Security awareness training program: a 12-month plan you can evidence
A security awareness training program is now a legal duty under NIS2, GDPR and DORA. Here is a 12-month plan with roles, phishing tests, KPIs and evidence, plus how .legal runs its own.
Most organisations have done some version of it. An annual e-learning course, a click rate from a phishing test and a spreadsheet of who completed what. It looks like a security awareness training program. It rarely survives contact with a regulator, an auditor or a real incident.
Under NIS2, awareness and training are no longer optional for in-scope entities. The same duty appears in GDPR, in DORA for financial entities and in ISO 27001 if you are certified. None of these rules tells you how to do it. They tell you it must be appropriate, recurring and documented.
This is the practical guide to building a security awareness training program (or programme, as we spell it from here on) that meets those rules. If you want the basics first, start with our introduction to what security awareness training is. Below you get the legal requirements at article level, a 12-month plan, KPIs that measure more than clicks, an evidence list and an honest account of how we run awareness training at .legal.
The short answer: what makes a security awareness training program work?
Build a programme, not a course. Spread twelve short themes across the year so that everyone, including the board and new starters, gets something every month. Run phishing tests every quarter, but measure first how many people report and how fast. Click rates fall slowly, reporting can move a lot. Document the plan, participation, understanding and review as you go, so you can show a regulator under NIS2 Article 21(2)(g) that the programme exists and is being improved. And remember that training never replaces MFA, email filtering and patching.
What the law requires from your awareness training
The duty comes from five overlapping sources. The differences decide who must be trained and what you must prove.
| Rule | Provision | What it requires | Who |
|---|---|---|---|
| NIS2 Directive (EU) 2022/2555 | Article 21(2)(g) | Basic cyber hygiene practices and cybersecurity training as one of ten minimum measures | Essential and important entities |
| NIS2 Directive | Article 20(2) | Members of management bodies must follow training. Entities are encouraged to offer similar training to employees regularly | Board and executive management |
| Implementing Regulation (EU) 2024/2690 | Annex, points 8.1 and 8.2 | An awareness programme scheduled over time, repeated, covering new employees and tested for effectiveness. Role-based training for staff in security-relevant roles | Directly binding on cloud, data centre, managed service providers and other digital providers. A benchmark for everyone else |
| GDPR (EU) 2016/679 | Article 32(4) and Article 39(1)(b) | Staff with access to personal data may only process it on instructions. The DPO monitors awareness-raising and training of staff | All controllers and processors |
| DORA (EU) 2022/2554 | Article 13(6) | ICT security awareness programmes and digital operational resilience training as compulsory modules for all staff and senior management | Financial entities, from 17 January 2025 |
| ISO/IEC 27001:2022 | Annex A.6.3, clauses 7.2 and 7.3 | Appropriate awareness, education and training, documented evidence of competence and awareness of policy and consequences | Organisations with a certified or planned ISMS |
NIS2: the board first, then everyone else
Article 20(2) of NIS2 says that members of the management bodies of essential and important entities are required to follow training, and that entities are encouraged to offer similar training to their employees on a regular basis. The aim is that people "gain sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices". Article 20(1) adds that the management body approves the Article 21 measures, oversees their implementation and can be held liable for infringements.
Article 21(2)(g) then makes basic cyber hygiene practices and cybersecurity training one of the ten minimum measures. Maximum fines under Article 34 are EUR 10 million or 2% of worldwide annual turnover for essential entities and EUR 7 million or 1.4% for important entities. Our guide to NIS2 training requirements covers the management training duty in more depth.
National transposition decides the detail
NIS2 is a directive, so the binding text is your national law. Transposition has been uneven. In May 2025 the European Commission sent reasoned opinions to 19 member states for failing to notify full transposition, and in 2026 it referred Ireland, Spain, France and the Netherlands to the Court of Justice for failing to notify transposition measures (press release IP/26/1499). Germany's implementation act entered into force on 6 December 2025.
The Danish NIS2 Act (Act no. 434 of 6 May 2025, in force 1 July 2025) copies the training measure into section 6(1)(7) and the board duty into section 7(2). The May 2025 guidance from Denmark's competent authority, Styrelsen for Samfundssikkerhed, adds useful detail: there are no formal content requirements for the board's courses, not every member needs to attend, but the board as a whole must have the competence, and participation must be documented, for example with a course certificate. It also links the board duty to a written training policy for employees. Check your own member state's law and guidance before you finalise the plan. If you are unsure whether you are in scope at all, start with our introduction to NIS2.
