# Security Awareness Program

> **Acme Inc** — Employee Security Training & Awareness Program
>
> **Effective Date:** 2026-03-19
>
> Generated by [Codepliant](https://github.com/joechensmartz/codepliant)
> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19

---

## 1. Program Overview

Acme Inc is committed to maintaining a strong security posture through continuous employee education. This Security Awareness Program establishes a structured approach to training all personnel on security best practices, threat recognition, and incident response procedures.

**Program Objectives:**

- Reduce human-factor security incidents by 80%+
- Achieve 100% staff completion of annual security training
- Maintain phishing simulation click rates below 5%
- Ensure all staff can identify and report security incidents
- Meet compliance requirements (SOC 2, ISO 27001, GDPR Art. 39)

## 2. Scope & Audience

| Audience | Training Level | Frequency |
|----------|---------------|-----------|
| All employees | Core security awareness | Annual + onboarding |
| Engineering/DevOps | Secure development practices | Quarterly |
| Customer support | Social engineering defence | Quarterly |
| Executive team | Strategic risk awareness | Semi-annually |
| IT/Security team | Advanced threat response | Monthly |
| Contractors/vendors | Vendor security requirements | Upon engagement |
| AI/ML engineers | AI security & data ethics | Quarterly |
| Finance/billing | PCI DSS & payment security | Annually |

## 3. Core Training Modules

### 3.1 Phishing Awareness

**Duration:** 45 minutes | **Frequency:** Quarterly refresher

#### Learning Objectives

- [ ] Identify common phishing email indicators (sender spoofing, urgency tactics, suspicious links)
- [ ] Recognise spear-phishing and business email compromise (BEC) attacks
- [ ] Identify vishing (voice phishing) and smishing (SMS phishing) attempts
- [ ] Know the correct procedure for reporting suspected phishing
- [ ] Understand the consequences of successful phishing attacks

#### Key Topics

1. **Email indicators** — hover-over URL inspection, sender verification, header analysis
2. **Common pretexts** — IT support, CEO fraud, invoice scams, password resets
3. **Safe behaviour** — never click suspicious links, forward to security team, verify via separate channel
4. **Real examples** — anonymised examples from industry incidents

#### Phishing Simulation Program

| Metric | Target | Current |
|--------|--------|---------|
| Click rate | < 5% | [TBD] |
| Report rate | > 60% | [TBD] |
| Simulation frequency | Monthly | |
| Repeat offender training | Within 48h of click | |

### 3.2 Password Hygiene & Authentication

**Duration:** 30 minutes | **Frequency:** Annually + onboarding

#### Learning Objectives

- [ ] Create strong, unique passwords (16+ characters, passphrase method)
- [ ] Use a company-approved password manager for all credentials
- [ ] Enable multi-factor authentication (MFA) on all accounts
- [ ] Never reuse passwords across services
- [ ] Recognise and avoid credential stuffing risks

#### Password Policy Summary

| Requirement | Standard |
|-------------|----------|
| Minimum length | 16 characters |
| Complexity | Mix of character types OR passphrase |
| Rotation | Not required if MFA enabled (NIST 800-63B) |
| MFA | Required for all corporate accounts |
| Password manager | Required — company-provided |
| Shared credentials | Prohibited — use SSO/service accounts |

### 3.3 Incident Reporting

**Duration:** 30 minutes | **Frequency:** Annually + onboarding

#### Learning Objectives

- [ ] Define what constitutes a security incident
- [ ] Know the internal reporting channels and timelines
- [ ] Understand that timely reporting is a duty, not optional
- [ ] Preserve evidence (do not delete emails, logs, screenshots)
- [ ] Know the escalation path for different incident types

#### Reporting Procedure

```
1. STOP — Do not attempt to fix the issue yourself
2. REPORT — Immediately contact:
   - Email: legal@acme.com
   - Slack: #security-incidents (if available)
   - Phone: [Security team phone number]
3. PRESERVE — Keep all evidence (emails, screenshots, URLs)
4. DOCUMENT — Note the time, what you observed, and what you did
5. WAIT — Do not discuss the incident outside the response team
```

### 3.4 Social Engineering Defence

**Duration:** 30 minutes | **Frequency:** Semi-annually

- [ ] Recognise pretexting, baiting, and tailgating techniques
- [ ] Verify identity before sharing sensitive information
- [ ] Challenge unknown visitors and report suspicious physical access
- [ ] Never share credentials, even with "IT support"
- [ ] Use callback verification for financial/sensitive requests

### 3.5 Device & Endpoint Security

**Duration:** 20 minutes | **Frequency:** Annually

- [ ] Lock screens when leaving devices unattended
- [ ] Enable full-disk encryption on all devices
- [ ] Keep operating systems and applications up to date
- [ ] Use only approved software and cloud services
- [ ] Avoid public Wi-Fi without VPN for work activities
- [ ] Report lost or stolen devices immediately

