# Security Awareness and Training Programme: [Organisation name]

> Plan for a cybersecurity and privacy learning programme: policy statement, drivers,
> governance, audience segments, needs analysis, role-based curriculum, awareness campaigns,
> rules for phishing and social engineering simulations, delivery, metrics and evaluation,
> maturity, budget and records. Based on NIST SP 800-50 Rev. 1, *Building a Cybersecurity
> and Privacy Learning Program* (September 2024), with the Awareness and Training category of
> the NIST Cybersecurity Framework (CSF) 2.0. Replace every `[bracketed]` value and every row
> marked *Example*. Worked examples use Calderwick Freight, a fictional logistics company
> with about 2,400 staff in the EU, the UK and the US. Legal references are dated examples,
> not legal advice: check the current official texts and a qualified professional, and
> consult employee representatives where local law requires it.

<!--
Guidance: How to use this template
- NIST SP 800-50 Rev. 1 calls this a Cybersecurity and Privacy Learning Program (CPLP) and
  manages it through a life cycle: plan and strategy, analysis and design, development and
  implementation, assessment and improvement. Sections 3 to 15 follow that order.
- Fill section 2 (drivers) and section 5 (audiences) first: they decide who must be trained,
  on what, and how often. Then write the learning paths (section 7) and only then the
  campaign calendar (section 8).
- Aim at behaviour, not attendance. Completion rates show that people clicked through a
  course; reporting rates, secure configuration habits and fewer human-caused incidents show
  that the programme works.
- Pitfall: a punitive phishing programme. Staff who fear blame stop reporting, and reporting
  is the behaviour you need most. Section 9 sets non-punitive rules.
- Developer-focused security education is better run through `security/security-champions-program`;
  link it here rather than duplicating it.
-->

## Document control

<!-- Guidance: Name the programme manager (the CPLP manager in NIST terms) and the executive who owns the budget. HR and the data protection officer should review because the programme processes personal data about staff behaviour. -->

| Field | Value |
|---|---|
| Document ID | [SAP-PLAN-001] |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner (programme manager) | [@awareness-lead] |
| Executive owner | [@ciso] |
| Approvers / reviewers | [@ciso], [@chief-privacy-officer or DPO], [@head-of-people], [@legal-counsel], [@works-council or employee representatives, where applicable] |
| Last updated | YYYY-MM-DD |
| Classification | Internal |
| Programme year | *Example:* FY2027 (January to December) |
| Population in scope | *Example:* 2,400 employees and long-term contractors |
| Next review | YYYY-MM-DD (annually, plus after any major incident caused by human error) |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Chief information security officer | [@name] | [Approved / Changes requested] | YYYY-MM-DD |
| Data protection officer or chief privacy officer | [@name] | [Decision] | YYYY-MM-DD |
| Head of people | [@name] | [Decision] | YYYY-MM-DD |
| Legal counsel (simulation rules) | [@name] | [Decision] | YYYY-MM-DD |

## Revision history

<!-- Guidance: Record changes to mandatory training, frequency and simulation rules: staff and managers need to see what changed in their obligations. -->

| Version | Date | Author | Change summary |
|---|---|---|---|
| 0.1 | YYYY-MM-DD | [@name] | First draft after needs analysis |
| 1.0 | YYYY-MM-DD | [@name] | *Example:* Approved for FY2027 |
| 1.1 | YYYY-MM-DD | [@name] | *Example:* Added payment fraud module for finance after Q2 incident |