The Implementing Regulation is the most concrete benchmark
Implementing Regulation (EU) 2024/2690 applies directly to a defined group of digital providers. Point 8.1 of its Annex requires an awareness raising programme that is scheduled over time so that activities are repeated and cover new employees. It must follow the security policy, cover relevant threats, contact points and cyber hygiene, and it must, where appropriate, be tested for effectiveness and updated at planned intervals. Point 8.2 adds role-based training for staff whose jobs need security skills, including when they move into such roles.
If the Regulation does not bind you, it is still the best definition of "appropriate" available. ENISA's technical implementation guidance from June 2025 adds practical advice and examples of evidence for each point.
GDPR, DORA and ISO 27001
GDPR never uses the word awareness, but Article 32(4) requires controllers and processors to ensure that anyone acting under their authority with access to personal data only processes it on instructions. An instruction nobody knows about is not an instruction. Article 39(1)(b) tasks the data protection officer with monitoring compliance, including awareness-raising and training of staff. The duty to deliver training stays with the controller.
DORA Article 13(6) is the most prescriptive text. Awareness programmes and resilience training must be compulsory modules for all employees and senior management, with complexity matched to each role, and ICT third-party providers should be included where appropriate. In ISO/IEC 27001:2022, Annex A.6.3 covers awareness, education and training, clause 7.2 requires documented evidence of competence, and clause 7.3 requires everyone to know the policy and the implications of not conforming.
Awareness, training and education are three different things
Searches for "security awareness training", "cyber security awareness training for employees" and "what is security awareness training" blend three levels that the rules actually separate. Treat them as one and everyone gets the same course, which suits nobody.
| Level | Purpose | Audience | Typical format | Source |
|---|---|---|---|---|
| Awareness | Attention and safe everyday behaviour | Everyone, including management and relevant suppliers | Monthly themes, short videos, quizzes, phishing tests | 2024/2690 point 8.1, ISO A.6.3 |
| Training | Skills tied to a specific role | IT operations, developers, finance, HR, customer service | Role-based modules, exercises, instructions | 2024/2690 point 8.2, ISO clause 7.2 |
| Education | Ability to assess risk and make decisions | Board, executives, CISO, DPO | Courses, workshops, certifications | NIS2 Article 20(2), DORA Article 13(6) |
Roles: who does what
A programme without an owner turns into a course on autopilot. Assign responsibility before you plan content.
| Role | Responsibility in the programme |
|---|---|
| Management body | Approves policy and plan, completes its own training, receives a quarterly KPI report and sets priorities |
| CISO or information security lead | Owns the programme, picks themes from the risk assessment, plans phishing tests and reports to the board |
| DPO | Supplies GDPR themes, monitors under Article 39(1)(b) and assesses data protection in the phishing tests themselves |
| HR | Runs onboarding for new starters and training on role changes, and checks works council or employment law requirements |
| IT operations or SOC | Runs the report button, handles reported emails and measures time from first report to block |
| All employees | Complete the monthly theme, report suspicious messages and give feedback |
A 12-month security awareness training plan
The plan follows the logic of point 8.1 of the Implementing Regulation: scheduled over time, repeated, covering new starters and tested for effectiveness. Each monthly theme takes an employee 10 to 15 minutes. The themes reflect what dominates recent threat reports, but your own information security risk management should set the final order.
Six things to have in place before month 1
- A training policy. State who gets what, how often and how it is documented. Denmark's regulator, for example, expects exactly this under its version of Article 21(2)(g).
- A role map. Identify the roles that need training beyond general awareness (point 8.2.1).
- One reporting channel. A single button or address that everyone knows. Without it you cannot measure reporting.
- A baseline. Measure the starting point with a first phishing test and a short knowledge quiz.
- A GDPR check of the tests. Decide the lawful basis, what staff are told and who sees results (see below).
- Board approval. Have the management body approve the plan under Article 20(1) and book its own training date.
| Month | Theme for everyone | Extra activity | Evidence |
|---|---|---|---|
| 1 | Why we do this: policy, contact points and how to report | Baseline quiz | Approved plan, attendance, quiz results |
| 2 | Phishing: the signs and what to do after a click | Phishing test 1 (baseline) | Aggregated test report |
| 3 | Passwords, MFA and password managers | Role module for IT operations | Completion by department |
| 4 | Personal data: misdirected email, sharing and instructions | Board training under Article 20(2) | Course certificates for board members |
| 5 | Social engineering, phone fraud and fake suppliers | Phishing test 2 and finance module | Test report, Q2 KPI report to the board |
| 6 | Mobile devices, travel and working away from the office | Mid-year review of the programme | Review note with changes |
| 7 | AI tools: what can we paste in? | Short refresher on the AI use policy | Quiz results |
| 8 | Incidents: what happens when you report? | Phishing test 3 and tabletop exercise for the response team | Exercise report, test report, Q3 KPI report |
| 9 | Suppliers and payment fraud | Briefing for relevant suppliers | Distribution log |
| 10 | Round-up of the year's threats (for example in European Cybersecurity Month in October) | Role modules for developers and HR | Completion by role |
| 11 | Physical security, clear desk and printing | Phishing test 4 | Test report, Q4 KPI report |
| 12 | What we learnt this year and what changes | Annual review as input to management review (ISO clause 9.3) | Annual report and new plan approved by the board |
Two streams run all year outside the calendar. New starters complete the core module within their first month, and staff moving into a security-relevant role get the role module when they move (point 8.2.4).
