Cyber Security Awareness Training: How to Build a Programme That Works

Cyber security awareness training teaches everyone in an organisation to recognise and respond to threats such as phishing, social engineering and unsafe data handling. The programmes that work are short, frequent and tailored by role. They are tested with realistic phishing simulations, and they measure how often staff report suspicious messages, not just how many completed a course. PCI DSS requires training on hire and at least annually, including phishing and social engineering, and ISO 27001 and UK GDPR both expect it.

Done badly, awareness training is an annual video that everyone clicks through. Done well, it changes what people do when something looks wrong. This guide explains where to find free courses, what cyber security awareness training for employees should cover, how often to train, what the standards require and how to prove it works.

Key takeaways

• Effective training is short, frequent and role-based, not a single annual course.
• PCI DSS v4.0.1 requires training on hire and at least every 12 months, covering phishing and social engineering.
• ISO 27001:2022 and UK GDPR both expect staff to understand their security responsibilities.
• Measure reporting rates and time to report, not just completion and click rates.
• A no-blame reporting culture matters as much as the content.

What is cyber security awareness training?

It is the part of your security programme aimed at everyday behaviour. It differs from specialist training:

Most organisations need both: awareness for all, and training for the roles that handle systems, code or money.

Is there free cyber security awareness training?

Yes. The NCSC’s Top Tips for Staff e-learning is free, takes under 30 minutes and covers four areas: strong passwords, securing devices, defending against phishing and reporting incidents. Staff can take it online, or you can load it into your own learning platform as a SCORM package. The National Business Crime Centre’s free staff training page points to the same course.

It is a good baseline for every employee, including new starters. What a generic course cannot do is reflect your own systems, policies and payment processes. A tailored programme adds:

• role-based content for finance, IT, developers and payment staff;
• your own reporting route, policies and acceptable use rules;
• phishing simulations that measure what people actually do;
• the training records and policy acknowledgements PCI DSS and ISO 27001 auditors ask to see.

Why are people still the main target?

Attackers go where the effort is lowest. Breaking through a well-configured firewall is hard. Persuading someone in accounts to change a supplier’s bank details is often much easier. Verizon’s 2024 Data Breach Investigations Report found that 68% of breaches involved a non-malicious human element, such as falling for social engineering or making an error.

The UK government’s annual Cyber Security Breaches Survey consistently finds phishing to be the most common type of attack businesses identify. Technical controls reduce the volume, but some messages always get through. Our guide to the types of social engineering attacks explains the techniques staff will meet.

What should cyber security training for employees cover?

Core topics for everyone

• How to recognise phishing and other social engineering, and how to report it (our guide on how to spot phishing emails includes a one-page checklist to share)
• Passwords, password managers and multi-factor authentication, including never approving an unexpected MFA prompt
• Safe handling of personal data and payment card data
• Acceptable use of company devices, email and cloud services
• Working securely from home and on the move
• What to do after a mistake, and why reporting quickly matters

Role-based content

How often should staff have security awareness training?

At least on joining and once every 12 months, which is what PCI DSS requires. Most effective programmes go further: short modules spread through the year, regular phishing simulations, brief team discussions after real incidents, and quick updates when a new attack type appears. People forget long courses quickly; little and often works better.

Is security awareness training a compliance requirement?

For many organisations, yes. This table shows what each framework expects and what an auditor will ask to see.

Requirements 12.6.3.1 and 12.6.3.2 were among the PCI DSS future-dated requirements that became mandatory on 31 March 2025, and Requirement 5.4.1 adds technical anti-phishing controls. The full text is in the PCI SSC document library. If you take card payments, your QSA will ask for training records; our PCI DSS compliance services cover this as part of assessment and readiness, and our PCI DSS consultancy can help you design a programme that meets Requirement 12.6. For ISO 27001, the programme sits inside your management system, and our ISO 27001 consultancy shows how.

How do you build a security awareness programme?

1. Establish a baseline. Run a first phishing simulation and a short knowledge check so you know where you are starting from.
2. Set measurable goals. Decide what good looks like: reporting rate, time to report, completion of role-based modules.
3. Choose content and delivery. Pick material that suits your culture and can be tailored by role. Avoid anything patronising or fear-driven.
4. Recruit champions. A few respected people in each department who reinforce messages and answer everyday questions.
5. Review and adapt. Update content at least annually, and sooner after an incident or when new attack types appear.

A sample security awareness training plan

Use this as a starting point for your own plan. Frequencies marked with a requirement number are set by that standard; the rest are suggestions.

Keep the completion records and acknowledgements for every row; they are the evidence an auditor samples.

How do you measure whether training works?

Completion rates show that people attended, not that they learned. Better measures are:

• Reporting rate: the share of staff who report a simulated phishing email.
• Time to first report: how quickly the security team hears about a suspicious message.
• Credential submission rate: far more serious than a click.
• Repeat clickers: people who need more support rather than punishment.
• Real incident data: whether genuine suspicious emails are reported, and how early.

Look at trends over time rather than a single score, and compare simulations of similar difficulty.

Why does a no-blame reporting culture matter?

The most valuable thing someone can do after clicking a malicious link is report it straight away. If people fear discipline, they stay silent, and a contained incident becomes a serious one.

Leaders set the tone. Thank people who report, including those reporting their own mistakes. Make the reporting route obvious, such as a single button in the email client. Share anonymised examples of good catches so people see that reporting is valued. A fast report also helps you meet the 72-hour deadline for notifying the ICO of a reportable personal data breach, which our guide to GDPR compliance audits covers.

How do you test that training has worked?

Training tells people what to do. Testing shows whether they do it under realistic pressure. Researched phishing simulations are the starting point: our phishing simulation service runs them for you, and our guide to phishing simulation examples explains how to run them fairly. Phone-based pretexting and, where appropriate, physical access attempts show how processes hold up beyond the inbox.

Why Sovereign Secure?

Sovereign Secure is a PCI SSC Qualified Security Assessor (QSA) company, ISO 27001 certified and an IASME-licensed Cyber Essentials certification body. We see how awareness programmes are assessed from the auditor’s side, and test them from the attacker’s side.

Next step

If your programme is an annual video and a completion certificate, start with a baseline. Our social engineering penetration testing gives you real evidence of how your people respond, so you can target training where it will make a difference.