Most organisations treat Cybersecurity Awareness Month as a week of posters and a quiz, then wonder why nothing changes by November. October is a useful hook: national agencies publish free material, leaders pay attention and staff expect a campaign. This toolkit turns that attention into a four-week, ready-to-run plan, with one behaviour per week, the activities and assets to run it, and the measures that show whether it worked. It is built to slot into the October block of a year-round programme such as the Security Awareness Plan Template, not to replace one. It is written for awareness leads, IT managers in smaller firms who own awareness by default, and communications teams asked to help.
Key takeaways
- One behaviour per week beats ten topics in a month. The four behaviours promoted by CISA and the National Cybersecurity Alliance (passwords and password managers, MFA, reporting phishing, updating software) map neatly onto four weeks.
- Start six weeks early. Approvals, HR sign-off on any simulation, reporting button checks and asset localisation take longer than the campaign itself.
- Every activity needs a measurable action. Enrolments in the password manager, passkey or MFA registrations, reports through the button and devices brought up to date are better evidence than quiz completions.
- Fix the plumbing before you ask people to use it. If the report button does not work on mobile, or the help desk cannot answer password manager questions, the campaign creates frustration, not habits.
- Close the month with a baseline for next year. Record the October numbers, decide which behaviour moved least, and feed it into the next quarter of the year-round plan.
What the month is, and what to borrow
October has been Cybersecurity Awareness Month in the United States since 2004, declared by the President and Congress, with the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cybersecurity Alliance (NCA) producing the resources and messaging. The NCA states that it launched the campaign in 2004 with the US Department of Homeland Security, and that it has since grown into a global effort. In Europe, the European Cybersecurity Month (ECSM) also runs each October, coordinated by ENISA with the European Commission and partner organisations, and lets organisations register events on a shared activities map. The UK does not run an equivalent month, but the NCSC reporting services are the natural call to action for UK staff.
You do not need to adopt a national theme, but borrowing the free assets saves weeks of design work and gives the campaign outside credibility. Check the licence terms on each asset before rebranding it.
| Source | What it offers | Best use in your campaign |
|---|---|---|
| CISA: Cybersecurity Awareness Month and Secure Our World | Four core behaviours, tip sheets in several languages, a "Secure Your Business" guide, short videos, speaker requests | Plain-language tip sheets for each week, translated versions for multilingual workforces |
| National Cybersecurity Alliance: Champion programme | Free registration as a Champion; the 2026 toolkit listed a tip sheet, 8 printable posters, 16 social media graphics and 16 Instagram Story graphics; 2026 theme "Don't Make It Easy for Them" | Posters for offices and sites, social graphics for internal channels and the company page |
| ENISA and European Commission: European Cybersecurity Month | Event registration on the ECSM activities map, past award-winning awareness materials | EU organisations wanting an external event listing or ready-made materials in EU languages |
| UK NCSC: phishing reporting services | Suspicious email reporting service ([email protected]), scam text forwarding to 7726, a scam website reporting form | The "what to do at home" call to action in week 3 for UK staff |
CISA's four steps are the backbone of this toolkit: use strong passwords with a password manager, turn on multifactor authentication (CISA prefers authenticator apps or hardware tokens), recognise and report phishing by verifying requests through a trusted channel, and keep software updated. The NCA's 2026 wording of step three, "recognize and report scams", is a useful widening: it covers calls, texts, QR codes and fake invoices as well as email.
Six weeks out: preparation
Most failed campaigns fail in September. Work through these steps in order, starting in the second half of August.
- Pick the four behaviours and one measure each. Use the calendar below as a default and swap a week only if your risk data says otherwise (for example, a finance-heavy firm may replace software updates with payment verification).
- Get the baselines. Pull September figures for each measure: password manager enrolment, MFA and passkey coverage, reports per 1,000 staff, devices behind on updates. Without a baseline you cannot show movement.
- Test the plumbing. Report the same test message from desktop, web and mobile mail clients and confirm it arrives in the security mailbox or reporting tool. Confirm the help desk has a script for password manager setup and MFA registration questions. See the Awareness Platform Security guidance if a third-party platform will send messages.
- Agree the rules for any simulation with HR and legal. The NCSC warns that punishing staff for clicking on simulated phishing may create legal risk and advises checking with HR first. Put the rules in writing before October. See the Phishing Simulation Programme Guide.
- Brief leaders and line managers. Ask one senior leader to open the month with a short message about their own password manager or passkey, and ask managers to give ten minutes in a team meeting each week.
- Prepare and schedule the assets. Localise posters, intranet pages and chat messages; book rooms or calls for the live sessions; schedule all messages in advance so a busy week does not stall the campaign.