## Contents

<!-- Guidance: Keep the list aligned with the headings. -->

1. [Purpose, scope and policy statement](#1-purpose-scope-and-policy-statement)
2. [Drivers and requirements](#2-drivers-and-requirements)
3. [Programme life cycle and strategy](#3-programme-life-cycle-and-strategy)
4. [Governance, roles and responsibilities](#4-governance-roles-and-responsibilities)
5. [Audience segments](#5-audience-segments)
6. [Learning needs analysis](#6-learning-needs-analysis)
7. [Curriculum and learning paths](#7-curriculum-and-learning-paths)
8. [Awareness activities and campaign calendar](#8-awareness-activities-and-campaign-calendar)
9. [Phishing and social engineering simulation rules](#9-phishing-and-social-engineering-simulation-rules)
10. [Delivery, accessibility and languages](#10-delivery-accessibility-and-languages)
11. [Metrics and evaluation](#11-metrics-and-evaluation)
12. [Maturity assessment](#12-maturity-assessment)
13. [Budget and resources](#13-budget-and-resources)
14. [Records, privacy and compliance reporting](#14-records-privacy-and-compliance-reporting)
15. [Annual review and improvement](#15-annual-review-and-improvement)
16. [Glossary and references](#16-glossary-and-references)
17. [Standard and licence note](#standard-and-licence-note)

## 1. Purpose, scope and policy statement

<!-- Guidance: A short policy statement signed by leadership gives the programme authority. NIST SP 800-50 Rev. 1 (section 2.2) recommends a learning programme policy; write yours in plain language and say who must take part. -->

**Purpose** *(Example)*: give every person who works for Calderwick Freight the knowledge,
habits and confidence to protect customer, shipment and employee information, to recognise
and report threats quickly, and to perform the security and privacy duties of their role.

**Policy statement** *(Example)*: All employees and contractors with access to Calderwick
Freight systems complete onboarding security and privacy training before or within
[30] days of receiving access, and annual refresher training. People in roles listed in
section 5 complete role-based training before taking up the role and at the frequency set
in section 7. Managers give their teams time to complete learning during working hours.
Simulated phishing and other exercises are learning tools and are never used for
disciplinary action on their own.

| In scope | Out of scope |
|---|---|
| Employees, contractors and temporary staff with system access *(Example:* 2,400 people) | Customer education campaigns (owned by marketing) |
| Awareness, role-based training and education support | Secure development education (owned by `security/security-champions-program`) |
| Phishing, voice and text message simulations | Technical red team engagements (`security/red-team-engagement-plan`) |
| Privacy awareness for staff handling personal data | Incident response exercises for responders (`security/tabletop-exercise`) |

## 2. Drivers and requirements

<!-- Guidance: List the laws, contracts and standards that require training, with the article or clause, so you can show auditors where each one is met. The rows below are dated examples for the EU, the UK and the US; keep only those that apply and check the current text. Paid standards are cited by number only. -->

| ID | Source | What it expects (paraphrase) | Where met |
|---|---|---|---|
| DRV-01 | NIST SP 800-50 Rev. 1 (September 2024) | Life-cycle learning programme with role-based content, behaviour change and metrics | Whole document |
| DRV-02 | NIST CSF 2.0 (February 2024), PR.AT-01 and PR.AT-02 | All personnel receive awareness and training for general tasks; people in specialised roles receive training for role-specific tasks | Sections 7 and 11 |
| DRV-03 | ISO/IEC 27001:2022, Annex A control 6.3 (awareness, education and training) | Staff and relevant interested parties receive appropriate awareness, education and training. Official text: ISO, purchase or licensed access: https://www.iso.org/standard/82875.html | Sections 5 to 8 |
| DRV-04 | EU: Directive (EU) 2022/2555 (NIS2), Article 20(2) and Article 21(2)(g) | Management body members must follow training, and staff should be offered similar training regularly; cybersecurity risk measures include basic cyber hygiene and cybersecurity training | Sections 5 (EXE segment) and 7 |
| DRV-05 | EU financial sector: Regulation (EU) 2022/2554 (DORA), Article 13(6) and Article 5(2)(g) | ICT security awareness programmes and digital operational resilience training for all staff and senior management; budget allocated by the management body | Sections 7 and 13 |
| DRV-06 | EU and UK: GDPR and UK GDPR, Article 39(1)(b) | The data protection officer monitors compliance, including awareness-raising and training of staff involved in processing | Sections 7 and 14 |
| DRV-07 | US healthcare: HIPAA Security Rule, 45 CFR 164.308(a)(5) | Security awareness and training programme for the workforce, with addressable specifications on security reminders, malicious software, log-in monitoring and password management. A proposed rule to update the Security Rule was published on 6 January 2025 (90 FR 898); check whether a final rule has changed these specifications | Sections 7 and 8 (if applicable) |
| DRV-08 | Payment card industry: PCI DSS v4.0.1, Requirement 12.6 | Formal security awareness programme, including awareness of phishing and social engineering. Official text: PCI Security Standards Council, free licensed download: https://www.pcisecuritystandards.org/document_library/ | Sections 7 and 9 (if applicable) |
| DRV-09 | Customer contracts and cyber insurance | *Example:* Annual training evidence requested by two key customers and the cyber insurer | Section 14 |

