Security Awareness Program: How to Build One That Works

A security awareness program is an ongoing, managed effort to teach your workforce about security threats and the policies that address them. It is not a once-a-year video. ASIS describes security awareness as education that trains the workforce about security threats and the organization's policies and procedures for handling them. The programs that work set a baseline, train people by role, measure behavior and get reviewed every year. This guide shows how to build one for a small or mid-sized business, step by step.

TL;DR

A program is a managed process with an owner, a schedule, objectives and reporting. A single course is only one piece of it.
Start with a risk assessment and a baseline, then set SMART goals and train people by role and access.
Train new hires early, train everyone at least annually, and add short modules and simulated phishing in between.
Measure behavior (reports, clicks, incidents), not just completion rates.
Review the program at least once a year, and sooner after an incident or a major change.

What a security awareness program is, and what it is for
Build the program in seven steps
Security training topics to cover
How often to train, and in what formats
When rules require training
Measure behavior, not just completion
Keep the program current
Our perspective
Put a program in place with Collett Systems
FAQ
Sources

What a security awareness program is, and what it is for

Most people picture a security awareness program as the annual training video everyone clicks through. The guidance says it is more than that.

NIST SP 800-50 Rev. 1 treats a cybersecurity and privacy learning program as an organizational capability. It builds knowledge, awareness and understanding of risks, policies and legal or regulatory requirements. It also calls for continual evaluation and improvement. In other words, awareness is something you manage, with risk analysis, measurable objectives, reporting and leadership decisions behind it.

Awareness and training are also different jobs. A peer-reviewed article on workforce training explains that awareness seeks to change attitudes, while training gives employees the skills and tools to practice secure behavior. Its authors argue the goal should be real motivation and good habits rather than check-box compliance.

For a business owner, that gives you three practical goals:

Employees recognize common attacks such as phishing, scams and social engineering.
They know exactly what to do next, including who to tell and how fast.
Leadership can show, with evidence, that the risk is going down.

Build the program in seven steps

The federal guidance from NIST and the PCI Security Standards Council follow the same logic. Here it is in plain order.

1. Assess your risks and set a baseline

Before you pick content, find out where you stand. NIST points to a risk and needs assessment, your incident history, compliance obligations, existing policies, the employee groups you have and a baseline measurement. ASIS says effective programs begin by evaluating security risk in the organization's own operating environment.

A manufacturer with plant-floor systems and a law firm handling client funds face different threats. Your program should reflect that difference from day one.

The baseline can be simple: a phishing simulation to see how many people click and report, a short knowledge quiz, and a count of last year's security incidents and near misses. Without those numbers you cannot show improvement later. Our security assessment checklist is a good way to score where you stand before you design anything.

2. Get leadership behind it

NIST calls for support from leadership and other stakeholders early on. This is not a formality. Someone with authority has to approve time for training, back the reporting rules and review the results. If the owner skips the training, employees notice.

3. Define SMART objectives

NIST recommends goals that are specific, measurable, achievable, relevant and time-bound, so that results can be quantified. "Be more secure" is not an objective. These are:

Raise the share of suspicious emails reported (rather than ignored) within 12 months.
Have every new hire complete core training within their first month.
Cut repeat clicks on simulated phishing among the groups that click most.

Pick the numbers that fit your baseline. Those figures are examples of the form, not benchmarks.

4. Segment people by role and access

Not everyone needs the same lesson. The person who approves wire transfers, the shop-floor lead with a shared tablet and the receptionist who answers every call all face different attacks. NIST advises segmenting learners by role and access. Federal rules take the same view: 5 CFR 930.301 requires federal agencies to give role-specific training to users with significant security responsibilities, on top of awareness materials for every user.

For most small businesses, three groups are enough:

All staff: the core topics below.
Finance and administration: payment fraud, invoice changes, executive impersonation.
IT and administrators: privileged access, change control, incident handling.

5. Choose content and delivery methods

The next two sections cover topics and formats in detail.

6. Document ownership, schedule and tracking

Write down who owns the program, who must be trained, when, and how completion is recorded. The PCI guidance recommends tracking who completes training and when, and documenting how and when success will be measured. Documentation also matters if a customer, insurer or auditor asks to see it.

7. Report, review and revise

Share results with leadership, agree on corrective actions, and feed them into the next cycle. We cover this below under keeping the program current.

Security training topics to cover

What belongs in the curriculum depends on your risks, but the published standards agree on a core.

The ASIS standard lists the code of conduct, personnel security policies, workplace violence warning signs, travel security, access control and emergency procedures. Under IT security it lists password management, social engineering, scams, phishing and other online threats. The PCI Council's guidance adds strong passwords, secure email, remote-working practices, malware avoidance, secure browsing, mobile and personal-device security, and safe social media use.

