You do not need a six-month project to improve how your team handles security. Twenty short sessions of 5–10 minutes each, spread over 30 days, can build the habits that defend against common everyday attacks: reporting suspicious messages, using strong sign-in, protecting devices and data, and speaking up quickly when something goes wrong.
This plan is ready to copy. It has a kickoff, four weekly themes, one activity per working day, a wrap-up and a simple way to measure results. Adapt the examples to your own tools and policies.
How the plan works
- Length: 30 calendar days, starting on a Monday. Four working weeks contain 20 daily activities; the last days are for wrap-up and measurement.
- Time per day: 5–10 minutes. Send each activity first thing in the morning by email or chat, or open team stand-ups with it.
- Audience: everyone, including managers and executives. Leaders taking part visibly is what makes it work.
- Owner: one coordinator (IT, security, HR or training) plus a “champion” in each team to answer questions.
- Tone: practical and blame-free. The message throughout is “here is how to protect yourself and the company”, not “here is what you are doing wrong”.
Before you start: preparation checklist
Do these in the week before kickoff:
- Confirm there is one clear way to report suspicious emails and messages (ideally a report button) and that someone monitors it.
- Check that MFA is available for email and key business systems, and that a password manager is approved and available if you will recommend one.
- Write down your approved tools for file sharing and AI, so staff know what “approved” means.
- Agree a short executive message for the kickoff.
- Collect your baseline numbers (see the measurement section).
- If you plan to run a phishing simulation, agree the rules first with HR and your DPO. Our phishing simulation program guide covers the ethical and privacy points.
Kickoff (Day 1)
Start with a 10–15 minute session, live or recorded, led by a senior manager. Cover three points: why this matters to the business, what the next 30 days look like, and that reporting mistakes is always welcome.
Copy-paste kickoff message:
Subject: 30 days, 10 minutes a day: our security awareness plan starts today
Hi everyone. Most cyberattacks start with a message to a person, not a hack of a server. For the next four weeks, you will get one short activity each working day, usually under 10 minutes. The themes are: phishing and social engineering; passwords, MFA and accounts; devices, data and remote work; and incident reporting and AI tools. There are no trick questions and no blame. If you ever think you have clicked something you should not have, report it straight away to [report channel]. A fast report is always the right call. Thank you for taking part. [Name, role]
Week 1: Phishing and social engineering
Goal: everyone can spot common lures and knows exactly how to report one. Background reading for the coordinator: what phishing is and how to stop it.
| Day | Activity (5–10 min) | Key takeaway |
|---|---|---|
| 1 | Kickoff session and message (above) | Why we are doing this; reporting is always welcome |
| 2 | Show three real-looking example phishing emails (anonymised); ask staff to find the red flags | Check sender, links, urgency and unusual requests |
| 3 | Walk through how to use the report button or channel; everyone reports a safe test email sent by the coordinator | One click, every time, even if unsure |
| 4 | Phone and SMS scams: short scenario of a caller “from IT” asking for a code | We never ask for passwords or MFA codes; hang up and call back on a known number |
| 5 | Payment and invoice fraud: a supplier “changes bank details” by email | Verify any payment change through a separate, known channel |
Week 2: Passwords, MFA and accounts
Goal: strong, unique sign-in for every work account. Base your guidance on current standards rather than old habits: NIST SP 800-63B recommends long passwords, checking new passwords against lists of compromised ones, and not forcing scheduled changes or complex character rules. Our guide to password policy under NIST 800-63B explains the details.
| Day | Activity (5–10 min) | Key takeaway |
|---|---|---|
| 6 | Passphrases: show how a long, memorable phrase beats a short complex password | Length matters more than symbols |
| 7 | Install or open the approved password manager; save one work password | A unique password for every account, stored safely |
| 8 | Enrol in or check MFA on email; explain authenticator apps and security keys | With MFA, a stolen password alone is not enough to get in |
| 9 | MFA fatigue: what to do with an unexpected sign-in prompt | Never approve a prompt you did not start; report it |
| 10 | Account hygiene: check recovery details, sign out of old devices, review shared accounts | Know which devices and people can access your accounts |
For more background on MFA to share with staff, see what two-factor authentication is.
Week 3: Devices, data and remote work
Goal: devices are updated and locked, and data stays in approved places.
| Day | Activity (5–10 min) | Key takeaway |
|---|---|---|
| 11 | Updates: everyone checks their laptop and phone for pending updates and installs them | Install updates when prompted; do not postpone for weeks |
| 12 | Screen lock and device encryption: set automatic lock; show the lock shortcut | Lock your screen every time you step away |
| 13 | Working from home and in public: Wi-Fi, screen privacy, conversations in public places | Assume people can see and hear you in public spaces |
| 14 | Sharing data: approved file-sharing tools vs personal email, USB sticks and personal cloud | Use approved tools; share with the fewest people needed |
| 15 | Personal data basics: what counts as personal data and why mistakes may need to be reported quickly | Sent something to the wrong person? Report it immediately |
Day 15 links to a real obligation: under the GDPR, a personal data breach must usually be notified to the supervisory authority within 72 hours of becoming aware of it, which is only possible if staff report quickly. See our guide to GDPR 72-hour breach notification.