### 3.6 Data Handling & Classification

**Duration:** 30 minutes | **Frequency:** Annually

- [ ] Understand data classification levels (Public, Internal, Confidential, Restricted)
- [ ] Handle personal data per GDPR/privacy requirements
- [ ] Use approved channels for sharing sensitive data
- [ ] Never store sensitive data in unapproved locations (personal email, USB drives)
- [ ] Apply clean desk policy for physical documents

### 3.7 AI Security & Data Ethics

**Duration:** 30 minutes | **Frequency:** Quarterly

- [ ] Do not paste confidential data into external AI tools
- [ ] Understand data retention policies of AI providers
- [ ] Review AI outputs for sensitive data leakage before sharing
- [ ] Follow the Acceptable AI Use Policy for approved AI tools
- [ ] Report AI-generated content that may contain PII or biased outputs

### 3.8 Payment Card Security (PCI DSS)

**Duration:** 30 minutes | **Frequency:** Annually

- [ ] Never store full card numbers, CVVs, or PINs
- [ ] Use only PCI-compliant payment processors
- [ ] Report any exposure of cardholder data immediately
- [ ] Follow secure payment handling procedures

## 4. Monthly Activities

### 2026 Monthly Calendar

| Month | Activity | Owner | Status |
|-------|----------|-------|--------|
| January | Annual security training kickoff | Security Team | |
| February | Phishing simulation #1 | Security Team | |
| March | Password hygiene reminder + MFA audit | IT | |
| April | Social engineering awareness week | Security Team | |
| May | Phishing simulation #2 | Security Team | |
| June | Incident response tabletop exercise | Security + Engineering | |
| July | Security newsletter: mid-year threats | Security Team | |
| August | Phishing simulation #3 | Security Team | |
| September | Clean desk / device security audit | IT | |
| October | Cybersecurity Awareness Month events | All Teams | |
| November | Phishing simulation #4 | Security Team | |
| December | Year-end review + policy update | Security + Legal | |

## 5. Quarterly Activities

| Quarter | Activities |
|---------|-----------|
| Q1 | Annual training deployment, baseline phishing test, policy review |
| Q2 | Incident response drill, vendor security review, new hire training audit |
| Q3 | Advanced threat briefing, access review, compliance check |
| Q4 | Year-end assessment, program effectiveness review, next-year planning |

## 6. Metrics & KPIs

| Metric | Target | Measurement Method |
|--------|--------|--------------------|
| Training completion rate | 100% within 30 days | LMS tracking |
| Phishing click rate | < 5% | Simulation platform |
| Phishing report rate | > 60% | Simulation platform |
| Mean time to report incidents | < 1 hour | Incident tracker |
| Security incidents from human error | Decreasing trend | Incident log |
| Password manager adoption | 100% | IT audit |
| MFA enrollment | 100% | Identity provider |

## 7. Training Completion Tracking

### 2026 Completion Status

| Department | Enrolled | Completed | Rate | Deadline |
|------------|----------|-----------|------|----------|
| Engineering | | | | 2026-02-28 |
| Product | | | | 2026-02-28 |
| Customer Support | | | | 2026-02-28 |
| Sales/Marketing | | | | 2026-02-28 |
| Legal/Compliance | | | | 2026-02-28 |
| Executive Team | | | | 2026-02-28 |
| **Overall** | | | | 2026-02-28 |

## 8. Non-Compliance

| Offence | Action |
|---------|--------|
| Training not completed by deadline | Manager notified; access restricted until complete |
| Failed phishing simulation (first time) | Mandatory additional training within 48 hours |
| Failed phishing simulation (repeat) | One-on-one coaching with security team |
| Failed phishing simulation (3+ times) | Escalation to management; potential access restriction |
| Failure to report a security incident | Written warning; potential disciplinary action |

## 9. Program Governance

| Role | Responsibility | Contact |
|------|---------------|---------|
| Program Owner | Overall program management | legal@acme.com |
| DPO | Data protection training oversight | Jane Mueller (dpo@acme-saas.com) |
| Department Managers | Ensure team completion | [Department leads] |
| IT/Security Team | Simulation execution, tool management | [Security team] |
| HR | Onboarding integration, compliance tracking | [HR team] |

## 10. Tools & Resources

| Tool | Purpose | Status |
|------|---------|--------|
| LMS Platform | Training delivery and tracking | [To configure] |
| Phishing Simulator | Monthly simulated phishing campaigns | [To configure] |
| Password Manager | Company-wide credential management | [To deploy] |
| Security Newsletter | Monthly threat intelligence digest | [To set up] |

### Related Documents

- Incident Response Plan (`INCIDENT_RESPONSE_PLAN.md`)
- Access Control Policy (`ACCESS_CONTROL_POLICY.md`)
- Information Security Policy (`INFORMATION_SECURITY_POLICY.md`)
- Training Record (`TRAINING_RECORD.md`)
- Acceptable AI Use Policy (`ACCEPTABLE_AI_USE_POLICY.md`)

---

*This Security Awareness Program was auto-generated by [Codepliant](https://github.com/joechensmartz/codepliant) based on code analysis. Customise the training topics, schedule, and metrics to match your organisation's specific needs. Review with your security team and legal counsel before implementation.*
