Why awareness is a control, not a nicety
People are the most targeted layer of any organisation. A security awareness and training policy defines how staff are trained to recognise phishing, handle data and report incidents — turning your workforce from the weakest link into a detection layer. Auditors expect evidence that training actually happens.
What to include
- Scope — all staff, contractors and, where relevant, role-specific training.
- Onboarding training — completed before or shortly after access is granted.
- Recurring training — at least annual refreshers, with completion tracked.
- Phishing simulations — periodic tests, with follow-up training rather than punishment.
- Role-based modules — extra training for developers, admins and finance (a frequent fraud target).
- Records — completion evidence retained for audits.
- Effectiveness — measure and improve (completion rates, phishing click rates).
Common mistakes
- One slide deck at onboarding and nothing after.
- Phishing tests used to punish, which destroys reporting culture.
- No completion records, so you cannot prove training to an auditor.
Framework alignment
Maps to ISO 27001:2022 Annex A 6.3 (awareness, education and training), the SOC 2 criteria, and NIST CSF Protect (PR.AT).
Generate it in minutes
See a sample awareness & training policy or generate yours free.