- Plan the fallback. If a real incident lands in October, pause playful content, keep the reporting message, and resume when the incident team agrees.
The four-week calendar
Each week has one behaviour, a short live activity, supporting assets and a single number to track. Week numbers assume the campaign starts on the first working Monday of October; adjust to your calendar and public holidays.
| Week | Behaviour | Core activity | Assets | Measure |
|---|---|---|---|---|
| 1 | Unique passwords kept in a password manager, passkeys where offered | 20-minute "set it up together" drop-in, run live and recorded | Launch message from a leader, setup guide, poster, chat tip | Password manager enrolments and passkey registrations in the week |
| 2 | Turn on MFA everywhere, approve only prompts you started | MFA check-in: staff confirm their methods; personal accounts clinic | Tip sheet on push fatigue, "never share a code" card, help desk script | Share of accounts on phishing-resistant methods; MFA registration changes |
| 3 | Recognise and report suspicious messages, calls and QR codes | "Spot the scam" session using real lures reported in your own organisation (with personal data removed) | Report button guide, home reporting card (country-specific), short video | Reports per 1,000 staff and median time to first report |
| 4 | Update devices and apps, report mistakes quickly | "Restart Friday" for updates, plus a 30-minute tabletop for managers | Update instructions per platform, "what to do if you clicked" card, results summary | Devices compliant with update policy; self-reported mistakes |
Week 1: passwords, password managers and passkeys
- Message: one long, unique password per account, stored in the approved password manager; use a passkey where the service offers one.
- Activity: a guided setup drop-in where staff install the approved manager, import or create their most important credentials, and register a passkey for their work account if supported. See the Passwordless and Passkeys Guide.
- Home angle: show how the same manager protects family accounts, which makes the habit stick at work.
- Watch out: do not run a "how strong is your password" checker that asks staff to type real passwords.
Week 2: MFA and verification
- Message: turn on MFA for every account that offers it, starting with email, banking and social media; never approve a prompt you did not start and never read a code to a caller.
- Activity: staff review their registered methods; IT uses the week to move remaining users from SMS or voice to authenticator apps, passkeys or security keys.
- Role add-on: a ten-minute briefing for the service desk on caller verification before any MFA reset. See the Help Desk Social Engineering Awareness guide.
Week 3: recognise and report scams
- Message: if a message, call or QR code creates urgency or asks for credentials, money or data, stop and report it. Reporting after a click is still welcome.
- Activity: walk through three to five real lures your organisation received this year, including at least one text or QR code lure. See the QR Code Phishing (Quishing) Guide.
- Feedback loop: reply to every report this week with a thank-you and the outcome. The NCSC recommends a quick, simple reporting process with feedback, and measuring reports as well as clicks.
- Home angle: in the UK, forward scam texts to 7726 and scam emails to [email protected]; give equivalent national services for other countries you operate in.
Week 4: updates and owning mistakes
- Message: install updates promptly on laptops, phones and home routers, and report mistakes such as a misdirected email or a lost device straight away.
- Activity: a "Restart Friday" nudge plus a manager tabletop using a short scenario from the Identity Attack Tabletop Exercise Scenarios.
- Close: publish a one-page results summary to all staff in the first week of November, with thanks to the top reporting teams (by team, never by individual click).
Asset checklist
| Asset | Audience | Channel | Owner | Ready by |
|---|---|---|---|---|
| Leader launch message (150 words) | All staff | Email and intranet | Communications with CISO | Mid September |
| Four weekly tip sheets | All staff, translated where needed | Intranet, print for sites | Awareness lead | Mid September |
| Posters (one per week) | Office and site staff | Print, digital screens | Communications | Late September |
| Chat and social tips (two per week) | All staff, company page | Teams or Slack, social channels | Communications | Scheduled before 1 October |
| Help desk scripts | Service desk | Knowledge base | IT service manager | Late September |
| Manager talking points | Line managers | Email, manager briefing | Awareness lead with HR | Late September |
| Results summary | All staff and leadership | Email, board pack | Awareness lead | First week of November |
Adapting the plan to your organisation
| Situation | What to change |
|---|---|
| Small business, no awareness lead | Run only the four messages and one drop-in per week; use the NCA or CISA assets unchanged; the owner sends the launch message. Pair with the Small Business Cybersecurity Basics Guide. |
| Large enterprise, many regions | Keep the four behaviours global, let regions pick activities and national reporting services; use one dashboard for all measures. |
| Frontline or deskless workforce | Use posters, shift briefings and QR-free printed cards; avoid email-only content. See the Frontline Worker Security Awareness guide. |
| Recent phishing or fraud incident | Move reporting to week 1 and use the anonymised incident as the main story, with consent from the affected team. |
| Finance or payroll heavy | Replace week 4 with call-back verification of payment and bank detail changes. See the Business Email Compromise Awareness for Finance Teams Guide. |
| Wide AI tool use | Add a short item in week 3 on what data may go into approved AI tools, linked to the AI Acceptable Use Policy Template. |
A choice most teams face is whether to run a phishing simulation during the month. A simulation in week 3 can give a clean before-and-after reporting number, but it lands at the moment you have asked staff to trust the security team. If you run one, keep it at the difficulty of real lures, measure reports rather than clicks, and never publish names. If trust is low or HR has not agreed the rules, skip it and use reported real lures instead. See Security Awareness Training vs Phishing Simulation.