## 3. Programme life cycle and strategy

<!-- Guidance: NIST SP 800-50 Rev. 1 presents four life-cycle phases (Figure 1) and uses the ADDIE instructional design model (analysis, design, development, implementation, evaluation) inside them. Its strategy model (Table 1) runs from strategic plan to goals, objectives and tactics; every tactic should trace to a goal. -->

```mermaid
flowchart LR
  A["Plan and strategy"] --> B["Analysis and design"]
  B --> C["Development and implementation"]
  C --> D["Assessment and improvement"]
  D --> A
```

The phases can overlap: a new phishing module may be in development while last quarter's
results are being assessed. The programme manager reviews the whole cycle once a year
(section 15).

| Goal ID | Strategic goal | Objective (SMART) | Tactics | Measure |
|---|---|---|---|---|
| GOAL-01 *(Example)* | Reduce susceptibility to social engineering | Raise the phishing report rate from 25.1 % to 40 % by Q4 FY2027 | Quarterly simulations, report button, short just-in-time lessons | MET-04 |
| GOAL-02 *(Example)* | Every person knows their baseline duties | 95 % completion of annual training within 30 days of assignment | Onboarding module, annual refresher, manager reminders | MET-01 |
| GOAL-03 *(Example)* | Specialised roles have the skills their risk needs | 95 % of privileged access holders complete role-based training before access is granted | Access request blocked until training recorded | MET-02 |
| GOAL-04 *(Example)* | Fewer incidents caused by human error | Human-error incidents down 20 % year on year | Targeted modules for teams with repeated incidents | MET-07 |

## 4. Governance, roles and responsibilities

<!-- Guidance: NIST SP 800-50 Rev. 1 (section 1.6) describes roles from the head of organisation to the system user. Make the manager role concrete: managers protect learning time and model reporting behaviour. -->

| Role | Responsibility |
|---|---|
| Head of organisation and executive team | Endorse the policy statement; complete executive training; talk about security in their own communications |
| CISO (executive owner) | Approves the plan and budget; reports programme results to the board in the security metrics report (`security/security-metrics-report`) |
| Programme manager | Runs the life cycle: analysis, content, calendar, simulations, metrics, vendor management |
| Data protection officer or privacy lead | Owns privacy content; reviews processing of learner data; monitors staff training under Article 39(1)(b) where applicable |
| People team | Integrates training into onboarding, role changes and learning platform; manages records |
| Line managers | Give time for learning; follow up on overdue training; support (not sanction) staff who need extra help |
| Security operations | Handles reported emails; feeds real threat examples into content; confirms simulation traffic is allowlisted |
| Legal counsel and employee representatives | Review simulation rules, monitoring and data use before launch |
| Everyone | Complete assigned learning; report suspicious messages and incidents; follow the acceptable use policy (`compliance/acceptable-use-policy`) |

## 5. Audience segments

<!-- Guidance: NIST SP 800-50 Rev. 1 (section 2.5) separates all users, privileged access account holders, and staff with significant cybersecurity or privacy responsibilities. Add segments your risk analysis shows, such as finance staff targeted by payment fraud. Count each segment so you can compute rates. -->

| Segment ID | Segment | Who | Headcount *(Example)* | Share of staff |
|---|---|---|---|---|
| AUD-ALL | All users | Every employee and contractor with system access | 2,400 | 100.0 % |
| AUD-PRV | Privileged access account holders | System, network, database and cloud administrators; anyone with elevated rights | 180 | 7.5 % |
| AUD-SIG | Significant security or privacy responsibilities | Security team, incident responders, privacy team, system owners, developers of critical systems | 95 | 4.0 % |
| AUD-MGR | People managers | Anyone with direct reports | 260 | 10.8 % |
| AUD-EXE | Executives and board | Executive committee and board members (management body under NIS2 and DORA) | 22 | 0.9 % |
| AUD-FIN | High-risk business roles | *Example:* Finance, payroll, procurement and customer billing staff exposed to payment fraud | [n] | [%] |

Segments overlap: an administrator is in AUD-ALL and AUD-PRV. Shares are of total staff and
do not add up to 100 %. Identify AUD-PRV from the identity platform, not from job titles, so
that people who gain privileged access between cycles are included
(`security/privileged-access-standard`).