Verizon's 2026 Data Breach Investigations Report, covering incidents from October 2024 to November 2025, found the human element in 62% of breaches, up from 60% the year before. Pretexting, often by phone, reached 6% of initial access vectors. And 45% of employees were regular users of AI tools on corporate devices, up from 15%. That is why months 5 and 7 are in the plan.
Phishing tests: fair and useful
A phishing test is a training tool, not a trap. The point is to rehearse what happens after the email arrives: the employee pauses and reports.
Measure reporting, not only clicks
Verizon's 2025 DBIR found that employees who had been trained in the previous 30 days reported simulated phishing at about 21%, against a base rate of 5%. The effect on click rates was much smaller. The largest study of phishing training to date points the same way. Researchers tracked more than 19,500 staff at UC San Diego Health over eight months and published the results at the 2025 IEEE Symposium on Security and Privacy. Embedded training after a click lowered the failure rate by an average of 1.7 percentage points, and annual mandatory training showed no significant link to click rates.
Difficulty drives the result
In the same study, 1.82% clicked a fake request to update an Outlook password, while 30.8% clicked a fake message about a new holiday policy. A click rate tells you as much about the email as about your people. Vary the lures, record the difficulty and only compare tests of similar difficulty.
Phishing tests process personal data
Recording who clicked is processing personal data about employees. You need a lawful basis, usually legitimate interests under GDPR Article 6(1)(f), and you must inform staff under Article 13. Consent fits poorly in employment and would spoil the test. Article 88 lets member states set more specific rules for the employment context, and in several countries works councils have a say over technical monitoring of staff. In practice:
- Tell staff in advance that tests will happen, why, and what the data is used for. Not when.
- Report to the board in aggregate, by department or role, never by name.
- Use individual results for extra training, not for sanctions.
- Set a deletion period for raw data.
- Involve HR and, where relevant, the works council before the first test.
Quarterly tests are a sensible default for most organisations. Some run monthly. That gives more data points but also more fatigue, and the UC San Diego study did not find that more training sessions by themselves reduced clicks.
Measure the right things: KPIs for your security awareness training program
Completion rates show that people clicked through. They do not show whether behaviour changed. Use a small set of KPIs that together tell you whether the programme works, and report them quarterly to the board, which has to oversee the measures under NIS2 Article 20(1).
| KPI | How to calculate it | What it tells you | Direction |
|---|---|---|---|
| Reporting rate | Reported test emails / recipients | Whether staff are becoming part of your defence | Up. The most important KPI |
| Time to first report | Minutes from send to first report | How fast IT can act on a real campaign | Down |
| Report-to-click ratio | Reports / clicks | Whether more people spot it than fall for it | Above 1 |
| Click rate | Clicks / recipients at the same difficulty | Exposure. Read together with difficulty | Down, but slowly |
| Understanding | Average quiz score per theme | Whether the message landed and what to repeat | Up |
| Coverage | Completed on time by department and role | Gaps, such as a team that never finishes | Up |
| New starters | Share with core module done in month one | Whether point 8.1.2(a) works in practice | 100% |
| Real reports | Incidents first detected through a staff report | Whether behaviour transfers from tests to real life | Up |
One caveat. More reports also means more false alarms for IT. Make sure there is capacity to handle them, or the willingness to report dies quickly.
Evidence: what regulators and auditors will ask for
Neither NIS2 nor ISO 27001 requires a particular tool, but both require you to show that the programme exists, runs and improves. ENISA's guidance lists, for example, records showing that the programme is reviewed regularly and updated as necessary. Keep at least the following in one place:
- Training policy and the approved annual plan, with the date of board approval
- Course certificates or attendance confirmations for management body members
- Participation and completion by theme, department and role
- Quiz results that show understanding, not just attendance
- Aggregated phishing test results with difficulty
- Quarterly KPI reports to the board
- Review notes and changes to the plan, which evidence point 8.1.3
- Onboarding log for new starters and role changes
The same evidence covers ISO 27001 clause 7.2, supports an ISAE 3000 assurance report and can be shown during ISO 27001 certification. Denmark's D-seal also has awareness as a mandatory criterion, see our comparison of the D-seal and ISO 27001.