Week 4: Incident reporting and AI tools
Goal: staff know what an incident looks like, report without hesitation, and use AI tools safely.
| Day | Activity (5–10 min) | Key takeaway |
|---|---|---|
| 16 | What counts as an incident: lost device, suspicious login, clicked link, unusual pop-up, data sent to the wrong person | If in doubt, report; the security team decides if it is serious |
| 17 | “I clicked – now what?” walk-through: disconnect if told to, do not delete evidence, report and describe what happened | Speed matters more than having all the details |
| 18 | Approved AI tools: which ones are allowed and what must never be pasted in (personal data, customer data, secrets, unreleased plans) | Only approved AI tools for work data; check before you paste |
| 19 | AI-powered scams: realistic emails, cloned voices and fake video calls asking for money or access | Verify unusual requests through a second channel, even if the voice sounds right |
| 20 | Wrap-up quiz (10 questions) and short feedback survey | Celebrate progress; tell us what to improve |
Two pieces of background help the coordinator here. The incident reporting days connect to your wider incident response process, and AI assistants bring their own risks, such as prompt injection, covered in the AI tools you trust can be turned against you. If you operate in the EU, note that the AI Act includes an AI-literacy provision (Article 4) for organisations that use AI systems, so the Day 18 and 19 material is also useful evidence there.
Wrap-up (Days 26–30)
The last working day of week 4 (Day 20 of the plan, calendar day 26) closes the activities. Use the remaining days to measure and share results.
- Close the quiz and survey; collect your end-of-plan numbers.
- Thank everyone, and recognise teams with the highest participation or most reports. Never single out individuals negatively.
- Share three results and three next steps with all staff.
- Brief management on what changed and what support is needed.
Copy-paste wrap-up message:
Subject: Thank you – here is what we achieved in 30 days
Thank you for taking part in our security awareness month. Together we [reported X suspicious emails / enrolled X% of accounts in MFA / installed the password manager on X devices]. Your feedback said [main point], so next we will [action]. Please keep using [report channel] whenever something looks wrong. A fast report is always the right call. [Name, role]
How to measure the plan
Measure before and after, and keep it simple. Pick four or five of these:
| Metric | How to collect | What good looks like |
|---|---|---|
| Suspicious email reports | Report button or mailbox count, before vs during the plan | More reports, including from staff who had never reported |
| Phishing simulation report rate | Baseline simulation before Day 1, similar difficulty after Day 30 | Report rate up; time to first report down |
| MFA enrolment | Identity provider or admin console | Higher share of accounts enrolled |
| Password manager adoption | Licence or admin console | More active users |
| Devices up to date | Device management or update reports | Fewer devices with pending updates |
| Quiz score | Day 20 quiz | Most staff answer reporting and verification questions correctly |
| Confidence to report | Anonymous survey: “I would feel comfortable reporting a security mistake” | Agreement goes up |
| Participation | Opens, attendance or quiz completions | Steady through all four weeks |
Participation tells you people saw the material. The behaviour metrics, such as reports, MFA enrolment and updates, tell you whether it worked. Report them together, and compare phishing simulation results only between emails of similar difficulty.
After the 30 days
A month builds momentum, but habits fade without reinforcement. Move into a lighter ongoing rhythm: one theme a month, a regular phishing simulation, and targeted sessions for high-risk roles such as finance, HR and IT. Our guide to building a security awareness program that works includes a 12-month calendar you can continue with.
If you are subject to NIS2, this plan supports the training and cyber hygiene measures the directive expects, but it does not replace management-body training. See NIS2 management training under Article 20. This is general guidance, not legal advice.
AceFortis runs practical security awareness training for teams and management, including live kickoff and wrap-up sessions – get in touch to plan a session.
FAQ
Can we run the plan with a small team and no training budget?
Yes. Every activity can be delivered as a short email or chat message with screenshots and a question. You need a coordinator, an hour or two of preparation per week, and a working way for staff to report suspicious messages.
Should we include a phishing simulation?
It is useful for measurement but optional. If you include one, announce that simulations are part of the program, avoid cruel lures such as fake bonuses, and never use results to punish people.
What if people miss days?
Keep each activity available in one place, such as an intranet page or shared channel, so people can catch up. Weekly summaries help too.
Can we start in the middle of the month?
Yes. Start on any Monday. Avoid launching during peak business periods or holidays, when participation drops.