## 6. Learning needs analysis

<!-- Guidance: The analysis phase finds the gap between what people know and do and what the risk requires. Use incident data, simulation results, audit findings, surveys and interviews. NIST SP 800-50 Rev. 1 section 3.1 describes the steps. -->

| Input | Source | Finding *(Example)* | Implication |
|---|---|---|---|
| Incidents caused by human action, last 12 months | Incident records (`security/security-incident-report`) | 14 incidents: 6 misdirected emails with shipment data, 5 credential phishing, 3 lost devices | Add data handling module; push password manager and phishing-resistant sign-in |
| Phishing simulation baseline | Q1 campaign | Click rate 9.4 %, report rate 25.1 % | Focus on reporting, not only on not clicking |
| Audit findings | Internal audit, ISO/IEC 27001 surveillance | Training records for contractors incomplete | Contractors added to learning platform |
| Role risk review | Identity platform, finance controls | Two attempted invoice fraud cases against accounts payable | New AUD-FIN segment with payment verification module |
| Staff survey | Annual survey, 1,104 responses | 38 % unsure how to report a lost device | Clear one-step reporting channel and campaign |
| Regulatory change | Legal register (`compliance/legal-register`) | NIS2 national law requires management training | Executive training module for AUD-EXE |

## 7. Curriculum and learning paths

<!-- Guidance: One row per module. Say who takes it, when, how long, how mastery is checked and which driver it meets. Keep modules short; several 10-minute lessons beat one long annual course. -->

| Module ID | Module | Audience | When | Duration | Assessment | Drivers |
|---|---|---|---|---|---|---|
| MOD-01 *(Example)* | Security and privacy essentials: passwords and passkeys, phishing, reporting, data handling, device security, acceptable use | AUD-ALL | Onboarding (within 30 days), then annually | 45 min | Quiz, pass mark 80 % | DRV-02 to DRV-08 |
| MOD-02 *(Example)* | Reporting quickly: what to report, how, and why it is never wrong to report | AUD-ALL | Onboarding; refresh each half year | 10 min | Scenario questions | DRV-01, DRV-04 |
| MOD-03 *(Example)* | Privacy in daily work: personal data, minimisation, misdirected messages, data subject requests | AUD-ALL; deeper version for customer service | Annually | 20 min | Quiz | DRV-06 |
| MOD-04 *(Example)* | Privileged access: separate admin accounts, just-in-time elevation, session recording, change control | AUD-PRV | Before access is granted, then annually | 60 min | Practical lab | DRV-02, DRV-03 |
| MOD-05 *(Example)* | Payment fraud and business email compromise: verification call-backs, change of bank details | AUD-FIN | Before role start, then each half year | 30 min | Scenario simulation | DRV-01, DRV-04 |
| MOD-06 *(Example)* | Manager toolkit: supporting the team, handling a reported incident, role changes and leavers | AUD-MGR | On becoming a manager, then every two years | 30 min | Self-check | DRV-01 |
| MOD-07 *(Example)* | Cyber risk for leaders: threat landscape, risk appetite, incident decisions, legal duties | AUD-EXE | On appointment, then annually | 2 h workshop | Tabletop participation | DRV-04, DRV-05 |
| MOD-08 *(Example)* | Specialist development: certifications, conferences, cyber range exercises, mapped to NICE Framework work roles | AUD-SIG | Individual development plan | Varies | Certification or exercise result | DRV-01, DRV-02 |

Map specialist roles to a skills framework such as the NICE Workforce Framework for
Cybersecurity (NIST SP 800-181 Rev. 1 and its current components) so that training links
to defined tasks, knowledge and skills. Record individual plans in
`career/individual-development-plan`.

