Email Security Training Template and Checklist
A ready-to-run email security program and the rollout checklist to go with it. Train every team to spot spoofing, bad attachments and payment fraud, then see who is actually covered.
Reviewed by Abhijit Rao, AVP & Business Head, India
- A seven-module email security program, with audience and coverage for each
- A rollout checklist mapped to your control framework
- A team readiness matrix that shows where phishing exposure is highest
- A simulation cadence and an annual refresher plan
What is inside
- A seven-module email security program, with audience and required coverage for each session.
- A 10-point rollout checklist you can map to your control framework and mark off as you go.
- A team readiness matrix that scores each team and shows where phishing exposure is highest.
- A simulation cadence and an annual refresher plan so awareness stays continuous.
Who it is for
Anyone who has to plan what people learn, and answer for whether it landed.
- L&D and training teams
- People managers and team leads
- Heads of function and department
- HR business partners
- Compliance and risk teams
- Onboarding and enablement teams
- Operations and delivery leads
- COOs and HR directors
How to use this template in 4 steps
- Pick your format. Download the PDF to share, the Word file to edit, or the Excel file to work in live. All three are free.
- Make it yours. Adapt the sections, fields and wording to your team, roles and process so it fits how you actually work.
- Put it to work. Fill it in, circulate it to stakeholders for sign-off, or roll it out to your team.
- Track and improve. Review it on a set cadence and refine it as your goals, roles and priorities change.
What is inside
- A seven-module email security program, with audience and required coverage for each session.
- A 10-point rollout checklist you can map to your control framework and mark off as you go.
- A team readiness matrix that scores each team and shows where phishing exposure is highest.
- A simulation cadence and an annual refresher plan so awareness stays continuous.
Adapt the modules and checklist to your own email security policy and control framework. This is a starting structure, not a substitute for your security team's requirements or your mail gateway configuration.
The training program template
Seven modules covering the email threats that actually cause incidents. Run the full set for new joiners, then use the refresher and role-specific modules through the year.
| Module | Audience | Duration | What it must cover |
|---|---|---|---|
| 1. Spoofing and impersonation | All staff | 25 min | Display-name spoofing, lookalike domains, mismatched reply-to addresses, and how a real sender can still be faked. |
| 2. Attachments and links | All staff | 25 min | Hovering before clicking, unexpected invoices and shared documents, macros, and safe ways to open or report. |
| 3. Reporting a suspicious email | All staff | 15 min | Using the Report Phish button, not forwarding or deleting, and why speed of reporting limits the damage. |
| 4. SPF, DKIM and DMARC for users | All staff | 20 min | What the authentication warnings in a client mean in plain language, and why external and unverified banners matter. |
| 5. Business email compromise | Finance, execs, PAs | 45 min | Fake payment and payroll changes, gift-card scams, and the out-of-band verification step for any money movement. |
| 6. Data and mistakes | All staff | 20 min | Wrong recipient, reply-all, auto-complete errors, and handling personal or confidential data over email. |
| 7. Annual refresher | All staff | 20 min | Updated lures, a recent anonymised incident, and a short knowledge check for evidence. |
Delivering the refresher and knowledge check through an LMS gives you dated completion per person and per team, the evidence an auditor or a cyber-insurer asks for.
The rollout checklist
Ten steps to get email security live and keep it continuous. Tick items to track your own progress, it stays in this browser. The download has the same list with an owner column.
- Baseline phishing simulation run before trainingThreat testingBefore launch
- New joiners trained within their first weekOnboardingPer hire
- Report Phish button rolled out to every mailboxReportingOngoing
- External-sender and unverified banners enabledMail gatewayOngoing
- Attachment and link handling covered in trainingThreat testingAnnual
- Payment-change verification step trained for FinanceFraud controlOngoing
- Phishing simulations scheduledThreat testingQuarterly
- Higher-risk roles given the business email compromise moduleRole-basedOngoing
- Completion tracked by team, not just company-wideGovernanceOngoing
- Annual refresher and knowledge check completedGovernanceAnnual
The most common gap is the last one. A company-wide 90 percent completion can still hide a whole team at zero, and that team is the way in.
Team readiness at a glance
The checklist tells you what is missing overall. This matrix tells you which teams are behind. Score each team on the five email behaviours that carry the most risk. In Excel the readiness and gaps calculate as you type.
| Team | People | Spoofing | Attachments | Reporting | Auth banners | Payment fraud | Ready |
|---|---|---|---|---|---|---|---|
| Engineering | 180 | 2 | 2 | 2 | 2 | 2 | 100% |
| Sales | 120 | 1 | 2 | 1 | 1 | 1 | 60% |
| Finance | 60 | 1 | 1 | 1 | 1 | 0 | 40% |
| Support | 90 | 2 | 1 | 2 | 1 | 1 | 70% |
| Executives / PAs | 25 | 2 | 1 | 1 | 0 | 1 | 50% |
| Coverage at required | 60% | 40% | 40% | 20% | 20% | 64% |
Finance is the exposure here: a gap on payment fraud in the exact team that authorises wires, which is precisely what business email compromise attacks aim for.
The annual email security calendar
| Timing | Action | Owner |
|---|---|---|
| On joining | Modules 1 to 4 in the first week, recorded. | L&D and IT |
| Monthly | Review simulation click and report rates, and completion by team. | Security |
| Quarterly | Run a phishing simulation with a fresh lure and a short follow-up nudge. | Security |
| For higher-risk roles | Business email compromise module for Finance, executives and PAs. | Security and L&D |
| Annual, all staff | Refresher module and knowledge check, tracked per team. | L&D |
| After any incident | Targeted micro-training on the specific lure that worked, fast. | Security |
How to run it
- Baseline with a phishing simulation
Send a realistic spoofed email before any training so you can show the change afterwards.
- Teach the tells, not just the theory
Display-name spoofing, lookalike domains, urgent payment requests and mismatched reply-to addresses, with real examples.
- Make reporting one click
Roll out a Report Phish button and train people to use it instead of deleting or forwarding.
- Give Finance a deeper module
Accounts payable and executives face business email compromise, so add a payment-verification module for them.
- Track completion by team
Roll it up per team so a non-compliant department is visible before an attacker finds it.
- Review the metrics monthly
Simulation click and report rates, completion by team, and time to report.
Frontline teams reach 45 percent-plus completion on Disprz when training is delivered in short, mobile modules, the format this program is built for.
Common mistakes this pack prevents
- Teaching people to spot a bad link but never giving them a one-click way to report it.
- A company-wide completion number that hides accounts payable at zero.
- Training everyone identically, when Finance and executives face targeted payment fraud.
- Relying on the mail gateway alone, so a spoofed email that slips through meets an untrained user.
- No dated records, so there is nothing to show an auditor or cyber-insurer after an incident.
Which format should you use?
| Format | Best for | What is inside | Editable | Size |
|---|---|---|---|---|
| Sharing and print | The full template, formatted to print or circulate | No | 55 KB | |
| Word | Editing the wording | Every section as editable text you can adapt | Yes | 86 KB |
| Excel | Filling it in live | The grid and fields set up as a working spreadsheet | Yes | 65 KB |
Questions people ask
Is email security training mandatory?
How often should email security training happen?
Do users really need to understand SPF, DKIM and DMARC?
Can I adapt the modules and checklist?
Do I have to fill the form three times?
Awareness is only a control if people finish it. That is the part we run.
Bring your teams to a 30-minute working session. We will show how Disprz delivers email security in short mobile modules and rolls completion up by team, so your next audit or board update is a two-minute export.