Security Awareness Program Planner
Tell it your headcount, email platform, budget and biggest risks. Get a week-by-week 30-day launch plan, a monthly 5-minute lesson calendar, the metrics to watch and tooling that fits your budget. Built on NIST SP 1300 and CISA Secure Our World. Everything runs in your browser.
Your 30-day launch
Week 1: set up
Week 2: kickoff
Week 3: roles
Week 4: test and measure
Then one 5-minute lesson a month
| Month | Topic | Activity | Watch |
|---|---|---|---|
| Month 1 | Spotting phishing and reporting it | Play Pick the Phish together (5 min), then show where the report button is | Report rate on the next simulation |
| Month 2 | Bank-detail changes and fake invoices | Finance runs the Invoice Fraud BEC Lab (15 min); everyone learns the call-back rule | Share of bank-detail changes verified by phone |
| Month 3 | Account takeover warning signs | IT and admins run the MFA Bypass Lab; everyone gets the "deny and report" rule | Phishing-resistant MFA on admin accounts |
| Month 4 | MFA prompts you did not request | Play Approve or Deny, the MFA-fatigue game (5 min) | MFA coverage; denied unexpected prompts reported |
| Month 5 | Passwords and a password manager | 5-minute demo of your password manager; CISA suggests passwords of at least 16 characters | Password manager adoption |
| Month 6 | Updates and lost devices | Turn on automatic updates together; agree who to call about a lost laptop or phone | Devices on current OS versions |
Run one phishing simulation a quarter, after the lesson it tests, and keep difficulty comparable.
Measure
- Report rate on simulations and real phishing (the most important number)
- Time to first report after a phishing email lands
- Click rate, adjusted for difficulty with the NIST Phish Scale
- MFA coverage on email, banking and admin accounts
- Share of bank-detail changes verified by phone
Tooling for your budget
- Content framework: NIST SP 1300 (CSF 2.0 Small Business Quick-Start Guide) and CISA Secure Our World. Free.
- Monthly 5-minute lessons: PlayCISO arcade games (free, no account, embeddable on an intranet page).
- Phishing simulation: GoPhish (free, open source) if someone technical can run it safely; otherwise skip simulations for now and use the free games plus real-phish reporting.
General guidance, not legal or compliance advice. Nothing you choose here leaves your browser.
What this tool is
- Answer five questions (headcount, email platform, budget, start date, biggest risks) and get a security awareness plan you can start on Monday.
- Week 1 sets up an owner, MFA and a one-click way to report; week 2 is a 15-minute kickoff; week 3 adds role rules such as call-back verification for bank-detail changes; week 4 runs a fair first phishing test and records a baseline.
- After launch: one 5-minute lesson a month, matched to your risks, with links to free PlayCISO games and labs where they fit.
- Measures behaviour, not just completion: report rate, time to first report and difficulty-adjusted click rate (NIST Phish Scale).
- Copy, download or print the plan. Nothing you choose leaves your browser.
Why short, monthly and measured
People finish lessons that are short, about situations they recognise, and ask them to make a decision. One 5-minute lesson a month keeps security in front of people all year; one annual hour is forgotten within weeks. And the number that protects you is not completion but report rate: one fast report lets you pull a phishing email from every inbox before anyone else clicks it.
The full reasoning, with a printable checklist, is in Security awareness program for small business: a 30-day plan and awareness training people actually finish.
Frequently asked questions
What should a small business security awareness program include?
An owner, a one-click way to report suspicious email, MFA on email and banking, five core topics (phishing and fake invoices, unexpected MFA prompts, passwords and a password manager, updates, and how to report), a monthly short lesson instead of an annual course, a fair phishing test after training, and a behaviour metric such as report rate. NIST SP 1300 and CISA Secure Our World cover the content for free.
How long should security awareness lessons be?
Three to seven minutes, once a month. Short lessons built around a realistic situation and a decision are finished far more often than a single annual hour, and they keep the topic in front of people all year.
When should we run our first phishing simulation?
After people have been taught what to look for and how to report, usually in week 4. Get written approval, use a realistic but kind lure, rate its difficulty with the NIST Phish Scale, show anyone who clicks a friendly explanation, and report results as percentages, never names.
Which phishing simulation tool should a small business use?
If you have Microsoft 365 E5 or Defender for Office 365 Plan 2, Microsoft’s Attack simulation training is already licensed. If you need completion records for customers, auditors or insurers, buy an awareness platform such as KnowBe4, Proofpoint ZenGuide or Hoxhunt. With no budget and a technical person, GoPhish is free and open source. PlayCISO does not send phishing simulations; it provides free games and labs for the monthly lessons.
Is anything I enter sent to a server?
No. The planner builds the plan in your browser from your answers and makes no network calls with them. The output is general guidance, not legal or compliance advice.
More free security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.