## 8. Awareness activities and campaign calendar

<!-- Guidance: Awareness keeps attention on a few behaviours between formal training. NIST SP 800-50 Rev. 1 (section 2.7) lists awareness activities and experiential learning (simulations, games, tabletop exercises). Tie each month to a measurable behaviour. -->

| Month *(Example)* | Theme | Activities | Target behaviour | Channel |
|---|---|---|---|---|
| January | Strong sign-in | Passkey and password manager drive, help desk drop-in sessions | Password manager adoption | Intranet, team meetings |
| February | Phishing reporting | Q1 simulation; "report button" short video | Report rate | Email, video |
| March | Data handling | Misdirected email campaign, email client delay-send setting | Fewer misdirected messages | Posters at depots, newsletter |
| April | Payment fraud | Finance workshop; supplier bank detail change walk-through | Call-back verification used | Workshop |
| May | Q2 simulation; voice phishing | Simulated call to help desk (with section 9 approval) | Help desk identity checks | Phone |
| June | Travel and mobile devices | Pre-summer travel tips; lost device reporting | Lost devices reported within 1 h | Mobile push, depot briefings |
| July to September | Q3 simulation; privacy | Privacy quiz game; data subject request scenarios | Correct routing of requests | Learning platform |
| October | Cybersecurity awareness month | Leadership messages, capture-the-flag event for technical staff, family online safety session | Engagement and reporting | All channels |
| November | Q4 simulation | Seasonal shipping scam examples drawn from real reported emails | Report rate | Email |
| December | Year in review | Results shared with all staff; recognition of top reporting teams | Programme trust | Intranet |

## 9. Phishing and social engineering simulation rules

<!-- Guidance: NIST SP 800-50 Rev. 1 (section 2.7.2) advises involving legal counsel, avoiding real brands or government bodies in lures, telling staff that exercises happen, and keeping them non-punitive. Use the NIST Phish Scale (NIST TN 2276) to rate difficulty so results across campaigns are comparable. -->

### 9.1 Rules

| Rule ID | Rule |
|---|---|
| SIM-01 | Staff are told in onboarding and annually that simulations happen at random times; dates are not announced |
| SIM-02 | Simulations are learning tools. Results never trigger disciplinary action on their own and individuals are never named publicly |
| SIM-03 | Lures do not impersonate real external brands, government bodies, regulators or charities without written legal approval; prefer fictional or internal-style senders |
| SIM-04 | Lures never use distressing themes: health emergencies, bereavement, layoffs, pay cuts, bonuses that do not exist, disciplinary threats, or personal family matters |
| SIM-05 | Each campaign is rated with the NIST Phish Scale (cue count and premise alignment) and the rating is reported with results |
| SIM-06 | Someone who clicks sees a short, kind landing page explaining the cues they missed, and a 3-minute lesson; no further action |
| SIM-07 | People who click in three consecutive campaigns are offered one-to-one support by the programme team, with their manager informed only to free up time |
| SIM-08 | The report button works for real and simulated emails. Reporting a simulation counts as a success and gets instant positive feedback |
| SIM-09 | Voice and text message simulations need an approved script, cover only work numbers and stop if the person shows distress |
| SIM-10 | Simulation data is personal data: lawful basis, retention (section 14) and access limited to the programme team; reporting to management is aggregated by team of at least [10] people |
| SIM-11 | Security operations and email administrators allowlist simulation infrastructure in a controlled way and know the campaign window, so real incident handling is not disrupted |
| SIM-12 | Employee representatives are consulted before the first campaign and when rules change, where local law or agreements require it |

### 9.2 Campaign plan

| Campaign ID | Quarter | Audience | Premise *(Example)* | Phish Scale difficulty | Approved by |
|---|---|---|---|---|---|
| PHS-2027-Q1 | Q1 | AUD-ALL | Shared document notification from an internal-style sender | Moderately difficult | [@legal], [@awareness-lead] |
| PHS-2027-Q2 | Q2 | AUD-ALL; AUD-FIN extra lure | Delivery exception notice from a fictional carrier | Moderately difficult | [Approvers] |
| PHS-2027-Q3 | Q3 | AUD-ALL | Benefits enrolment reminder (no pay or bonus claims) | Very difficult | [Approvers] |
| PHS-2027-Q4 | Q4 | AUD-ALL | Calendar invitation to a fictional industry webinar | Moderately difficult | [Approvers] |

