Security Awareness Training Plan: 12-Month Roadmap With Owners
8 min read ยท 2026-10-25
A security awareness training plan is a yearly schedule of training, reminders and practice exercises that teaches every employee how to spot and report threats such as phishing, weak passwords and data mishandling, and that measures whether their behavior actually changes. A good plan mixes a short core course for everyone, role-based modules for higher-risk teams, regular phishing simulations and a monthly topic, with clear owners and metrics.
The roadmap below covers 12 months in six phases. It also includes a filled-in monthly calendar, a RACI, the metrics that show real progress and how to report to leadership. If you need the program for a standard or a contract, such as ISO 27001, PCI DSS, SOC 2 or HIPAA, confirm the exact training requirements with the official text or your auditor, and keep records of who completed what.
The roadmap at a glance
Goal: Every employee completes core training, high-risk roles complete role-based modules, phishing simulations run monthly and reporting rates rise against the baseline, with records ready for audit. Duration: 12 months
Assess risks and requirements (Weeks 1-4)
Know which threats and rules the plan must address and who is most exposed.
- Review recent security incidents, near misses and help desk tickets to find the behaviors that cause problems.
- List training requirements from the standards, contracts and regulations that apply to you, and confirm them with compliance or your auditor.
- Group employees by risk: finance and payroll, executives and assistants, IT admins, developers, customer-facing staff, everyone else.
- Agree on goals with the CISO or IT security lead, such as higher phishing report rates and fewer incidents caused by user error.
Milestone: A one-page plan brief with risks, requirements, audience groups and goals, approved by the CISO or security lead.
Baseline and program setup (Weeks 3-8)
Measure current behavior and prepare the tools and content.
- Run an unannounced baseline phishing simulation after agreeing the approach with HR, legal and works councils where they exist.
- Choose or confirm the training platform and connect it to your user directory so new hires and leavers sync.
- Make it easy to report suspicious email, for example with a report button in the mail client.
- Select or write content for each audience and plan a 12-month topic calendar.
- Write the policy for repeat clickers: extra coaching, not public blame.
Milestone: Baseline click and report rates recorded, platform live with all users synced and a 12-month calendar approved.
Launch core training (Weeks 7-12)
Get every employee through a short core course with leadership support.
- Send a kickoff message from the CEO or a senior leader explaining why the program matters.
- Assign a core course of short modules on phishing, passwords and multi-factor authentication, data handling and reporting incidents.
- Add the core course to onboarding so new hires complete it in their first weeks.
- Send reminders and give managers a list of team members who have not finished.
Milestone: Core course completion reaches the target agreed in the brief, with records exported for audit.
Role-based training (Months 4-6)
Give higher-risk teams training that matches the threats they face.
- Finance and payroll: payment fraud, fake invoices and changes to bank details, with a call-back rule for any payment change.
- Executives and assistants: targeted phishing, impersonation and travel risks.
- IT admins and developers: privileged access, secure coding basics and handling secrets.
- Customer-facing staff: verifying identity on calls and handling personal data.
Milestone: Every high-risk group completes its module, and the call-back rule for payment changes is written into the finance procedure.
Ongoing campaigns and simulations (Months 4-11)
Keep security in front of people all year with practice and short reminders.
- Run a phishing simulation each month with varied templates and difficulty.
- Send a short monthly topic message, such as a two-minute video or a one-page tip.
- Give instant, friendly feedback to people who click, with a short lesson on what they missed.
- Thank people who report, and share real examples of reported attacks that were stopped.
Milestone: Monthly simulations and topic messages sent on schedule for at least six months, with results reviewed each month.
Measure, report and plan next year (Month 12)
Show what changed and update the plan.
- Compare click rates, report rates and time to report with the baseline.
- Review incidents caused by user error over the year.
- Run a short survey on how confident staff feel about spotting and reporting threats.
- Update risks, audiences and topics for next year.
Milestone: Annual report shared with leadership and the audit or compliance team, and next year's plan approved.
Who owns what
Security awareness sits between IT security, HR and communications. Security knows the threats, HR knows the people processes and communications knows how to get attention. Name one program owner and give each team a clear part.
Managers matter more than any module. When a manager asks the team about a simulated phishing email in a weekly meeting, people pay attention.
- CISO or IT security lead (sponsor): goals, risk priorities, approval of simulations and reporting to leadership.
- Security awareness manager (owner): plan, content, calendar, simulations and metrics.
- HR: onboarding integration, policy on repeat clickers and links to the employee handbook.
- Internal communications: kickoff message, monthly topics and tone.
- IT operations: directory sync, report button, email filtering and incident handling.
- Compliance or audit: requirements, evidence of completion and audit support.
- People managers: follow up on completion and talk about security in team meetings.
Example: a 12-month training calendar
Picture a company of 800 people with offices in two countries. It has had two attempted invoice frauds and many reports of fake delivery emails. Here is how the year could look. Each month has a topic, a simulation and an owner.
