the date and the result: Pass, Fail, or N/A with a reason. |
| 2 | Ask Legal whether national law or a collective agreement requires the works council or staff representatives to be informed, consulted or to agree (ET-03). Where it does, do that first, and record it as ET-04 before the others sign. Where it does not, ET-04 is N/A with Legal's reason. |
| 3 | Agree the lawful basis with the Data Protection Officer (ET-05). Where it is legitimate interests, record the assessment. A public authority cannot use legitimate interests for its tasks: use the basis its law gives it. |
| 4 | Set the platform to keep only the simulation record (ET-06), to reduce named results to group figures after 12 months (ET-07) and to show managers groups of at least 10 people only (ET-09). Check each line of 'Who sees what' on the Safeguards sheet in the platform, and record it. |
| 5 | Tell staff before the first campaign what is recorded, who sees it and how support works, without saying when (ET-08). The programme approval is renewed every 12 months and whenever the method changes; the Summary shows the renewal date. |
| 6 | For every campaign, screen the lure on the Lure Screening sheet first (ET-10): HR checks it against the six forbidden topics on the Safeguards sheet and that it names no real colleague, supplier, customer or partner. A rejected lure is replaced, never adjusted until it passes. |
| 7 | Then add the campaign on the Campaign Checks sheet: send date, group, grade (from the progression rule in the Phishing Simulation Programme Method) and the accepted lure, and record the result of each campaign item, ET-10 to ET-15. Send only when the Decision says Cleared to send. A Grade 4 campaign needs the Head of Information Security's written approval and its date. |
| 8 | Sign the Summary when the programme is approved and each time it is renewed. Delete the EXAMPLE rows before use. Do not type over the white calculated columns. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Rule AW-09: "No simulation may run until the programme has been approved on the ethics and approval checklist by the Head of Information Security, HR, the Data Protection Officer and Legal, and cleared with the works council or staff representatives where national law or a collective agreement requires it. The approval is renewed every [[12]] months and whenever the method changes."
Rule AW-10: "A simulation must never use a lure about pay, bonuses, benefits or gifts from the organisation; health or medical matters; redundancy, restructuring or disciplinary action; or a real emergency, disaster or appeal. It must never imitate the reporting route, the security team's own warnings, a real named colleague, or a real supplier or customer."
Rule AW-13: "Individual results are personal data. Only the minimum is recorded: sent, clicked, entered a credential, reported, and when. Never what was typed, and never whether an email was opened. Results by name go only to the person and to the awareness lead; everyone else sees group results of at least [[10]] people. Named results are kept for [[12]] months, then reduced to group figures. The lawful basis, and the legitimate interests assessment where that is the basis, are recorded with the Data Protection Officer before the first campaign, and staff are told in advance what is recorded and who sees it."
AW-10, AW-12, AW-13, AW-14 admit no exception (AW-18); any other departure is a P02 exception, and a Critical one is approved by the board or its equivalent.
EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders. Staff representatives were consulted on 17 Jun 2026; the four signers approved the programme on 24 Jun 2026, on legitimate interests (GDPR Art 6(1)(f)), with the assessment recorded by the Data Protection Officer. Three campaigns ran in Q3. For September, HR rejected "Your September bonus statement is ready to view" on 8 Sep 2026 under FL-1, and it was replaced.
Tailoring — small organisation: the four sign-offs may be two or three people, but HR's and the Data Protection Officer's views are still recorded separately. Keep every campaign check.
Tailoring — regulated entity or public body: a public authority uses the lawful basis its law gives it, not legitimate interests (ET-05). Where national law gives staff representatives a say in monitoring at work, their agreement can be a condition of the whole programme (GDPR Article 88).
Tailoring — simulations run by a service provider: the provider's platform must meet ET-06, ET-07 and ET-09, and its contract must say so. Its staff never see names unless they run the platform for the awareness lead. The decisions on this checklist stay yours.