## 10. Delivery, accessibility and languages

<!-- Guidance: Logistics staff in depots, drivers and shift workers do not sit at desks. Design for the real working day: mobile, short, offline briefings and translated content. -->

| Topic | Approach *(Example)* |
|---|---|
| Delivery methods | Self-paced modules on the learning platform; 10-minute depot briefings led by supervisors; live workshops for AUD-FIN and AUD-EXE; cyber range labs for AUD-SIG |
| Devices | Mobile-friendly modules for drivers; kiosks in depots |
| Time | Learning counted as working time; shift workers scheduled during handover |
| Languages | English, German, French, Polish and Spanish; interface and content reviewed by native speakers |
| Accessibility | Modules meet WCAG 2.2 level AA; captions and transcripts; screen reader tested; no time-limited quizzes |
| Third-party content | Vendor modules reviewed for accuracy, local law and tone before release (NIST SP 800-50 Rev. 1 section 4.1.5) |
| Learner testing | New modules piloted with 20 learners from different segments before launch (section 4.1.6) |

## 11. Metrics and evaluation

<!-- Guidance: NIST SP 800-50 Rev. 1 (sections 2.4 and 5.2) separates raw measurements from metrics that support decisions, and uses the four Kirkpatrick levels: reaction, learning, behaviour, results. Track at least one measure per level. Define each measure the same way as in the security metrics report so numbers match. -->

### 11.1 Measures

| Metric ID | Measure | Kirkpatrick level | Formula | Target *(Example)* | Frequency | Source |
|---|---|---|---|---|---|---|
| MET-01 | Annual training completion | Learning (participation) | Completed within 30 days of assignment / assigned | ≥ 95 % | Monthly | Learning platform |
| MET-02 | Role-based training before access | Learning | AUD-PRV holders trained before grant / AUD-PRV holders | ≥ 95 % | Quarterly | Learning platform, identity platform |
| MET-03 | Click rate in simulations | Behaviour | Unique users who clicked / users who received | Falling trend, ≤ 5 % at moderate difficulty | Per campaign | Simulation platform |
| MET-04 | Report rate in simulations | Behaviour | Unique users who reported / users who received | ≥ 40 % by Q4 | Per campaign | Simulation platform |
| MET-05 | Real phishing reports | Behaviour | Reported real malicious emails per month | Rising trend | Monthly | Security operations |
| MET-06 | Knowledge gain | Learning | Average post-test score minus pre-test score; retest after 3 months | +15 points, retained at 3 months | Per module | Quiz results |
| MET-07 | Human-error incidents | Results | Incidents with human action as primary cause, per 1,000 staff | 20 % lower year on year | Quarterly | Incident records |
| MET-08 | Learner satisfaction | Reaction | Average rating of usefulness, 1 to 5 | ≥ 4.0 | Per module | Survey |

### 11.2 Simulation results *(Example)*

| Campaign | Recipients | Clicked | Click rate | Reported | Report rate | Reports per click |
|---|---|---|---|---|---|---|
| PHS-2027-Q1 | 2,400 | 226 | 9.4 % | 602 | 25.1 % | 2.7 |
| PHS-2027-Q2 | 2,410 | 190 | 7.9 % | 724 | 30.0 % | 3.8 |
| PHS-2027-Q3 | 2,395 | 151 | 6.3 % | 838 | 35.0 % | 5.5 |
| PHS-2027-Q4 | 2,402 | 132 | 5.5 % | 961 | 40.0 % | 7.3 |

Read results with the Phish Scale rating: Q3 used a harder lure and still showed a lower
click rate, which supports a real improvement rather than an easier test. A rising ratio of
reports to clicks is the most useful single signal: more people catch and report the lure
than fall for it. Repeat clickers (three consecutive campaigns) in FY2027 *(Example)*: 37
people, 1.5 % of staff, all offered support under SIM-07.

```mermaid
xychart-beta
  title "Simulation click and report rates, FY2027 (Example)"
  x-axis ["Q1", "Q2", "Q3", "Q4"]
  y-axis "Percent of recipients" 0 --> 45
  bar [25.1, 30.0, 35.0, 40.0]
  line [9.4, 7.9, 6.3, 5.5]
```

Bars show the report rate; the line shows the click rate.

