Ask staff when their security training happens and many will say the same thing: the week before the deadline, with the video muted in another tab. The completion rate hits 100%, the auditor is satisfied, and nobody behaves any differently.
A security awareness program that works looks different. It focuses on a handful of behaviours, trains people for the risks in their actual job, runs all year in small doses, and measures what people do rather than what they clicked through. This guide shows how to build one, and how it maps to NIS2 and ISO 27001.
Why annual slideware fails
The once-a-year compliance module persists because it is easy to buy, easy to assign and easy to evidence. It fails for predictable reasons:
- People forget. A single session in January is a distant memory by the time a convincing invoice email arrives in September.
- It is generic. The accounts payable clerk, the HR recruiter and the system administrator face very different attacks, but they watch the same video.
- It tells instead of practises. Knowing that phishing exists is not the same as spotting a well-crafted lure under time pressure.
- It measures the wrong thing. Completion rate proves attendance, not behaviour.
- It ignores the environment. If reporting a suspicious email takes five steps, or the approved file-sharing tool is painful, training alone will not change what people do.
NIST’s updated guidance, SP 800-50 Rev. 1 Building a Cybersecurity and Privacy Learning Program (September 2024), reflects this shift: it treats awareness and training as an ongoing learning program with planning, design, implementation and continuous assessment, rather than a one-off event.
A behaviour-change approach
Start from the behaviours you want, not the topics you want to cover. A short list is far more effective than a long curriculum.
Pick 6–8 target behaviours
For most organisations, a good starting list is:
- Report suspicious emails, messages and calls quickly, using one clear channel.
- Verify payment or bank-detail changes through a known, separate channel.
- Use multi-factor authentication on every account that supports it.
- Use a password manager and unique passwords.
- Install updates when prompted, on work and personal devices used for work.
- Lock screens and protect devices when travelling or working remotely.
- Share and store data only in approved tools, including AI tools.
- Report lost devices and mistakes immediately, without fear of blame.
Make each behaviour easy, normal and prompted
For each behaviour, ask three questions:
- Is it easy? One-click report button, single sign-on, a password manager already installed. Remove friction before you ask for effort.
- Is it normal? Do managers and executives visibly do it? Do people get thanked when they report? Culture is set by what leaders do, not what the policy says.
- Is there a prompt at the right moment? A banner on external emails, a reminder in the payment workflow, a short tip when someone first signs into a new tool.
Then use training to supply the knowledge and practice that remain. Short, frequent sessions (5–15 minutes) beat long annual ones. Realistic practice, such as a well-run phishing simulation program, builds the habit of reporting.
Role-based training
Everyone needs a common baseline. On top of that, the roles attackers target most need tailored content. The table below is a starting point.
| Role | Main risks | Training focus | Good formats |
|---|---|---|---|
| Finance and accounts payable | Business email compromise, invoice fraud, fake supplier bank changes, urgent “CEO” payment requests | Out-of-band verification, dual approval, spotting lookalike domains, what to do after a suspicious payment | Scenario walk-throughs using real (anonymised) process steps |
| HR and recruitment | Malicious CVs and attachments, fake candidates, requests for payroll or employee data, onboarding and offboarding gaps | Safe handling of attachments, verifying data requests, GDPR basics, joiner-mover-leaver process | Short modules plus a checklist for data requests |
| IT, helpdesk and admins | Helpdesk impersonation for password or MFA resets, privileged account misuse, MFA fatigue, unpatched systems | Caller identity verification, privileged access hygiene, change control, incident escalation | Hands-on labs, reset-request role plays, runbook reviews |
| Executives and board | Targeted spear phishing, voice or video impersonation, travel risks, decision-making under pressure in a crisis | Personal account security, verification codes with assistants, oversight duties, crisis roles | Briefings and tabletop exercises |
Other groups worth tailoring for include developers (secure coding, secrets handling), customer service (account takeover via social engineering) and anyone with access to large volumes of personal data. Our guide on protecting against social engineering attacks covers the techniques behind many of these scenarios.
Linking the program to NIS2 and ISO 27001
A behaviour-focused program also gives you strong compliance evidence. This is general guidance, not legal advice.
NIS2 Article 20 and Article 21
Directive (EU) 2022/2555 (NIS2) includes training in two places:
- Article 20(2) requires member states to ensure that members of the management bodies of essential and important entities follow training, and to encourage those entities to offer similar training to their employees on a regular basis. The aim is for people to gain enough knowledge and skills to identify risks and assess cybersecurity risk-management practices and their impact on the entity’s services.
- Article 21(2)(g) lists “basic cyber hygiene practices and cybersecurity training” among the minimum cybersecurity risk-management measures.
National transpositions can go further. In Italy, Article 23(2) of Legislative Decree 138/2024 requires management bodies to follow cybersecurity training and to promote regular training for employees consistent with it. For the board-level part, see our article on NIS2 management training under Article 20, and for the wider picture the NIS2 compliance checklist.