Summary
Summary and sign-off
Whether the programme is approved and in date, the lures screened and the campaigns cleared. Everything above the sign-off is calculated, except the As-at date.
| As-at date | 30 Sep 2026 | EXAMPLE date (the example quarter end). Type the date you read it. |
Where it stands
| Measure | Value | What it means | ||
|---|---|---|---|---|
| Programme items | 9 | ET-01 to ET-09, on the Programme Approval sheet. | ||
| Pass | 9 | The evidence shows the item is met. | ||
| Fail | 0 | Any Fail means no simulation may run (AW-09). | ||
| N/A | 0 | Each with its reason, such as no works council where none is required. | ||
| Not assessed | 0 | Items with no result yet. | ||
| Programme approval | Approved | Approved when every item is Pass, or N/A with a reason, signed and dated. | ||
| Approved on | 24 Jun 2026 | The last signature's date. | ||
| Renewal due | 24 Jun 2027 | 12 months after approval, or sooner if the method changes (AW-09). | ||
| Programme status | Approved | No campaign is cleared unless this says Approved on its send date. | ||
| Lures screened | 4 | On the Lure Screening sheet (ET-10, AW-10). | ||
| Lures rejected | 1 | Each replaced by a new lure, never adjusted until it passes. | ||
| Campaigns checked | 3 | On the Campaign Checks sheet. | ||
| Cleared to send | 3 | Every campaign check passed, the lure accepted and the programme approval in date. | ||
| Results access set in the platform | 6 of 6 | 'Who sees what' on the Safeguards sheet (ET-09). | ||
Programme sign-off (AW-09)
| Role | Name | Date | Signature or approval reference | |
|---|---|---|---|---|
| Head of Information Security | [[Name]] | 24 Jun 2026 | [[Reference]] | |
| HR | [[Name]] | 24 Jun 2026 | [[Reference]] | |
| Data Protection Officer | [[Name]] | 24 Jun 2026 | [[Reference]] | |
| Legal | [[Name]] | 24 Jun 2026 | [[Reference]] | |
| Works council or staff representatives, where required | EXAMPLE: [[the staff representatives]], consulted | 17 Jun 2026 | [[Minutes reference]] | |
Renew the approval by the renewal date above, and whenever the method changes (AW-09).
Programme Approval
Signed once before the first campaign, renewed every 12 months and when the method changes (AW-09). Yellow columns are yours; the Check column calculates.
| Row | Item ID | Check | Rule | Signed by (role) | Evidence reference | Name | Date | Result | Reason (for Fail or N/A) | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | ET-01 | The purpose is written: to build reporting and to teach, never to catch people out or to rank them. | AW-12 | Head of Information Security | Programme purpose, approved with the plan | [[Name, Head of Information Security]] | 24 Jun 2026 | Pass | OK | |
| EXAMPLE | ET-02 | HR has approved the programme, the support stages and the never-list. | AW-09 | HR | HR approval of the programme, the support stages and the never-list | [[Name, HR]] | 24 Jun 2026 | Pass | OK | |
| EXAMPLE | ET-03 | Legal has confirmed the national rules on monitoring at work and any duty to inform or consult staff representatives (GDPR Art 88). | AW-09 | Legal | Legal note on monitoring at work and the duty to consult | [[Name, Legal]] | 24 Jun 2026 | Pass | OK | |
| EXAMPLE | ET-04 | The works council or staff representatives have been consulted, or have agreed, where national law or a collective agreement requires it. | AW-09 | HR | Consultation with the staff representatives, minutes | [[Name, HR]] | 17 Jun 2026 | Pass | OK | |
| EXAMPLE | ET-05 | The lawful basis is recorded, with a legitimate interests assessment where that is the basis; a public authority uses the basis its law gives it, as Article 6(1)(f) does not apply to its tasks. | AW-13 | Data Protection Officer | Legitimate interests (GDPR Art 6(1)(f)), with the assessment recorded by the Data Protection Officer | [[Name, Data Protection Officer]] | 24 Jun 2026 | Pass | OK | |
| EXAMPLE | ET-06 | Only the fields of the simulation record are kept; the platform is set never to store typed credentials or open tracking. | AW-13 | Data Protection Officer | Platform settings: no credential capture, no open tracking | [[Name, Data Protection Officer]] | 24 Jun 2026 | Pass | OK | |
| EXAMPLE | ET-07 | Named results are deleted or reduced to group figures after [[12]] months, and the platform supplier's contract says so. | AW-13 | Data Protection Officer | Platform supplier contract, deletion clause; platform retention setting | [[Name, Data Protection Officer]] | 24 Jun 2026 | Pass | OK | |
| EXAMPLE | ET-08 | Staff have been told that simulations happen, what is recorded, who sees it and how support works, without being told when. | AW-13 | HR | Staff notice on the intranet and in the induction | [[Name, HR]] | 24 Jun 2026 | Pass | OK | |
| EXAMPLE | ET-09 | The results access table is configured in the platform: managers see groups of at least the minimum size only. | AW-13 | Awareness lead | Platform role settings: managers see groups only | EXAMPLE: Information Security Manager | 24 Jun 2026 | Pass | OK |
Campaign Checks
One row per campaign, before it is sent: the accepted lure, a result for each campaign item (ET-10 to ET-15, in full below the table) and the decision. Send only when it says Cleared to send.
