> Acme Inc — Employee Security Training & Awareness Program

>

> Effective Date: 2026-03-19

>

> Generated by Codepliant Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

## 1. Program Overview

Acme Inc is committed to maintaining a strong security posture through continuous employee education. This Security Awareness Program establishes a structured approach to training all personnel on security best practices, threat recognition, and incident response procedures.

Program Objectives:

- Reduce human-factor security incidents by 80%+
- Achieve 100% staff completion of annual security training
- Maintain phishing simulation click rates below 5%
- Ensure all staff can identify and report security incidents
- Meet compliance requirements (SOC 2, ISO 27001, GDPR Art. 39)

## 2. Scope & Audience

Audience | Training Level | Frequency
--- | --- | ---
All employees | Core security awareness | Annual + onboarding
Engineering/DevOps | Secure development practices | Quarterly
Customer support | Social engineering defence | Quarterly
Executive team | Strategic risk awareness | Semi-annually
IT/Security team | Advanced threat response | Monthly
Contractors/vendors | Vendor security requirements | Upon engagement
AI/ML engineers | AI security & data ethics | Quarterly
Finance/billing | PCI DSS & payment security | Annually

## 3. Core Training Modules

### 3.1 Phishing Awareness

Duration: 45 minutes | Frequency: Quarterly refresher

#### Learning Objectives

- Identify common phishing email indicators (sender spoofing, urgency tactics, suspicious links)
- Recognise spear-phishing and business email compromise (BEC) attacks
- Identify vishing (voice phishing) and smishing (SMS phishing) attempts
- Know the correct procedure for reporting suspected phishing
- Understand the consequences of successful phishing attacks

#### Key Topics

1. Email indicators — hover-over URL inspection, sender verification, header analysis
2. Common pretexts — IT support, CEO fraud, invoice scams, password resets
3. Safe behaviour — never click suspicious links, forward to security team, verify via separate channel
4. Real examples — anonymised examples from industry incidents

#### Phishing Simulation Program

Metric | Target | Current
--- | --- | ---
Click rate | < 5% | [TBD]
Report rate | > 60% | [TBD]
Simulation frequency | Monthly |
Repeat offender training | Within 48h of click |

### 3.2 Password Hygiene & Authentication

Duration: 30 minutes | Frequency: Annually + onboarding

#### Learning Objectives

- Create strong, unique passwords (16+ characters, passphrase method)
- Use a company-approved password manager for all credentials
- Enable multi-factor authentication (MFA) on all accounts
- Never reuse passwords across services
- Recognise and avoid credential stuffing risks

#### Password Policy Summary

Requirement | Standard
--- | ---
Minimum length | 16 characters
Complexity | Mix of character types OR passphrase
Rotation | Not required if MFA enabled (NIST 800-63B)
MFA | Required for all corporate accounts
Password manager | Required — company-provided
Shared credentials | Prohibited — use SSO/service accounts

### 3.3 Incident Reporting

Duration: 30 minutes | Frequency: Annually + onboarding

#### Learning Objectives

- Define what constitutes a security incident
- Know the internal reporting channels and timelines
- Understand that timely reporting is a duty, not optional
- Preserve evidence (do not delete emails, logs, screenshots)
- Know the escalation path for different incident types

#### Reporting Procedure

    1. STOP — Do not attempt to fix the issue yourself
    2. REPORT — Immediately contact:
       - Email: legal@acme.com
       - Slack: #security-incidents (if available)
       - Phone: [Security team phone number]
    3. PRESERVE — Keep all evidence (emails, screenshots, URLs)
    4. DOCUMENT — Note the time, what you observed, and what you did
    5. WAIT — Do not discuss the incident outside the response team

### 3.4 Social Engineering Defence

Duration: 30 minutes | Frequency: Semi-annually

- Recognise pretexting, baiting, and tailgating techniques
- Verify identity before sharing sensitive information
- Challenge unknown visitors and report suspicious physical access
- Never share credentials, even with "IT support"
- Use callback verification for financial/sensitive requests

### 3.5 Device & Endpoint Security

Duration: 20 minutes | Frequency: Annually

- Lock screens when leaving devices unattended
- Enable full-disk encryption on all devices
- Keep operating systems and applications up to date
- Use only approved software and cloud services
- Avoid public Wi-Fi without VPN for work activities
- Report lost or stolen devices immediately

### 3.6 Data Handling & Classification

Duration: 30 minutes | Frequency: Annually

- Understand data classification levels (Public, Internal, Confidential, Restricted)
- Handle personal data per GDPR/privacy requirements
- Use approved channels for sharing sensitive data
- Never store sensitive data in unapproved locations (personal email, USB drives)
- Apply clean desk policy for physical documents