### 11.3 Other results *(Example)*

| Metric | Result | Calculation |
|---|---|---|
| MET-01 | 97.0 % | 2,328 of 2,400 completed within 30 days |
| MET-02 | 95.0 % | 171 of 180 privileged holders trained before access |
| AUD-SIG development plans in place | 92.6 % | 88 of 95 |
| MET-06 | +23 points after module, +17 at 3 months | Average pre-test 61, post-test 84, retest 78 |

## 12. Maturity assessment

<!-- Guidance: NIST SP 800-50 Rev. 1 Appendix A gives examples of maturity levels for learning programmes: Ad Hoc, Defined, Consistently Implemented, Managed and Measurable, Optimized. Rate each question with evidence; do not rate higher than the evidence supports. -->

| Area | Current level *(Example)* | Evidence | Target next year | Action |
|---|---|---|---|---|
| Roles, responsibilities and resources defined and resourced | Consistently Implemented | Approved plan, programme manager in post, budget line | Managed and Measurable | Add metrics on manager follow-up |
| Workforce skills assessment and tailored content | Defined | Needs analysis in section 6 | Consistently Implemented | Annual skills survey for AUD-SIG |
| Role-based training for privileged and specialist roles | Consistently Implemented | MET-02 at 95.0 % | Managed and Measurable | Automate access gating |
| Measurement of learning effectiveness | Defined | MET-01 to MET-08 defined; MET-07 baseline new | Managed and Measurable | Two quarters of trend data |
| Continuous improvement from results | Ad Hoc | No formal review yet | Defined | Section 15 review in December |

## 13. Budget and resources

<!-- Guidance: NIST SP 800-50 Rev. 1 (section 2.10) covers budget and staffing. Show cost per participant so leaders can compare with incident costs. Under DORA Article 5(2)(g) the management body allocates the budget for awareness and training. -->

| Item | Annual cost *(Example)* | Notes |
|---|---|---|
| Learning platform and content licences | 64,000 | Covers 2,400 learners, 5 languages |
| Simulation platform | 28,000 | Email, voice and text simulations |
| Specialist training and certifications (AUD-SIG) | 70,000 | About 740 per person for 95 people |
| Workshops and events | 18,000 | Executive and finance workshops, awareness month |
| Translation and accessibility review | 12,000 | New and updated modules |
| **Total** | **192,000** | 80 per person in scope (192,000 / 2,400) |

Staff: programme manager (1.0 full-time equivalent), content designer (0.5), plus time from
security operations for reported-email handling. Currency: [currency].

## 14. Records, privacy and compliance reporting

<!-- Guidance: Training records are evidence for auditors, customers and regulators, and they are personal data. Decide what is kept, for how long, who sees it and how it is reported. NIST SP 800-50 Rev. 1 section 5.2.2 covers compliance reporting. -->

| Record | Content | Retention *(Example)* | Access |
|---|---|---|---|
| Training completion | Person, module, date, score | Employment plus [3] years | Programme team, HR, auditors on request |
| Simulation interaction | Recipient, campaign, clicked, reported, time | [12] months at individual level, then aggregated | Programme team only |
| Role-based training evidence | Certificates, lab results | Employment plus [3] years | Programme team, line manager |
| Survey responses | Anonymous ratings and comments | [24] months | Programme team |

Record the lawful basis and purpose of each record in the record of processing activities
(`compliance/gdpr-ropa`) and, where a privacy impact assessment is required, in
`compliance/dpia`. Reports to the executive team and board use aggregated results; the
quarterly security metrics report (`security/security-metrics-report`) carries MET-01,
MET-04 and MET-07.