| Row | Campaign ID | Send date | Group | Grade | Lure ID | Lure (calc) | Lure decision (calc) | ET-10 | ET-11 | ET-12 | ET-13 | ET-14 | ET-15 | Grade 4 approved on | Programme approval in date (calc) | Decision (calc) | Cleared by | Notes |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | SIM-2026-07 | 14 Jul 2026 | Group A | 1 | L-01 | A parcel delivery could not be made; follow the link to rebook | Accepted | Pass | Pass | Pass | Pass | Pass | Pass | Yes | Cleared to send | Awareness lead | ||
| EXAMPLE | SIM-2026-08 | 25 Aug 2026 | Group B | 1 | L-02 | A document has been shared with you; sign in to view it | Accepted | Pass | Pass | Pass | Pass | Pass | Pass | Yes | Cleared to send | Awareness lead | ||
| EXAMPLE | SIM-2026-09 | 17 Sep 2026 | Group A | 2 | L-04 | A delivery note from a pallet carrier, with a link to the attached document | Accepted | Pass | Pass | Pass | Pass | Pass | Pass | Yes | Cleared to send | Awareness lead | The first lure proposed (L-03) was rejected under FL-1 on 8 Sep 2026 and replaced. |
The campaign items
ET-10 (AW-10, HR): The lure is on none of the forbidden topics, and names no real colleague, supplier, customer or partner.
ET-11 (AW-11, Awareness lead): The grade is the one the progression rule gives each group; a Grade 4 campaign has the Head of Information Security's written approval.
ET-12 (AW-11, Awareness lead): No Severity 1 or 2 incident is open, and the send avoids payroll day, the busiest trading days and any period of redundancy consultation.
ET-13 (AW-11, HR): Joiners in their first [[30]] days, people on long absence and anyone the person's manager has asked HR to exclude for personal circumstances are left out.
ET-14 (AW-08, Awareness lead): The teaching page is ready for this lure, and the service desk and incident manager know the campaign is running, so a report is thanked and not escalated.
ET-15 (AW-13, Awareness lead): The sending route is allowed through mail filtering for the campaign only, and the simulated domain cannot receive real replies.
Lure Screening
Every lure proposed, screened by HR against the forbidden topics on the Safeguards sheet before it is used (ET-10, AW-10). A rejected lure is replaced, never adjusted until it passes.
| Row | Lure ID | For campaign | The lure (the story the email tells) | Forbidden topic | Names a real person or organisation | Screened by | Screened on | Decision (calc) | Replaced by |
|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | L-01 | SIM-2026-07 | A parcel delivery could not be made; follow the link to rebook | None | No | HR | 7 Jul 2026 | Accepted | |
| EXAMPLE | L-02 | SIM-2026-08 | A document has been shared with you; sign in to view it | None | No | HR | 18 Aug 2026 | Accepted | |
| EXAMPLE | L-03 | SIM-2026-09 | Your September bonus statement is ready to view | FL-1 | No | HR | 8 Sep 2026 | Rejected: FL-1, Pay, bonuses, benefits, pensions, or gifts and vouchers from the organisation | L-04 |
| EXAMPLE | L-04 | SIM-2026-09 | A delivery note from a pallet carrier, with a link to the attached document | None | No | HR | 8 Sep 2026 | Accepted |
Safeguards
Safeguards
What is never done (AW-10, AW-12 to AW-14). AW-10, AW-12, AW-13, AW-14 admit no exception (AW-18). Check 'Who sees what' in the platform before the first campaign and at each renewal.
