Security Awareness Training Checklist
A security awareness training checklist for an annual programme: choose topics, train every employee, run phishing simulations and keep records for auditors.
- Typical schedule annually
- The checklist 4 sections, 18 items
- Variables
{{year}}
Use this checklist to plan and run your yearly security awareness programme. Most security incidents in small companies start with a person: a phishing email, a reused password, a fake invoice. Customers, insurers and auditors for SOC 2 or ISO 27001 often ask for proof that staff are trained, so the records matter as well.
Who owns it
A security, IT or people-operations lead owns the programme. Managers make sure their teams complete it. HR adds the training to onboarding so new hires do not wait for the next annual cycle. Adapt this to your jurisdiction, especially for phishing simulations and monitoring of staff; it is a practical checklist, not legal advice.
Common pitfalls
- One long video a year. People forget quickly. Short sessions spread over the year, with real examples from your own inbox, work better.
- Generic content. Train on the attacks your company actually sees, such as fake supplier invoices or CEO payment requests for finance staff.
- Shaming people who fail simulations. It discourages reporting. Treat a click as a chance to teach, and praise fast reporting.
- No record of completion. Without a list of who completed what and when, you cannot show the training happened.
- Forgetting contractors. Anyone with a company account should be included.
The checklist: Security awareness programme {{year}}
Plan
-
Review last year's incidents, phishing reports and simulation results to pick focus topics for
{{year}} -
Confirm the core topics: phishing, passwords and MFA, device security, data handling and incident reporting
-
Add role-specific topics, such as payment fraud for finance and secure coding for developers
-
Choose the format and platform for training and tracking completion
-
Confirm with HR or legal that phishing simulations fit local rules and works council requirements optional
Deliver
-
Publish the training schedule and the deadline for completion
-
Assign the training to all employees and contractors with company accounts
-
Add the training to the onboarding checklist for new hires
-
Run the main training session or course
-
Share short reminders during the year, such as examples of real phishing emails received optional
-
Make sure everyone knows how to report a suspicious email or incident
Test
-
Run at least one phishing simulation and record click and report rates
-
Give follow-up training to people who clicked, without public naming
-
Run a short quiz or check of understanding at the end of the course optional
Record and improve
-
Export the completion list and chase people who have not finished
-
Record policy acknowledgements alongside training completion
-
File completion records for
{{year}}as audit evidence -
Collect feedback and update the topics for next year
Checklist as Markdown
Frequently asked questions
What topics should security awareness training cover?
Cover phishing and social engineering, password managers and multi-factor authentication, device and remote work security, handling customer and personal data, and how to report incidents. Add topics for specific roles, such as invoice fraud for finance staff or secure coding for developers.
How often should employees receive security awareness training?
Many organisations require training at onboarding and at least once a year after that, with short reminders in between. Your policy and customer contracts may set the interval. Regular short sessions tend to stick better than a single long one.
Are phishing simulations allowed?
In many places they are, but rules on employee monitoring and works council involvement differ. Inform staff that simulations happen, avoid collecting more personal data than needed, and check local rules before you start. Use results to target training, not to punish people.
Updated