Security Awareness Program: A 30-Day Start Plan

You can start a real security awareness program in 30 days. You need one owner, a list of your staff and about an hour a week.

Many owners wait because it sounds big. It is not. Here is a plan that fits around normal work.

What do you need before you start a security awareness program?

You need four things, and they take about one hour in total.

• Pick one owner.
• Make a list of everyone who uses email or company data.
• Decide how people will report a suspicious message. One place. One name.
• Pick your tool. See how to choose a security awareness training platform.

What do you do in week 1?

Set up the tool and tell your team why. Keep the message friendly.

1. Add all staff to the platform (in bulk if you can).
2. Send a short note: why you are doing this, what to expect, and “reporting is welcome, not punished.”
3. Turn on multi-factor authentication for email and admin accounts. CISA explains how.

What do you do in week 2?

Assign the core lesson. Leaders go first.

1. Assign the all-staff core track. In Skillermatic that is the All-Staff Core track of short lessons.
2. Set a due date of one week.
3. Check progress by Friday. Send a gentle reminder.
4. Leaders go first. When the boss finishes first, others follow.

What do you do in week 3?

Run your first practice phishing test. Keep it fair and small.

1. Tell staff practice emails will happen.
2. Send one realistic scenario. See how to run a phishing simulation.
3. Look at who clicked, who reported, and who did nothing.
4. People who clicked get a short follow-up lesson automatically.

What do you do in week 4?

Read the numbers and fix one thing. Do not try to fix everything at once.

Number	Why
Completion rate	Did people do it?
Click rate	Who needs help?
Report rate	Is the team speaking up?

Pick one weakness. Maybe finance needs a lesson on bank-change fraud. Assign it. Done. For help reading the results, see phishing simulation metrics.

What happens after the first 30 days?

Keep a steady rhythm. A program that runs a little every month beats a big push once a year.

• Every month: one short lesson.
• Every month or quarter: one practice phishing test.
• Every quarter: read the numbers.
• Keep a dated copy of reports. See how to track employee training completion.

CISA says to make training a regular part of staff onboarding and ongoing development. This plan does that. NIST also asks whether you regularly train employees to spot phishing threats.

Who does what?

Person	Job	Time
Owner of the program	Runs the plan, sends reminders	1 hour a week
Leaders	Finish first, say thanks	20 minutes
Everyone	Lessons, report suspicious messages	5 to 10 minutes a lesson

What mistakes should you avoid?

• Starting with a test before anyone has had a lesson.
• Having no clear place to report.
• Skipping the leaders.
• Making it a one-time event.

New hires should join the loop right away. See employee onboarding training online.

What is a copy-paste checklist for the 30 days?

Print this and tick the boxes.

• I named one owner.
• I listed all staff who use email or company data.
• Everyone knows where to report a suspicious message.
• Staff are added to the platform.
• MFA is on for email and admin accounts.
• The core lesson is assigned with a due date.
• Leaders finished first.
• Staff were told practice emails are coming.
• The first practice phishing test went out.
• People who clicked got a follow-up lesson.
• I looked at completion, click rate and report rate.
• I picked one weakness and assigned one lesson for it.
• I saved a dated copy of the reports.

Start here

Start a free trial to set up your first team, or book a demo. See the course library for the tracks.