Security awareness program for small business: a 30-day plan (with checklist)

A small business does not need an enterprise platform to start a security awareness program. It needs an owner, five topics, a way to report, a monthly rhythm and one number to watch. This 30-day plan gets you there, with free resources first and paid options when a customer, insurer or regulator asks for evidence.

Why does a small business need security awareness training?

Most attacks on small businesses start with a person: an email that looks like a supplier invoice, a login page that looks like Microsoft 365, an MFA prompt approved to make it stop. Business email compromise in particular targets small finance teams because a single changed bank account can cost more than a year’s profit. Technical controls help, but the person who pauses and reports is often the only control that sees the attack first.

What frameworks should a small business follow?

• NIST CSF 2.0 Small Business Quick-Start Guide (NIST SP 1300, February 2024): a short, free guide for businesses with modest or no cybersecurity plans. Awareness and training sit under its Protect function.
• CISA Secure Our World: four steps to teach everyone: use strong passwords and a password manager, turn on MFA, recognise and report phishing, and update software.
• NIST Phish Scale (NIST Technical Note 2276): a free method to rate how hard a phishing email is to spot, so your test results are fair and comparable.
• ISO 27001 clause 7.3 (awareness) and SOC 2 if customers ask: both expect evidence that people received training.

What is the 30-day plan?

Which topics come first?

1. Phishing and fake invoices: check the sender, hover links, and never change bank details from an email alone.
2. MFA prompts you did not request: deny and report. Attackers send floods of prompts hoping someone approves.
3. Passwords: long and unique (CISA suggests at least 16 characters), stored in a password manager, never reused.
4. Updates: automatic updates on, restart when asked.
5. Reporting: how to report, and that reporting a mistake early is always the right call.

Then add: remote work and personal devices, safe use of AI tools with customer data, QR-code and SMS phishing, and deepfake voice calls asking for urgent payments.

How do you run a fair first phishing test?

• Train first, test second. Testing people on something nobody taught them only measures surprise.
• Get written approval from the owner or managing director.
• Use a realistic but kind lure: a shared document or delivery notice, not a fake bonus, layoff or medical result.
• Rate its difficulty with the NIST Phish Scale so next quarter’s result is comparable.
• Anyone who clicks sees a friendly 1-minute explanation, not a warning.
• Report results as percentages, never as a list of names.

Tools: Microsoft’s Attack simulation training if you have Microsoft 365 E5 or Defender for Office 365 Plan 2; KnowBe4, Proofpoint or Hoxhunt if you buy a platform; GoPhish (free, open source) if someone technical can run it safely.

What does it cost: free, low-cost and paid options?

What should you measure?

• Report rate on simulations and real phishing: the most important number.
• Time to first report: how fast someone raises the alarm.
• Click rate, adjusted for difficulty.
• MFA coverage on email, banking and admin accounts (aim for 100%).
• Payment verification: share of bank-detail changes verified by phone.

The 30-day checklist

• [ ] Owner named and given 2 hours a week for the first month
• [ ] MFA on for email, banking, payroll and admin accounts
• [ ] Report-phishing button or shared address set up and tested
• [ ] One-paragraph "if something looks wrong" rule sent to everyone
• [ ] 15-minute kickoff held on the five core topics
• [ ] Password manager rolled out (or chosen)
• [ ] Call-back verification rule for bank-detail changes written and agreed by finance
• [ ] First fair phishing simulation approved, run and rated for difficulty
• [ ] Baseline report rate, time to first report and click rate recorded
• [ ] Monthly 5-minute lessons scheduled for the next 6 months
• [ ] Incident contact list ready: IT support, bank fraud line, insurer, and the BEC response checklist bookmarked

Want this tailored to your headcount, email platform and budget? The security awareness program planner builds the week-by-week plan and a 6-month lesson calendar for you.

Frequently asked questions

How do I build a security awareness program for a small business?

Pick an owner, cover five topics first (phishing and payment fraud, MFA, passwords and a password manager, updates, and how to report), deliver them as short monthly lessons instead of one annual session, run a gentle phishing test after people have been trained, and measure report rate. NIST’s free CSF 2.0 Small Business Quick-Start Guide (SP 1300) and CISA’s Secure Our World steps give you the content framework.

What topics should small business security awareness training cover?

Start with the attacks that actually hit small businesses: phishing and business email compromise (fake invoices and bank-detail changes), MFA push fatigue, weak or reused passwords, unpatched devices, and what to do when something looks wrong. Add remote work and personal devices, safe use of AI tools with company data, and physical basics such as screen locks.

What are employee phishing test best practices?

Train before you test, announce that tests will happen (not when), use realistic but fair scenarios, never use lures that cause real distress (bonuses, layoffs, health scares), give instant friendly feedback to anyone who clicks, thank reporters, and never publish names. Rate difficulty so results are comparable, and keep the test approved in writing by management.

Which security training platforms integrate with Microsoft 365?

Microsoft’s own Attack simulation training is built into Microsoft 365 E5 and Defender for Office 365 Plan 2. KnowBe4 and Proofpoint both provide report-phishing buttons and integrations for Microsoft 365. Whatever you choose, set up the allow-listing the vendor documents so simulations are delivered.

How much does security awareness training cost for a small business?

It can start at zero: CISA and NIST materials are free, PlayCISO’s arcade games are free without an account, and GoPhish is free open-source software if you have someone technical. As of October 2026 KnowBe4’s published US list price for 25 to 50 seats starts at $2.40 per seat per month (SAT Foundation, 3-year term), about $1,440 a year for 50 people.