Forbidden lures (AW-10)
| Topic | Never use | Why | ||
|---|---|---|---|---|
| FL-1 | Pay, bonuses, benefits, pensions, or gifts and vouchers from the organisation | It plays on what people are owed, damages trust in real pay messages, and has caused public backlash where it was used. | ||
| FL-2 | Health, medical results, illness or pandemics | It plays on fear for oneself or one's family. | ||
| FL-3 | Redundancy, restructuring, performance reviews or disciplinary action | It plays on fear for one's job, and can be mistaken for the real thing. | ||
| FL-4 | Real emergencies, disasters, threats to safety, bereavement or charity appeals | It exploits real suffering and trains people to distrust genuine emergency messages. | ||
| FL-5 | The reporting route, or the security team's own warnings | It teaches people to distrust the one channel the programme needs them to trust. | ||
| FL-6 | A real named colleague, or a real supplier, customer or partner | It can harm the person or the relationship named; use fictional names and look-alike, not real, organisations. | ||
What a simulation records, and what it never does (AW-13)
| Recorded | Never recorded |
|---|---|
| Sent: when | What was typed into the sign-in page |
| Clicked: whether and when | Whether the email was opened (opening counts are unreliable and say nothing about behaviour) |
| Entered a credential: whether and when, never what | Location, device or browser details beyond what the platform needs to deliver the page |
Reported: whether and when, through the reporting route
Who sees what (AW-13): set in the platform (ET-09)
| Who | Sees | Set in the platform | Checked on | Notes |
|---|---|---|---|---|
| The person | Their own results, at once, and on request | Yes | 24 Jun 2026 | |
| Awareness lead | Results by name, to send teaching and offer support | Yes | 24 Jun 2026 | |
| Line manager | Their team's group result, if the team has at least [[10]] people; a name only at the third support stage, with the person told first | Yes | 24 Jun 2026 | |
| HR | Nothing by name, except to arrange an adjustment the person agrees to at the third stage | Yes | 24 Jun 2026 | |
| Executive management and the board | Group results and trends only | Yes | 24 Jun 2026 | |
| Everyone else | Nothing | Yes | 24 Jun 2026 |
What the teaching page shows after a click (AW-12)
Shown at once
| 1 | This was a practice email from [[the security team]]. Nobody else will see that you clicked. | |||
| 2 | The cues you could have spotted, marked on a picture of the email. | |||
| 3 | How to report one next time, with the reporting route. | |||
| 4 | One link to the module for this kind of email. No score, no test and no warning. | |||
Never done to a repeat clicker (AW-14)
Never
| 1 | Naming them to colleagues, in a league table, or in any report above the person | |||
| 2 | Sending extra or harder simulations as a penalty | |||
| 3 | Removing access, pay or opportunities because of a simulation result | |||
| 4 | Starting the disciplinary process because of simulation results | |||
Support comes before any sanction, in the stages the Phishing Simulation Programme Method sets. A simulation result is never on its own a ground for disciplinary action (AW-14).