Topics follow the calendar where it helps. Travel risks before summer, shopping scams before the holidays. Timely topics get more attention than generic ones.
- Month 1 (security awareness manager): risks and requirements reviewed. Milestone: brief approved.
- Month 2 (security awareness manager with IT operations): baseline phishing test, report button live. Milestone: baseline recorded.
- Month 3 (internal communications): CEO kickoff, core course assigned. Milestone: completion target met.
- Months 4-6 (security awareness manager with finance lead): role-based modules, invoice fraud call-back rule, topics on multi-factor authentication and safe file sharing. Milestone: all high-risk groups trained.
- Months 7-11 (security awareness manager): monthly simulations, topics on travel, social media, physical security, QR code scams and holiday shopping scams. Milestone: report rate trending up.
- Month 12 (CISO): annual report and next year's plan. Milestone: plan approved.
Running phishing simulations the right way
Simulations work when they teach and fail when they feel like traps. Agree on the rules with HR and legal before the first one, and tell employees that simulations are part of the program, without telling them when.
Avoid templates that play on real personal fears, such as fake layoffs or pay cuts. They may catch people, but they damage trust in the security team and in internal email.
- Vary templates and difficulty so people learn patterns, not one specific email.
- Show a short lesson right after a click, not a week later.
- Measure reports as well as clicks. A rising report rate shows people are acting, not just avoiding.
- Offer coaching to repeat clickers in private, and involve their manager only if it continues.
- Share results by department, never by name, in company-wide updates.
Metrics to track
Completion rates prove that training happened, which auditors need. They do not prove behavior changed. Track both, and lead with behavior in your reports.
Pull the numbers from your training platform, your email security tools and your incident records, and compare them with the baseline every month.
- Completion rate: share of employees who finished core and role-based training on time.
- Phishing click rate: share of recipients who clicked a simulated link, by department.
- Report rate: share of recipients who reported the simulated email.
- Time to first report: how fast the first person reported a simulation or a real phishing email.
- Real incidents linked to user behavior: compared with the previous year.
- Confidence score: a short survey asking whether staff know how to spot and report threats.
How to present it to leadership
Leaders want to know whether people are a smaller risk than last year. Open with two numbers: the report rate and the click rate, both against the baseline. Add one real story, such as a fraud attempt stopped because someone used the call-back rule.
On one slide, show the yearly calendar as a timeline, completion by department, the trend of clicks and reports, and two or three asks, such as a senior leader recording a short video or managers mentioning security in team meetings. Keep platform details and module lists in an appendix for the audit team.
How to adapt it
Small companies can run the same plan with less: a short core course, quarterly simulations and a monthly email from the IT lead. Large companies need local versions, translations and regional owners.
For regulated industries, add the topics and records your rules require and confirm them with your compliance team or auditor. Keep evidence of completion, dates and content versions in one place so audits do not turn into a scramble.
- Small business: one owner in IT, quarterly simulations, core course at onboarding and once a year.
- Remote or hybrid teams: home network safety, device security and verifying requests on chat tools.
- Frontline or shift workers: short mobile-friendly modules and briefings in team meetings instead of long online courses.
- Multi-country company: translated content, local examples and coordination with works councils where required.
Common mistakes to avoid
- Treating training as a once-a-year video gives people nothing to practice, so add monthly simulations and short reminders.
- Reporting only completion rates hides whether behavior changed, so lead with click rates, report rates and real incidents.
- Shaming people who click makes them hide mistakes, so give private coaching and thank those who report.
- Giving everyone the same content ignores the biggest risks, so add role-based training for finance, executives and IT admins.
- Using cruel simulation themes damages trust, so avoid fake layoffs, pay cuts or health scares.
- Assuming a standard's training requirement without checking can fail an audit, so confirm the exact requirements with the official text or your auditor.
Frequently asked questions
What should a security awareness training plan include?
It should include a risk assessment, audience groups, a baseline phishing test, a core course for everyone, role-based modules, a monthly calendar of topics and simulations, metrics and an annual review. Each part needs an owner.
How often should security awareness training be done?
Many organizations train at onboarding, run a core course once a year and add short monthly reminders and phishing simulations. Check whether your industry rules or contracts set a minimum frequency.
How do you measure security awareness training?
Track completion for audit purposes, but focus on behavior: phishing click rates, report rates, time to report and real incidents linked to user actions. Compare each with a baseline taken before the program starts.
Who is responsible for security awareness training?
Usually the CISO or IT security lead sponsors it and a security awareness manager runs it. HR, internal communications, IT operations and compliance each have a role, and managers help by following up with their teams.
What topics should security awareness training cover?
Common topics are phishing and social engineering, passwords and multi-factor authentication, safe data handling, payment fraud, device security, remote work and how to report incidents. Add topics based on your own incidents and roles.