Educate Checklist
Use this checklist to confirm that the company has assigned cybersecurity education ownership, trained employees on practical risks, provided role-based training for high-risk teams, built a strong reporting culture, practiced common scenarios, and tracked evidence and improvement.
The goal of Educate is not to make every employee a cybersecurity expert. The goal is to make sure people understand the risks connected to their work, know what safe behavior looks like, and report suspicious activity or mistakes quickly.
Security Awareness Ownership and Training Plan Checklist
☐ Assign a security awareness owner.
☐ Define who supports the training program, including HR, IT, managers, MSPs, compliance, or leadership where needed.
☐ Identify all groups that need training, including employees, new hires, executives, finance, HR, IT, managers, remote workers, contractors, and vendors with access.
☐ Define the core cybersecurity topics every employee must understand.
☐ Define which roles require additional role-based training.
☐ Create a basic annual cybersecurity training schedule.
☐ Include cybersecurity training in new employee onboarding.
☐ Include access removal, device return, and ownership transfer reminders in offboarding.
☐ Define how training completion will be tracked.
☐ Define where training evidence will be stored.
☐ Update training after incidents, near misses, new tools, new risks, or repeated mistakes.
☐ Review the training plan at least once per year.
Core Employee Cybersecurity Training Checklist
☐ Train employees on phishing and suspicious messages.
☐ Train employees on fake login pages, malicious attachments, unknown QR codes, and social engineering.
☐ Train employees on password safety and use of the approved password manager.
☐ Train employees not to share passwords or reuse work passwords on personal sites.
☐ Train employees not to approve unexpected MFA prompts.
☐ Train employees to report suspicious MFA prompts immediately.
☐ Train employees on safe email, link, and attachment handling.
☐ Train employees on safe data sharing and recipient checking.
☐ Train employees to use approved tools for company work.
☐ Train employees to avoid personal email, personal cloud storage, and unmanaged file-sharing tools for company data.
☐ Train employees on device safety, updates, screen locking, lost-device reporting, and remote work expectations.
☐ Train employees on payment fraud warning signs and urgent request scams.
☐ Train employees to report suspicious activity quickly.
☐ Train employees to report mistakes immediately.
☐ Use short real-world scenarios to reinforce the training.
☐ Track completion of core employee training.
Role-Based and High-Risk Team Training Checklist
☐ Identify high-risk teams and roles.
☐ Include executives and senior managers in role-based training.
☐ Include finance and accounting in role-based training.
☐ Include HR and payroll in role-based training.
☐ Include IT, administrators, and MSP-facing contacts in role-based training.
☐ Include developers and technical teams where relevant.
☐ Include sales, customer service, operations, procurement, legal, compliance, and managers where relevant.
☐ Define the main cyber risks faced by each high-risk role.
☐ Train finance on invoice fraud, payment diversion, bank-detail changes, payroll fraud, and verification procedures.
☐ Train HR on employee data protection, fake applicant attachments, onboarding, offboarding, payroll data, and sensitive document sharing.
☐ Train executives on impersonation, approval pressure, cyber risk decisions, incident communication, and leadership responsibility.
☐ Train IT and administrators on privileged access, MFA resets, vendor access, patching, logging, backups, and evidence preservation.
☐ Train developers on secure coding, secrets management, repository access, dependency risk, cloud access, and CI/CD security where relevant.
☐ Train customer-facing teams on suspicious customer messages, account-change requests, CRM data handling, and escalation.
☐ Train procurement and operations on supplier impersonation, vendor changes, shipment redirection, and third-party file sharing.
☐ Train managers on access approval, offboarding, reporting culture, exceptions, and temporary workaround approval.
☐ Use role-specific scenarios.
☐ Track role-based training separately from general training.
☐ Update role-based training after incidents, near misses, or process changes.
Reporting Culture, Simulations, and Practice Checklist
☐ Define a clear no-blame reporting message.
☐ Tell employees that fast reporting is expected and appreciated.
☐ Tell employees that honest mistakes should be reported immediately.
☐ Define what employees should report.
☐ Include suspicious emails, links, attachments, QR codes, fake login pages, unexpected MFA prompts, payment-change requests, lost devices, data mistakes, strange device behavior, and possible malware.
☐ Create simple reporting channels.
☐ Provide a phishing report button where available.
☐ Provide a dedicated security email address or helpdesk category.
☐ Provide an urgent escalation path for serious incidents.
☐ Tell employees what to do immediately after clicking a suspicious link, entering a password, opening a suspicious attachment, approving an MFA prompt, losing a device, or sending data to the wrong person.
☐ Run phishing or social engineering simulations where appropriate.
☐ Measure reporting rates, not only click rates.
☐ Avoid simulations that shame or embarrass employees.
☐ Run short practical drills for common scenarios.
☐ Include drills for suspicious emails, unexpected MFA prompts, payment fraud, lost devices, public file-sharing mistakes, and ransomware first actions.
☐ Run tabletop exercises for leadership, IT, finance, HR, operations, and other key teams.
☐ Include managers in reporting and escalation practice.
☐ Track exercise participation and findings.
☐ Turn simulation and exercise findings into improvement actions.
Training Evidence, Metrics, and Continuous Improvement Checklist
☐ Define what training evidence must be retained.
☐ Keep training plans, materials, attendance records, completion records, quiz results, acknowledgement forms, role-based training records, simulation results, tabletop records, and improvement actions.
☐ Track core training completion for all employees.
☐ Track onboarding cybersecurity training for new employees.
☐ Track role-based training separately.
☐ Track simulation, drill, and tabletop exercise results.
☐ Define useful training metrics.
☐ Track training completion rate.
☐ Track overdue training.
☐ Track role-based training completion.
☐ Track phishing simulation reporting rate.
☐ Track phishing simulation click rate.
☐ Track average time to report suspicious activity.
☐ Track number of employee security reports.
☐ Track number of real issues found through employee reporting.
☐ Track repeated training gaps.
☐ Track open and overdue training-related improvement actions.
☐ Review training metrics with leadership at least once per year.
☐ Protect training and simulation records from unnecessary access.
☐ Avoid using individual results to shame employees.
☐ Use metrics to improve training, reporting paths, and controls.
☐ Update training after incidents, near misses, repeated mistakes, new tools, new vendors, or new business processes.
Final Educate Section Outputs
☐ Security awareness owner assigned.
☐ Training audiences defined.
☐ Core employee training topics documented.
☐ Role-based training topics documented.
☐ High-risk teams identified.
☐ Annual training schedule created.
☐ Onboarding training defined.
☐ Offboarding security reminders included.
☐ Reporting channels defined.
☐ Employee reporting message written.
☐ Manager escalation guidance created.
☐ Phishing simulation or reporting practice plan created.
☐ Practical drill schedule created.
☐ Tabletop exercise plan created.
☐ Training completion tracker created.
☐ Training evidence storage location defined.
☐ Training metrics defined.
☐ Leadership reporting format created.
☐ Training improvement actions tracked.
☐ Training records protected.
☐ Training program review schedule created.
Objective
Educate should create safer behavior, faster reporting, and better decision-making.
The company should leave this section able to say:
“Our people know the risks tied to their roles, know how to report suspicious activity, practice common scenarios, and receive training that is tracked, reviewed, and improved over time.”