Security Awareness Training Template and Checklist
A ready-to-run awareness program built as a rolling campaign, not a one-off course. Keep every team engaged, then see who is actually paying attention.
Reviewed by Abhijit Rao, AVP & Business Head, India
- A seven-module rolling awareness program, with audience and cadence for each
- A program checklist covering culture, reporting and champions
- A team readiness matrix that shows where engagement is thin
- A monthly topic calendar and a security champions plan
What is inside
- A seven-module rolling awareness program, with audience and cadence for each topic.
- A 10-point program checklist covering culture, reporting, champions and governance.
- A team readiness matrix that scores each team on engagement, not just completion.
- A monthly topic calendar and a security champions plan so the program never goes cold.
Who it is for
Anyone who has to plan what people learn, and answer for whether it landed.
- L&D and training teams
- People managers and team leads
- Heads of function and department
- HR business partners
- Compliance and risk teams
- Onboarding and enablement teams
- Operations and delivery leads
- COOs and HR directors
How to use this template in 4 steps
- Pick your format. Download the PDF to share, the Word file to edit, or the Excel file to work in live. All three are free.
- Make it yours. Adapt the sections, fields and wording to your team, roles and process so it fits how you actually work.
- Put it to work. Fill it in, circulate it to stakeholders for sign-off, or roll it out to your team.
- Track and improve. Review it on a set cadence and refine it as your goals, roles and priorities change.
What is inside
- A seven-module rolling awareness program, with audience and cadence for each topic.
- A 10-point program checklist covering culture, reporting, champions and governance.
- A team readiness matrix that scores each team on engagement, not just completion.
- A monthly topic calendar and a security champions plan so the program never goes cold.
Adapt the topics and checklist to your own security policy and control framework. This is a starting structure, not a substitute for your security team's requirements.
The training program template
Seven modules that build a security culture rather than tick a compliance box. Run them as a rolling campaign, one theme at a time, so awareness stays warm through the year.
| Module | Audience | Duration | What it must cover |
|---|---|---|---|
| 1. Why security is everyone's job | All staff | 15 min | The human role in incidents, real stories, and how one habit protects the whole team. |
| 2. Social engineering and manipulation | All staff | 25 min | Pretexting, urgency and authority tricks, both online and over the phone or in person. |
| 3. Clean desk and physical security | All staff | 15 min | Tailgating, locked screens, visitor badges, and keeping sensitive paper out of sight. |
| 4. Acceptable use and safe habits | All staff | 20 min | Approved tools, safe browsing, personal devices, and what not to put in public apps. |
| 5. Reporting and speaking up | All staff | 15 min | The one reporting channel, what to report, and why speed beats blame every time. |
| 6. Security champions playbook | Champions | 40 min | How champions nudge their team, escalate fast, and feed real events back to security. |
| 7. Annual refresher | All staff | 20 min | Updated threats, a recent anonymised near miss, and a short knowledge check for evidence. |
Delivering the rolling topics through an LMS gives you dated completion and engagement per person and per team, the evidence an auditor or a cyber-insurer asks for.
The program checklist
Ten steps to run awareness as a program, not a one-off. Tick items to track your own progress, it stays in this browser. The download has the same list with an owner column.
- Monthly awareness topic planned and scheduledCampaignMonthly
- New joiners onboarded to the program in week oneOnboardingPer hire
- Reporting channel published and made easy to findReportingOngoing
- Every report acknowledged, no blame attachedCultureOngoing
- Acceptable use policy acknowledged by all staffGovernanceOn change
- Clean desk and physical security coveredPhysicalAnnual
- Security champion named in each teamChampionsOngoing
- Executives and high-risk roles given tailored nudgesRole-basedQuarterly
- Engagement tracked by team, not just company-wideGovernanceOngoing
- Annual refresher and knowledge check completedGovernanceAnnual
The most common gap is the last one. A company-wide 90 percent completion can still hide a team that never reports anything, and silence is not the same as safety.
Team readiness at a glance
The checklist tells you what is missing overall. This matrix tells you which teams are actually engaged. Score each team on the five behaviours that carry the most risk. In Excel the readiness and gaps calculate as you type.
| Team | People | Vigilance | Reporting | Policy | Physical | Champion | Ready |
|---|---|---|---|---|---|---|---|
| Engineering | 180 | 2 | 2 | 2 | 2 | 2 | 100% |
| Sales | 120 | 1 | 1 | 2 | 1 | 0 | 50% |
| Finance | 60 | 2 | 1 | 1 | 1 | 1 | 60% |
| Support | 90 | 1 | 2 | 1 | 2 | 1 | 70% |
| Marketing | 70 | 1 | 0 | 1 | 1 | 1 | 40% |
| Coverage at required | 40% | 40% | 40% | 40% | 20% | 64% |
Marketing is the quiet risk here: no champion and no reporting activity, and a team that never reports is a team you have no signal from.
The monthly topic calendar
| Timing | Action | Owner |
|---|---|---|
| On joining | Program intro and the reporting channel in the first week, recorded. | L&D and Security |
| Monthly | Publish the topic of the month and a short nudge, tracked per team. | Security awareness |
| Monthly | Review completion and reporting rates by team. | Security |
| Quarterly | Champions sync to share what their teams are seeing. | Security and champions |
| Annual, all staff | Refresher module and knowledge check, tracked per team. | L&D |
| After any near miss | Turn the event into next month's topic, fast. | Security awareness |
How to run it
- Plan a topic per month
A rolling calendar of short topics beats one long annual course that fades in weeks.
- Make reporting effortless
One obvious channel, a fast response, and thanks for every report so people keep using it.
- Recruit champions per team
A named person in each team carries the message further than any central campaign.
- Segment the message
Finance, executives and new joiners face different pressures and need tailored nudges.
- Track engagement by team
Watch completion and reporting rates per team so a quiet department is visible early.
- Refresh from real events
Turn each near miss into next month's topic so the program stays grounded in reality.
Frontline teams reach 45 percent-plus completion on Disprz when training is delivered in short, mobile modules, the format this program is built for.
Common mistakes this pack prevents
- One long annual course and nothing else, so awareness fades within weeks.
- Measuring completion but never engagement, so a silent team looks compliant.
- A reporting channel that is slow or blames people, so reports quietly stop.
- No champions, so the whole program leans on one central team with no reach.
- No dated records, so there is nothing to show an auditor or cyber-insurer.
Which format should you use?
| Format | Best for | What is inside | Editable | Size |
|---|---|---|---|---|
| Sharing and print | The full template, formatted to print or circulate | No | 54 KB | |
| Word | Editing the wording | Every section as editable text you can adapt | Yes | 86 KB |
| Excel | Filling it in live | The grid and fields set up as a working spreadsheet | Yes | 65 KB |
Questions people ask
Is security awareness training mandatory?
How is a program different from a single awareness course?
What are security champions and do I need them?
Can I adapt the topics and checklist?
Do I have to fill the form three times?
Awareness is only a control if people stay engaged. That is the part we run.
Bring your teams to a 30-minute working session. We will show how Disprz delivers a rolling awareness program in short mobile modules and rolls engagement up by team, so your next audit or board update is a two-minute export.