Most organisations buy a training library, assign the annual course and spend the last month of the year chasing stragglers. That produces a certificate for every employee and very little change in behaviour. A security awareness programme that actually reduces risk runs all year. It starts from the threats your own people face, gives developers, administrators, finance staff and executives training that fits their work, uses phishing simulations to measure what people do rather than what they remember, and reviews the results before planning next year. This free security awareness training checklist gives security and GRC teams that annual cycle in six phases, from needs assessment to leadership sign-off. It follows the life cycle in NIST SP 800-50 Rev. 1 and produces the evidence ISO 27001, PCI DSS, SOC 2 and HIPAA reviewers ask for, without turning the programme into a box-ticking exercise.
NIST rewrote its guidance on this subject in September 2024. SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program, replaced both the 2003 awareness guide and the 1998 role-based training model in SP 800-16. The new version treats the programme as a managed life cycle with four phases: plan and strategy, analysis and design, development and implementation, and assessment and improvement. It puts behaviour change at the centre. One of its example metrics is the share of people who received a simulated phishing email and reported it, rather than how many finished a module.
It is also clear about how simulations should be run. Tell staff that phishing exercises happen, involve your legal team in designing them, avoid using real brands as bait, and never single out individuals or punish them for clicking. A programme built on those rules produces honest data, and the data tells you where to spend next year’s training time.
Content: the same generic library modules for every role.
Measure: completion percentage by the deadline.
Phishing tests: occasional, with clickers named or sent to remedial training.
Result: an audit trail, but little evidence of lower risk.
Content: a common baseline plus role-based modules for higher-risk jobs.
Measure: reporting rate, time to report and real incidents flagged by staff.
Phishing tests: regular, announced in principle and never punitive.
Result: the audit trail plus a trend you can show the board.
Six phases cover one programme year. The phishing and escalation tasks appear only when the answers call for them.
Owned by the security awareness lead. Task 5 decides whether the phishing simulation tasks in Phase 4 are shown this year.
The finished plan is approved by the programme sponsor, usually the CISO.
Switches on when Phase 1 records that simulations will run this year.
Task 4 appears only if completion is still below target at the deadline.
The annual review is signed off by the sponsor and closes the programme year.
Almost every security framework requires awareness training, but they differ on frequency, topics and evidence. The table sets out the main references and where the checklist produces the proof. Your obligations depend on your sector and certifications, so treat it as a starting point, not legal or audit advice.
| Framework | Reference | What it expects | Evidenced in |
|---|---|---|---|
| NIST SP 800-50 Rev. 1 (September 2024) | Programme life cycle | Plan and strategy, analysis and design, development and implementation, assessment and improvement, with metrics that show behaviour change | Phases 1–6 |
| ISO/IEC 27001:2022 | A.6.3 | Personnel and relevant interested parties receive awareness, education and training, and regular updates on policies relevant to their job | Phases 2, 3 and 5 |
| PCI DSS v4.0.1 | 12.6.1–12.6.3.2 | A formal programme reviewed at least once every 12 months; training on hire and at least once every 12 months; annual policy acknowledgement; phishing and social engineering; acceptable use of end-user technologies | Phases 2, 3 and 6 |
| HIPAA Security Rule | 45 CFR 164.308(a)(5) | A programme for the whole workforce, including management; addressable specifications cover security reminders, malicious software, log-in monitoring and password management | Phases 2–3 |
| SOC 2 (2017 TSC, revised points of focus 2022) | CC1.4, CC2.2 | A commitment to developing competent people; a CC2.2 point of focus calls for a security awareness training programme to improve knowledge and model good behaviour | Phases 2, 3 and 5 |
| CIS Controls v8.1 | 14.1–14.9 | Training at hire and at least annually, content reviewed annually, specific topics from social engineering to insecure networks, and role-specific training | Phases 1–3, 6 |
| NIS2 Directive (EU) 2022/2555 | Art. 20(2), 21(2)(g) | Management bodies must follow cybersecurity training; basic cyber hygiene and cybersecurity training are among the required risk management measures | Phases 2–3 |
HHS proposed changes to the HIPAA Security Rule in January 2025, including more prescriptive training requirements. As of September 2026 they had not been finalised, and HHS’s regulatory agenda pointed to 2027, so the table reflects the current rule. Each framework in the table has its own checklist: the PCI DSS 4.0 Compliance Checklist, the SOC 2 Readiness Checklist, the NIS2 Compliance Checklist and the NIST CSF 2.0 Checklist. UK organisations can pair the programme with the Cyber Essentials Certification Checklist.
A recurring schedule opens the new programme year on the same date every year, with Phase 1 assigned to the awareness lead and due dates set for each phase. The annual review cannot slip quietly into the following spring.
Conditional logic hides the phishing phase in a year you decide not to run simulations, and adds the sponsor escalation only when completion misses its target. The checklist stays as long as the year actually requires.
Completion reports, policy acknowledgements, campaign results and the signed annual review sit on the tasks that produced them, with the name and date of each completion. When an auditor asks for last year’s programme, you export it.
CheckFlow is not a learning management system or a phishing simulation platform. It runs the planning, approvals, chasing and review around them, and holds the evidence those tools produce. CheckFlow’s compliance checklist software shows how this programme sits alongside the other annual controls in your compliance calendar.
Training on hire works best when it is a task in the onboarding process rather than a separate reminder. The Employee Onboarding Checklist is the place to add it. For executives, the most effective awareness session is often a scenario: the Incident Response Tabletop Exercise Checklist shows how to run one.
Training completion and phishing results are part of the evidence an annual IT Security Audit Checklist reviews, so the completion export from Phase 5 does double duty.
A baseline for everyone covering social engineering and phishing, passwords and multi-factor authentication, handling sensitive data, reporting incidents and acceptable use of devices. On top of that, role-based training for people whose jobs carry extra risk, such as administrators, developers, finance staff and executives. Around the content you need training on hire, an annual refresher, regular short reminders, a way to measure behaviour, and a yearly review of what worked.
On hire and at least once a year is the most common expectation. PCI DSS v4.0.1 requirement 12.6.3 sets exactly that for personnel, and CIS Controls v8.1 safeguard 14.1 asks for training at hire and at a minimum annually. ISO 27001 and HIPAA do not fix a frequency, so the annual cycle is usually what organisations adopt and auditors expect to see. Short monthly reminders between annual courses help keep the topics current.
NIST SP 800-50 Rev. 1 advises against it. It recommends treating phishing exercises as learning opportunities, not singling people out, and telling staff that simulations happen. Punishment discourages the behaviour you most want: people reporting suspicious messages quickly, including ones they have already clicked. Extra support for repeat clickers works better than sanctions.
Completion shows the programme was delivered, not that it worked. Better signals are the percentage of people who report a simulated phishing email, how quickly the first report arrives, the number of real incidents raised by staff and whether human-error incidents fall over time. Track them year on year in the Phase 6 review rather than judging a single campaign.
If they have access to your systems or data, they should be in scope. ISO 27001 control A.6.3 extends to relevant interested parties as well as personnel, and auditors commonly expect contractors and temporary staff with system access to appear in the training records. The checklist enrols contractors and temporary staff alongside employees and records any approved exceptions.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