A worked example: from click rate to reporting rate
Northlight Logistics and Anna Berg are fictional. We invented them for this article.
Northlight Logistics has 220 employees and is an important entity under its national NIS2 law. Anna Berg is its information security lead. She inherits an awareness programme that consists of one annual e-learning course, introduces the 12-month plan and measures in month 2 and month 11 with phishing tests of the same difficulty.
| Measure | Month 2 | Month 11 |
|---|---|---|
| Recipients | 220 | 220 |
| Clicks | 29 (13%) | 22 (10%) |
| Reports | 11 (5%) | 66 (30%) |
| Report-to-click ratio | 0.4 | 3.0 |
| Time to first report | 52 minutes | 6 minutes |
The click rate fell by only three percentage points. That is in line with the research and would look disappointing if it were the only KPI. But reporting rose sixfold, and the first report arrived after six minutes instead of 52. In a real campaign that means IT can pull the email from other inboxes before most people have opened it. That is the result Anna reports to the board.
The time cost is modest. Twelve themes of 15 minutes add up to three hours per employee per year, or 660 hours in total. A one-day, seven-hour course for three executives and five board members adds 56 hours.
How .legal runs its own awareness training
We use our own compliance platform for internal awareness training. This is what we do.
One theme a month
We prepare a presentation on the month's theme with recorded audio and send it to every employee. Topics often come from our annual compliance calendar, from our own processing activities or from whatever is current. The presentation has to be watched by a deadline, but where and when is up to each person. We keep the content short and practical, with everyday examples. The goal is not to turn everyone into IT experts.
A questionnaire afterwards
Once the deadline passes, employees automatically receive a questionnaire through our internal audit module. It tests whether the content was understood and also serves as a receipt that the presentation was watched. That receipt can be used as evidence for our ISAE 3000 and ISAE 3402 work and for ISO 27001. The questionnaire also has a free-text field for feedback and requests for future themes.
Follow-up
The owner of the questionnaire is notified when an employee has finished and can see the overall score, the risk level and the individual answers. We use that to judge how the theme landed and what to cover next.
This gives us a monthly cadence, a measure of understanding and evidence created as part of the work. It is knowledge-based. If many of your employees live in their inbox, add phishing tests and reporting measurement as set out above.
What awareness training cannot do
Training is necessary, but it is not a technical control. Three caveats belong in any board presentation.
First, the numbers depend on the dataset. ENISA's Threat Landscape 2025 puts phishing, including vishing and malspam, at about 60% of observed initial intrusions. Verizon's 2026 DBIR puts phishing at 16% and vulnerability exploitation at 31%, now the most common entry point. Both can be true. The point is that many attacks never reach an employee.
Second, the UC San Diego study shows that training alone moves click rates only a little. The researchers recommend technical measures such as MFA and password managers alongside it. Read more about those layers in our article on email security.
Third, people make mistakes without any attacker involved, for example by sending personal data to the wrong recipient. That is why month 4 is about personal data. When it happens, staff must know to speak up at once, so you can handle the security breach and meet the 72-hour deadline for notifying the supervisory authority under GDPR Article 33.
How .legal supports your security awareness training
.legal does not supply awareness content or phishing simulations. What the platform does is keep the programme and its evidence in order, so you can show regulators and auditors that it runs.
- Compliance task management holds the 12 themes, board training and quarterly tests as recurring tasks with owners, deadlines and reminders, with templates for GDPR, NIS2 and ISO.
- Policy Management distributes the training policy and your security policies and tracks who has signed off, which supports ISO 27001 clause 7.3.
- The audit module sends questionnaires after each theme and collects scores and answers, the way we do it ourselves.
- The information security management module has framework templates for NIS2 and ISO/IEC 27001:2022, so the training requirement links to your other measures, plus an incident log for reported events.
If you want to see how it fits together, book a demo.
.legal compliance platform
Build Better Awareness Training with .legal
-
Track and manage employee training completion
-
Run and monitor phishing simulation campaigns
-
Document training policies and procedures
-
Generate compliance reports for audits
-
Integrate training with your security framework
.jpeg?width=131&height=26&name=right_people_logo%20(1).jpeg){kind=small}
.jpg?width=58&height=26&name=Praktiserende%20L%C3%A6gers%20Organisation%20(1).jpg){kind=small}
.jpg?width=108&height=26&name=finans%20danmark%20(1).jpg){kind=small}
.jpg?width=89&height=26&name=klasselotteri%20(1).jpg){kind=small}
-1.png?width=34&height=26&name=bws_shipping_rgb%20-%20Kopi%20(2)-1.png){kind=small}
.jpeg?width=135&height=26&name=AH%20industries%20(1).jpeg){kind=small}
.jpg?width=225&height=26&name=KAUFMANN%20(1).jpg){kind=small}