Lists
| Result | YesNo | ForbiddenTopic | FLID | FLTopic | Grade | GradeName |
|---|---|---|---|---|---|---|
| Pass | Yes | None | FL-1 | Pay, bonuses, benefits, pensions, or gifts and vouchers from the organisation | 1 | Grade 1: obvious |
| Fail | No | FL-1 | FL-2 | Health, medical results, illness or pandemics | 2 | Grade 2: plausible |
| N/A | FL-2 | FL-3 | Redundancy, restructuring, performance reviews or disciplinary action | 3 | Grade 3: targeted | |
| FL-3 | FL-4 | Real emergencies, disasters, threats to safety, bereavement or charity appeals | 4 | Grade 4: tailored | ||
| FL-4 | FL-5 | The reporting route, or the security team's own warnings | ||||
| FL-5 | FL-6 | A real named colleague, or a real supplier, customer or partner |
FL-6
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Simulation | A harmless email, written to look like phishing, sent to people who know simulations happen but not when, to practise spotting and reporting it. |
| Lure | The story a simulated email tells to get a click: a parcel, a shared document, an invoice. |
| Cue | A sign in an email that it is not genuine: an unexpected sender, a mismatched link, urgency, a request for a password or payment. |
| Grade | How hard a simulation is to spot, from Grade 1 (many cues) to Grade 4 (one cue, tailored to a role). |
| Teaching page | The page a person sees at once after clicking a simulation: the cues they missed and how to report next time. No score and no warning. |
| Repeat clicker | Someone who clicked in two or more simulations within 12 months. |
| Group result | A simulation result for a group of at least the minimum size, with no name in it. |
| Works council | The body that represents staff where national law or a collective agreement gives it a say in monitoring at work: a works council, staff representatives or a trade union. |
| Programme approval | The 9 programme items signed by Head of Information Security, HR, Data Protection Officer, Legal before the first campaign, renewed every 12 months and when the method changes (AW-09). |
| Pass | The evidence shows the item is met today. |
| Fail | The evidence shows it is not, or there is no evidence. No simulation runs while a programme item fails. |
| N/A | The item does not apply, for example ET-04 where no law or agreement gives staff representatives a say. Give the reason. |
| Cleared to send | Every campaign check passed, the lure was accepted, the programme approval is in date on the send date, and a Grade 4 campaign has its approval. |
| ET-nn, FL-n, AW-nn | The checks, forbidden topics and rules of this pack; the rules are in the Phishing Simulation Programme Method and the pack guide. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 6.3 — Information security awareness, education and training | The checklist as a whole: simulations used for awareness and training, run so they teach |
| ISO/IEC 27001:2022 | Annex A 5.34 — Privacy and protection of PII | ET-05 to ET-09 and Safeguards: privacy and protection of the personal data simulations create |
| NIST CSF 2.0 | PR.AT-01 — “Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind” | The checklist as a whole: awareness provided through simulations that keep people's trust |
| GDPR — Regulation (EU) 2016/679 | Article 5(1)(c) — personal data shall be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’)” | ET-06 and Safeguards: only the simulation record kept; never what was typed, never whether an email was opened |
| GDPR — Regulation (EU) 2016/679 | Article 5(1)(e) — personal data shall be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed” (‘storage limitation’), with the exceptions the Article sets for archiving, research and statistics | ET-07: named results reduced to group figures after 12 months |
| GDPR — Regulation (EU) 2016/679 | Article 6(1)(f) — processing is lawful where it “is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data”. “Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.” | ET-05: the lawful basis, with a legitimate interests assessment where that is the basis; not for a public authority's tasks |
| GDPR — Regulation (EU) 2016/679 | Article 88(1) — Member States “may, by law or by collective agreements, provide for more specific rules to ensure the protection of the rights and freedoms in respect of the processing of employees' personal data in the employment context” | ET-03 and ET-04: national law or collective agreements on processing employees' data, checked before the first campaign |
| GDPR — Regulation (EU) 2016/679 | Article 88(2) — those rules “shall include suitable and specific measures to safeguard the data subject's human dignity, legitimate interests and fundamental rights, with particular regard to the transparency of processing, the transfer of personal data within a group of undertakings, or a group of enterprises engaged in a joint economic activity and monitoring systems at the work place” | ET-03, ET-04 and ET-08: transparency and monitoring at work, with staff told in advance |
| GDPR — Regulation (EU) 2016/679 | Article 39(1)(b) — the data protection officer’s task “to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits” | ET-05 to ET-07: the Data Protection Officer signs the data protection items |
Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR)
ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.