## 15. Annual review and improvement

<!-- Guidance: Close the life cycle. NIST SP 800-50 Rev. 1 (section 5.2.4) recommends reviewing the assessment report with senior leadership. Bring three decisions to that meeting, not a list of activities. -->

Each December the programme manager prepares an assessment report covering goal results
(section 3), metrics trends (section 11), maturity (section 12), incidents linked to human
action, feedback from staff and managers, and changes in law or threat. The CISO reviews it
with the executive team and records decisions:

| Decision ID | Topic | Decision *(Example)* | Owner | Due |
|---|---|---|---|---|
| DEC-01 | Reporting | Extend report button to mobile mail clients used by drivers | [@it-workplace] | YYYY-MM-DD |
| DEC-02 | Payment fraud | Make MOD-05 mandatory for all procurement staff | [@head-of-finance] | YYYY-MM-DD |
| DEC-03 | Measurement | Add time-to-report (median minutes from delivery to first report) as a metric | [@awareness-lead] | YYYY-MM-DD |

## 16. Glossary and references

<!-- Guidance: Keep definitions short and plain; this glossary may be shared with all staff. -->

### 16.1 Glossary

| Term | Meaning |
|---|---|
| CPLP | Cybersecurity and Privacy Learning Program, the NIST SP 800-50 Rev. 1 term for this programme |
| Awareness | Activities that focus attention on security and privacy so people recognise issues and respond |
| Role-based training | Training for the knowledge and skills a specific role needs |
| Education | Deeper learning that builds specialist capability, often towards a qualification |
| Click rate | Share of simulation recipients who clicked a link or opened an attachment |
| Report rate | Share of simulation recipients who reported the message |
| NIST Phish Scale | NIST method for rating how hard a phishing email is to detect, based on cues and premise alignment |
| Kirkpatrick levels | Four levels of training evaluation: reaction, learning, behaviour, results |

### 16.2 References

| Reference | Use |
|---|---|
| NIST SP 800-50 Rev. 1, *Building a Cybersecurity and Privacy Learning Program*, September 2024 (doi.org/10.6028/NIST.SP.800-50r1); supersedes SP 800-50 (2003) and SP 800-16 (1998) | Life cycle, audiences, activities, metrics, maturity |
| NIST Technical Note 2276, NIST Phish Scale (doi.org/10.6028/NIST.TN.2276) | Simulation difficulty rating |
| NIST CSF 2.0, CSWP 29, February 2024 (doi.org/10.6028/NIST.CSWP.29) | PR.AT outcomes |
| NIST SP 800-181 Rev. 1, NICE Workforce Framework for Cybersecurity | Work roles for AUD-SIG |
| ISO/IEC 27001:2022, Annex A control 6.3. Official text: ISO, purchase or licensed access: https://www.iso.org/standard/82875.html | Certification evidence |
| Directive (EU) 2022/2555 (NIS2), Regulation (EU) 2022/2554 (DORA), Regulation (EU) 2016/679 (GDPR) (eur-lex.europa.eu) | EU drivers |
| 45 CFR 164.308(a)(5) (ecfr.gov) | US healthcare driver |
| Security Champions Programme (`security/security-champions-program`) | Developer security education |
| Information Security Policy (`compliance/information-security-policy`) and Acceptable Use Policy (`compliance/acceptable-use-policy`) | Rules the training teaches |
| Security Metrics Report (`security/security-metrics-report`) | Board reporting of programme results |

## Standard and licence note

Based on NIST SP 800-50 Rev. 1 (September 2024) and the NIST Cybersecurity Framework 2.0
(February 2024), which are works of the US Government and not subject to copyright in the
United States. Section numbers, the life-cycle phase names, audience categories, the
Kirkpatrick level names and the maturity level names are cited from NIST SP 800-50 Rev. 1;
all other text is original. ISO/IEC 27001:2022 and PCI DSS v4.0.1 are cited by name and
clause or requirement number only (official text: ISO and the PCI Security Standards
Council). Laws are summarised in original words with article numbers as dated examples for
the EU, the UK and the US; check the current official text and a qualified professional,
since employment, monitoring and privacy rules for simulations differ by country. Check
csrc.nist.gov for newer revisions. Template licence: MIT.