Where identity fits
Three of the four weekly behaviours are identity controls. Week 1 and week 2 only work if IT has the approved password manager licensed, single sign-on configured and phishing-resistant methods available for every user, so plan the month with the identity team. Developers and administrators need one extra message: keys, tokens and service account passwords belong in a secrets manager, never in a personal password vault, chat or code. See the Security Awareness and Human Risk Management Guide for role-based content beyond October.
Measuring the month
NIST SP 800-50 Rev. 1 asks learning programmes to define metrics and evaluation methods and to use them to update the programme. For a single month, track four to six numbers against the September baseline and again in December, to see what lasted.
- Password manager adoption: active users as a share of licensed users, before, during and two months after.
- Phishing-resistant MFA coverage: share of users with a passkey, security key or platform authenticator registered. See MFA Coverage Measurement.
- Reporting rate: reports per 1,000 staff per week, and the share of reports that were real threats.
- Time to first report: for real or simulated campaigns, the median minutes from delivery to the first report.
- Update compliance: share of managed devices within your update window at the end of week 4.
- Self-reported mistakes: count of misdirected emails, lost devices or "I clicked" reports; a rise is good news.
Report these as trends, not league tables, and see the Security Awareness Metrics guide for definitions.
Framework mapping
| Framework | Reference | How the month supports it |
|---|---|---|
| NIST CSF 2.0 | PR.AT-01, PR.AT-02 | General awareness for all personnel; week 2 and week 4 add-ons for service desk and managers |
| NIST SP 800-53 Rev. 5 | AT-2, AT-2(3), AT-3, AT-4 | Literacy training and awareness, social engineering content, role-based training, training records |
| CIS Controls v8.1 | Control 14 (Security Awareness and Skills Training) | Awareness programme, social engineering recognition, authentication practice, reporting incidents. See the CIS Control 14 Security Awareness and Skills Training Guide |
| ISO/IEC 27001:2022 | Annex A 6.3 | Information security awareness, education and training evidence |
| MITRE ATT&CK | T1566 Phishing, T1078 Valid Accounts, T1657 Financial Theft | The techniques the weekly behaviours make harder |
Common failure patterns
- Content without capability: telling staff to use a password manager the organisation has not licensed, or MFA methods IT has not enabled.
- A broken report button: the campaign doubles reporting volume and the security mailbox either rejects messages or nobody replies, which teaches staff that reporting is pointless.
- Gotcha simulations: a hard simulation in week 3 with names shared with managers undoes the trust the month set out to build.
- Measuring completions only: quiz scores rise and no behaviour moves; nobody checks enrolment or reporting data.
- Thirty topics in thirty days: daily tips on everything from Wi-Fi to shredding mean staff remember none of them.
- No November: the month ends without a results summary or a plan for the behaviour that moved least, so next October starts from zero.
Practitioner checklist
- Choose four behaviours and one measure each by mid August, and pull September baselines.
- Register for the NCA Champion toolkit or download CISA tip sheets and check licence terms.
- Test the report button on every mail client, including mobile, and staff the reporting mailbox.
- Confirm the password manager, passkeys and phishing-resistant MFA are available to everyone.
- Get written HR and legal agreement on any simulation, with no names published.
- Schedule all messages and book all live sessions before 1 October.
- Reply to every report during the month with thanks and an outcome.
- Publish a results summary in early November and re-measure in December.
- Feed the weakest behaviour into the next quarter of the year-round plan.
Standards and references
- CISA: Cybersecurity Awareness Month
- CISA: Secure Our World
- National Cybersecurity Alliance: Cybersecurity Awareness Month
- European Commission and ENISA: European Cybersecurity Month
- NIST: SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program
- NCSC: Phishing attacks, defending your organisation
- NCSC: Report a scam email
- NCSC: Report a scam text message
Related NHI Mgmt Group resources: Security Awareness Plan Template · Security Awareness and Human Risk Management Guide · Security Awareness Maturity Model · Phishing Incident Response Playbook