Cyber Security Awareness Training Template and Checklist
A ready-to-run awareness program and the rollout checklist to go with it. Train every team, then see who is actually covered.
Reviewed by Madhu Karunakaran, VP, People & Culture
- A seven-module awareness program, with audience and coverage for each
- A rollout checklist mapped to your control framework
- A team readiness matrix that shows where coverage is thin
- A phishing-simulation cadence and an annual refresher plan
What is inside
- A seven-module security awareness program, with audience and required coverage for each session.
- A 10-point rollout checklist you can map to your control framework and mark off as you go.
- A team readiness matrix that scores each team and shows where coverage is thin.
- A phishing-simulation cadence and an annual refresher plan so awareness stays continuous.
Who it is for
Anyone who has to plan what people learn, and answer for whether it landed.
- L&D and training teams
- People managers and team leads
- Heads of function and department
- HR business partners
- Compliance and risk teams
- Onboarding and enablement teams
- Operations and delivery leads
- COOs and HR directors
How to use this template in 4 steps
- Pick your format. Download the PDF to share, the Word file to edit, or the Excel file to work in live. All three are free.
- Make it yours. Adapt the sections, fields and wording to your team, roles and process so it fits how you actually work.
- Put it to work. Fill it in, circulate it to stakeholders for sign-off, or roll it out to your team.
- Track and improve. Review it on a set cadence and refine it as your goals, roles and priorities change.
What is inside
- A seven-module security awareness program, with audience and required coverage for each session.
- A 10-point rollout checklist you can map to your control framework and mark off as you go.
- A team readiness matrix that scores each team and shows where coverage is thin.
- A phishing-simulation cadence and an annual refresher plan so awareness stays continuous.
Adapt the modules and checklist to your own security policy and control framework. This is a starting structure, not a substitute for your security team's requirements.
The training program template
Seven modules covering the threats that actually cause incidents. Run the full set for new joiners, then use the refresher and role-specific modules through the year.
| Module | Audience | Duration | What it must cover |
|---|---|---|---|
| 1. Phishing and social engineering | All staff | 25 min | Spotting phishing, spear-phishing and pretexting, with real examples and a safe way to report. |
| 2. Passwords and MFA | All staff | 20 min | Strong passphrases, a password manager, and why multi-factor authentication matters. |
| 3. Data handling | All staff | 25 min | Classifying data, safe sharing, and handling personal and confidential information. |
| 4. Devices and remote work | All staff | 20 min | Locking devices, safe Wi-Fi, updates, and reporting a lost device fast. |
| 5. Incident reporting | All staff | 15 min | What to report, how, and why speed beats blame. The report path drilled. |
| 6. Role-based deep dive | Finance, IT, execs | 45 min | Payment fraud, admin-access hygiene and executive targeting for high-value roles. |
| 7. Annual refresher | All staff | 20 min | Updated threats, a recent anonymised incident, and a short knowledge check for evidence. |
Delivering the refresher and knowledge check through an LMS gives you dated completion per person and per team, the evidence an auditor or a cyber-insurer asks for.
The rollout checklist
Ten steps to get awareness live and keep it continuous. Tick items to track your own progress, it stays in this browser. The download has the same list with an owner column.
- Baseline phishing simulation run before trainingThreat testingBefore launch
- New joiners trained within their first weekOnboardingPer hire
- MFA enforced and covered in trainingAccess controlOngoing
- Password manager rolled out and trainedAccess controlOngoing
- Data classification and handling policy acknowledgedData protectionOn change
- Incident reporting path published and drilledIncident responseQuarterly
- Phishing simulations scheduledThreat testingQuarterly
- Higher-risk roles given the deep-dive moduleRole-basedOngoing
- Completion tracked by team, not just company-wideGovernanceOngoing
- Annual refresher and knowledge check completedGovernanceAnnual
The most common gap is the last one. A company-wide 90 percent completion can still hide a whole team at zero, and that team is the way in.
Team readiness at a glance
The checklist tells you what is missing overall. This matrix tells you which teams are behind. Score each team on the five behaviours that carry the most risk. In Excel the readiness and gaps calculate as you type.
| Team | People | Phishing | Passwords / MFA | Data handling | Reporting | Devices | Ready |
|---|---|---|---|---|---|---|---|
| Engineering | 180 | 2 | 2 | 2 | 2 | 2 | 100% |
| Sales | 120 | 1 | 2 | 1 | 1 | 2 | 70% |
| Finance | 60 | 1 | 1 | 2 | 0 | 1 | 50% |
| Support | 90 | 2 | 2 | 1 | 2 | 1 | 80% |
| Frontline / field | 140 | 1 | 1 | 1 | 1 | 2 | 60% |
| Coverage at required | 40% | 60% | 40% | 40% | 60% | 72% |
Finance is the exposure here: weak on phishing and no incident-reporting drill, and Finance is exactly who payment-fraud attacks target.
The annual awareness calendar
| Timing | Action | Owner |
|---|---|---|
| On joining | Modules 1 to 5 in the first week, recorded. | L&D and IT |
| Monthly | Review simulation click and report rates, and completion by team. | Security |
| Quarterly | Run a phishing simulation and a short follow-up nudge. | Security |
| For higher-risk roles | Role-based deep dive for Finance, IT and executives. | Security and L&D |
| Annual, all staff | Refresher module and knowledge check, tracked per team. | L&D |
| After any incident | Targeted micro-training on the specific failure, fast. | Security |
How to run it
- Baseline with a phishing simulation
Run one before any training so you can show the change afterwards.
- Set the cadence, not just the launch
New joiners in week one, an annual refresher for all, and simulations every quarter.
- Segment by risk
Finance, executives and IT admins are higher-value targets and need deeper modules.
- Track completion by team
Roll it up per team so a non-compliant department is visible before an attacker finds it.
- Drill incident reporting
The goal is not zero clicks, it is fast reporting. Make the report path muscle memory.
- Review the metrics monthly
Simulation click and report rates, completion by team, and time to report.
Frontline teams reach 45 percent-plus completion on Disprz when training is delivered in short, mobile modules, the format this program is built for.
Common mistakes this pack prevents
- One annual slideshow and nothing else, so awareness fades within weeks.
- A company-wide completion number that hides a whole team at zero.
- Training everyone identically, when Finance and executives face targeted attacks.
- Measuring clicks but not reporting speed, which is what actually limits damage.
- No dated records, so there is nothing to show an auditor or cyber-insurer.
Which format should you use?
| Format | Best for | What is inside | Editable | Size |
|---|---|---|---|---|
| Sharing and print | The full template, formatted to print or circulate | No | 55 KB | |
| Word | Editing the wording | Every section as editable text you can adapt | Yes | 86 KB |
| Excel | Filling it in live | The grid and fields set up as a working spreadsheet | Yes | 65 KB |
Questions people ask
Is security awareness training mandatory?
How often should security awareness training happen?
Can I adapt the modules and checklist?
Does the Excel tracker work in Google Sheets?
Do I have to fill the form three times?
Awareness is only a control if people finish it. That is the part we run.
Bring your teams to a 30-minute working session. We will show how Disprz delivers security awareness in short mobile modules and rolls completion up by team, so your next audit or board update is a two-minute export.