ISO/IEC 27001:2022 control 6.3
In ISO/IEC 27001:2022, Annex A control 6.3 is “Information security awareness, education and training”. It expects personnel and relevant interested parties to receive appropriate awareness, education and training, and regular updates on the organisation’s policies and procedures relevant to their job. The standard’s clauses on competence (7.2) and awareness (7.3) support it.
Auditors typically want to see more than completion records:
- A documented training plan linked to your risk assessment and roles
- Evidence of delivery (attendance, materials, dates)
- Evidence that effectiveness is evaluated, and that the plan is updated as a result
- Coverage of new starters, role changes and contractors where relevant
A program built around measured behaviours makes the third point easy to show.
Measuring security culture
Measure behaviours and outcomes, not only participation. Combine a few metrics from each group below and review them quarterly.
Behaviour metrics
- Phishing simulation report rate and time to first report, by difficulty level
- Share of real suspicious emails reported by staff (from your SOC or email security tool)
- MFA enrolment and password manager adoption rates
- Number of lost devices and mistakes self-reported (a rising number early on is often good news)
Process and risk metrics
- Payment-change requests verified out of band
- Time from leaver date to account removal
- Policy exceptions requested and granted
Perception metrics
Run a short anonymous survey once or twice a year. Useful statements to rate from “strongly disagree” to “strongly agree”:
- “I know how to report a suspicious email or call.”
- “If I made a security mistake, I would feel comfortable reporting it.”
- “Security rules here make sense for my job.”
- “My manager takes security seriously.”
The second statement is often the most revealing. If people are afraid to report mistakes, incidents will surface later and cost more. That links directly to your incident response capability.
Sample 12-month awareness calendar
This calendar assumes one main theme per month, a short activity for everyone, and extra content for targeted roles. October aligns with European Cybersecurity Month, coordinated by ENISA, and Cybersecurity Awareness Month in the US. Adjust to your own risk assessment and business cycle.
| Month | Theme | Everyone | Targeted roles |
|---|---|---|---|
| January | Program launch and baseline | Leadership kickoff message, baseline survey, baseline phishing simulation | Board briefing on the year’s plan and NIS2 duties |
| February | Phishing and reporting | 10-minute module on reporting; introduce the report button | Helpdesk: handling reported emails |
| March | Accounts, passwords and MFA | Password manager rollout, MFA enrolment drive | IT admins: privileged account hygiene |
| April | Payment and invoice fraud | Short “verify before you pay” video | Finance: payment-change scenario workshop |
| May | Data protection | Handling personal data and approved sharing tools | HR: data requests and joiner-mover-leaver process |
| June | Travel and remote work | Devices, public Wi-Fi, screen privacy before the summer | Executives: travel security briefing |
| July | Light-touch month | One short tip and one simulation only | Review half-year metrics |
| August | Updates and devices | “Update when prompted” reminder; mobile security | IT: patch process review |
| September | AI tools and new threats | Safe use of AI tools; voice and video impersonation | Executives and assistants: verification routines |
| October | Cybersecurity Month | Quiz, live session, recognition for top reporters | Management tabletop exercise |
| November | Incident reporting | “What to do if you clicked” walk-through | IT and SOC: escalation drill |
| December | Seasonal scams and review | Delivery and gift-card scam awareness | Annual metrics review; plan next year |
Keep phishing simulations running throughout the year at a steady cadence, independent of the monthly theme. If you need a faster start, our 30-day security awareness training plan condenses the core topics into four weeks.
Making it stick
- Name an owner with time and a budget, not a side task for whoever is free.
- Build a champions network: one volunteer per team who shares tips and feeds back problems.
- Get leaders on camera. A two-minute message from the CEO about reporting does more than a policy update.
- Fix friction you discover. When training reveals that a secure process is painful, change the process.
- Report to management quarterly using behaviour metrics, not just completion rates.
AceFortis runs practical security awareness training for staff, targeted roles and management – get in touch to plan a session.
FAQ
How long should security awareness training sessions be?
For general staff, 5–15 minutes at a time, several times a year, works better than one long session. Reserve longer workshops for high-risk roles and management.
Does NIS2 require training for all employees?
NIS2 Article 20(2) requires training for members of management bodies and asks member states to encourage regular training for employees. Article 21 also lists cybersecurity training among the required measures. National laws may be stricter; Italy’s Legislative Decree 138/2024 requires management bodies to promote regular employee training.
What evidence do ISO 27001 auditors expect for control 6.3?
Usually a training plan linked to roles and risks, records of delivery, and evidence that you evaluate effectiveness and act on the results.
What is the single most useful metric?
If you pick one, choose the rate at which staff report suspicious messages, alongside how quickly they do it. It reflects both awareness and trust.
