How do organisations get started with an IT security awareness and training programme?

Organisations should start by identifying their highest-risk user behaviours, then deliver targeted training that matches those risks. Build baseline phishing, password, device use, and reporting guidance, measure participation and click rates, and repeat training regularly. Keep content role-based, current, and tied to incidents, policies, and the controls users are expected to follow.

How to start by focusing the programme on the riskiest behaviours

The best starting point is not a generic “awareness campaign,” but a short list of behaviours that create the most exposure in your environment. That usually includes phishing, password reuse, unsafe device use, poor reporting, and handling of sensitive data or links. Baseline the current state first, so training is targeted to the mistakes people actually make.

At this stage, the programme should be risk-led and role-aware. A finance team, service desk, and engineering team do not need the same examples or the same escalation paths. Training is more effective when it reflects the policy, incident patterns, and daily workflows people are expected to follow.

A practical sequence is to identify the highest-risk actions, map each one to a short learning objective, and decide what success looks like before you launch. That keeps the programme tied to measurable behaviour change rather than attendance alone.

What the first training content should include

Start with the controls users must recognise and apply immediately: how to spot suspicious messages, how to create and protect passwords, how to use devices safely, and how to report a concern quickly. The initial content should be short, repeatable, and specific enough that users can apply it on the same day they receive it.

It also helps to mix awareness with action. Users need to know what bad looks like, but they also need the exact steps for reporting, the approved channels for help, and the situations that require escalation. If the organisation expects people to follow a process, the programme should teach that process rather than only describe the threat.

For most organisations, this first wave should be simple enough to scale, but not so broad that it loses relevance. The aim is to make the most common security decisions easier and safer for users in their normal work, not to turn everyone into a security specialist.

How to make the programme work after launch

Once the baseline material is in place, the programme needs regular reinforcement. Short refreshers, simulated phishing, reminder prompts, and targeted follow-up after incidents all help keep the message current. Training should evolve when policies change, new attack patterns appear, or a specific user group shows a repeat weakness.

Measurement matters as much as delivery. Track participation, click rates, report rates, and repeat offenders, then use those results to adjust content and targeting. If the metrics do not change over time, the programme may be too generic, too infrequent, or disconnected from real user behaviour.

Good programmes also include managers and business owners, not just end users. Role-based reinforcement works best when local leaders help reinforce expected behaviour, especially where a team has unusual tools, higher privileges, or a history of security incidents.

Risk and Threat Considerations

User awareness programmes fail when they treat all behaviours as equally important. That creates training fatigue, lower reporting quality, and a false sense of coverage while the most dangerous behaviours remain unchanged.

Failure mechanism: Attackers and internal mistakes exploit the gap between policy and habit, especially where users are asked to make quick trust decisions under time pressure, or where reporting channels are unclear or inconvenient.

Impact: The organisation sees more successful phishing, weaker credential hygiene, slower incident reporting, and greater exposure from everyday errors that could have been caught earlier.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-14 — Security Awareness and Skills Training	Directly addresses a user awareness and training programme.
Recommendation — Build a role-based awareness programme and measure behavioural improvement over time.
NIST SP 800-53 Rev 5	AT-2 — Literacy Training and Awareness	Fits the need to provide baseline security awareness for all users.
	AT-3 — Role-Based Training	Applies because the programme should match training to user roles and risk.
	AU-6 — Audit Review, Analysis, and Reporting	Supports measuring participation, click rates, and reporting outcomes.
Recommendation — Deliver initial awareness training and repeat it on a defined cadence. Tailor training content to the duties, risks, and tools of each role. Track training metrics and use them to adjust content and follow-up.

Practitioner Guidance

What to prioritise: Start with the behaviours that create the biggest business impact if they fail, then align each one to one clear action users can remember and repeat. If a topic does not change day-to-day behaviour, it is probably not the first topic to train.

What to verify: Check that the programme has an owner, a baseline measure, and a repeat cadence before you scale it. If you cannot show which groups are improving and which are not, you are measuring delivery rather than risk reduction.

Practitioner takeaway: The strongest awareness programmes are narrow at the start, measurable from day one, and tied to the actual behaviours that most often lead to incidents.