### 3.7 AI Security & Data Ethics

Duration: 30 minutes | Frequency: Quarterly

- Do not paste confidential data into external AI tools
- Understand data retention policies of AI providers
- Review AI outputs for sensitive data leakage before sharing
- Follow the Acceptable AI Use Policy for approved AI tools
- Report AI-generated content that may contain PII or biased outputs

### 3.8 Payment Card Security (PCI DSS)

Duration: 30 minutes | Frequency: Annually

- Never store full card numbers, CVVs, or PINs
- Use only PCI-compliant payment processors
- Report any exposure of cardholder data immediately
- Follow secure payment handling procedures

## 4. Monthly Activities

### 2026 Monthly Calendar

Month | Activity | Owner | Status
--- | --- | --- | ---
January | Annual security training kickoff | Security Team |
February | Phishing simulation #1 | Security Team |
March | Password hygiene reminder + MFA audit | IT |
April | Social engineering awareness week | Security Team |
May | Phishing simulation #2 | Security Team |
June | Incident response tabletop exercise | Security + Engineering |
July | Security newsletter: mid-year threats | Security Team |
August | Phishing simulation #3 | Security Team |
September | Clean desk / device security audit | IT |
October | Cybersecurity Awareness Month events | All Teams |
November | Phishing simulation #4 | Security Team |
December | Year-end review + policy update | Security + Legal |

## 5. Quarterly Activities

Quarter | Activities
--- | ---
Q1 | Annual training deployment, baseline phishing test, policy review
Q2 | Incident response drill, vendor security review, new hire training audit
Q3 | Advanced threat briefing, access review, compliance check
Q4 | Year-end assessment, program effectiveness review, next-year planning

## 6. Metrics & KPIs

Metric | Target | Measurement Method
--- | --- | ---
Training completion rate | 100% within 30 days | LMS tracking
Phishing click rate | < 5% | Simulation platform
Phishing report rate | > 60% | Simulation platform
Mean time to report incidents | < 1 hour | Incident tracker
Security incidents from human error | Decreasing trend | Incident log
Password manager adoption | 100% | IT audit
MFA enrollment | 100% | Identity provider

## 7. Training Completion Tracking

### 2026 Completion Status

Department | Enrolled | Completed | Rate | Deadline
--- | --- | --- | --- | ---
Engineering |  |  |  | 2026-02-28
Product |  |  |  | 2026-02-28
Customer Support |  |  |  | 2026-02-28
Sales/Marketing |  |  |  | 2026-02-28
Legal/Compliance |  |  |  | 2026-02-28
Executive Team |  |  |  | 2026-02-28
Overall |  |  |  | 2026-02-28

## 8. Non-Compliance

Offence | Action
--- | ---
Training not completed by deadline | Manager notified; access restricted until complete
Failed phishing simulation (first time) | Mandatory additional training within 48 hours
Failed phishing simulation (repeat) | One-on-one coaching with security team
Failed phishing simulation (3+ times) | Escalation to management; potential access restriction
Failure to report a security incident | Written warning; potential disciplinary action

## 9. Program Governance

Role | Responsibility | Contact
--- | --- | ---
Program Owner | Overall program management | legal@acme.com
DPO | Data protection training oversight | Jane Mueller (dpo@acme-saas.com)
Department Managers | Ensure team completion | [Department leads]
IT/Security Team | Simulation execution, tool management | [Security team]
HR | Onboarding integration, compliance tracking | [HR team]

## 10. Tools & Resources

Tool | Purpose | Status
--- | --- | ---
LMS Platform | Training delivery and tracking | [To configure]
Phishing Simulator | Monthly simulated phishing campaigns | [To configure]
Password Manager | Company-wide credential management | [To deploy]
Security Newsletter | Monthly threat intelligence digest | [To set up]

### Related Documents

- Incident Response Plan (`INCIDENTRESPONSEPLAN.md`)
- Access Control Policy (`ACCESSCONTROLPOLICY.md`)
- Information Security Policy (`INFORMATIONSECURITYPOLICY.md`)
- Training Record (`TRAINING_RECORD.md`)
- Acceptable AI Use Policy (`ACCEPTABLEAIUSE_POLICY.md`)

This Security Awareness Program was auto-generated by Codepliant based on code analysis. Customise the training topics, schedule, and metrics to match your organisation's specific needs. Review with your security team and legal counsel before implementation.