For a business your size, a practical core looks like this:

Topic	What employees should be able to do	Who needs the deeper version
Phishing and email scams	Spot a suspicious message and report it in seconds	Everyone, finance first
Passwords and sign-in	Use unique passphrases and approve sign-ins only when they started them	Everyone, admins in depth
Social engineering and phone fraud	Verify unusual requests by a second channel	Reception, finance, executives
Remote work and mobile devices	Keep devices updated and avoid public Wi-Fi risks	Remote and field staff
Physical access	Challenge unknown visitors and secure sensitive areas	Plant, office and lab staff
Incident reporting	Know who to call and what not to touch	Everyone

Two topics deserve extra time because they cause real losses. The first is phishing, covered in our practical phishing training guide for small businesses. The second is payment and executive impersonation, covered in our walkthrough on catching business email compromise attacks in progress. If your staff handle technology-facing tasks, it also helps to connect training to broader practices, so employees see why their habits protect customers.

How often to train, and in what formats

The PCI guidance separates three kinds of training: new-hire, annual and ongoing. Expert Insights' 2026 buyer's guide gives the same rhythm: initial training for new employees, at least annual training for everyone, and regular bite-size modules and simulated phishing for continuous awareness. It adds that the schedule should reflect risk, industry, size, geography and regulatory requirements.

A schedule that works for most small and mid-sized businesses:

Within the first weeks of employment: core training before or soon after access is granted.
Annually: a full refresh for everyone, updated for current threats.
Monthly or quarterly: short modules or reminders, plus simulated phishing.
After an incident: a short targeted briefing for the people affected.

Vary the format too. ASIS recommends mixing written methods such as memos and posters, verbal methods such as meetings and online training, and hands-on methods such as simulations, exercises and contests. A 10-minute talk at a shift meeting about a real scam that hit a neighboring company often does more than another slide deck.

When rules require training

Some industries have explicit training mandates. A few examples from the research:

Hazardous materials shipping: 49 CFR 172.704 requires security-awareness training within 90 days for new hazmat employees and recurrent training at least every three years. This can apply to manufacturers that ship regulated materials.
Transportation security-sensitive employees: 49 CFR 1582.115 requires approved security training and bars performing a security-sensitive function for more than 60 calendar days without it.
Federal agencies: 5 CFR 930.301 requires a security-awareness and training plan and exposure of all information-system users to awareness materials at least annually.

Financial firms, dental and medical practices, and contractors serving larger customers often face contract or industry requirements as well. Check which apply to you, and write them into the program's scope. If you handle federal contract data, our NIST 800-171 self-assessment guide shows how to score yourself honestly.

Measure behavior, not just completion

Completion rates are easy to collect and easy to misread. A NIST study of U.S. government organizations found the most common measures were completion rates (84%), phishing-simulation click rates (72%) and audits or evaluations (67%). Fewer than 30% used attendance, surveys or online-material views. The same study warns that completion alone does not show effectiveness.

CISA's Training and Awareness resource guide says evaluation should be planned while training is designed. It should look at learning conditions, intended learning and actual behavior change. Combine several signals:

Signal	What it tells you
Completion and quiz scores	Whether people took the training and absorbed the basics
Phishing clicks and reports	Whether behavior is changing under realistic conditions
Time to report	How fast your team can respond to a real attack
Real incidents and policy violations	Whether risk is actually falling
Secure sign-in behavior	Whether people use multi-factor prompts correctly
Surveys and interviews	Where people are confused, and why

A rising report rate is often a better sign than a falling click rate, because it means people are paying attention and trust the process. Review results by group, too. An average hides the department that needs help.

Keep the program current

Threats change faster than a training library. NIST recommends reviewing the program at least annually and sooner after incidents, audit findings, major technology or policy changes, or new threats. A review should analyze incidents, risk trends, learner feedback, compliance changes and behavioral metrics. Then update content, role assignments, simulations, schedules and objectives, and get leadership approval.

NIST also recommends writing an assessment report, reviewing it with senior leadership, agreeing on changes and budget, and folding the revisions into your plans and schedules. The PCI guidance recommends annual review, threat and compliance updates, periodic reassessment against the baseline and staff feedback surveys. For a deeper look at how this lifecycle fits into formal risk governance, see this NIST risk management framework overview.

Our perspective

Most of the companies we meet already own some kind of training. What they lack is ownership. Nobody is responsible for the baseline, nobody reviews the numbers, and the training lives apart from the rest of IT.

We treat awareness as part of the managed stack, not an add-on. When we run IT for a client, we see the phishing attempts, the sign-in anomalies and the endpoint alerts. That is the real material for training. A lesson built on what hit your own inbox last month lands harder than a generic one.

Our approach is a standardized, fully-loaded stack with a fixed cost per user, so security training, monitoring and documentation do not turn into separate line items you have to defend. For manufacturers, financial firms, law offices and dental practices across Southeastern Wisconsin, that means the program gets run, measured and documented. It does not depend on someone remembering to schedule it.

Start with the baseline. Everything else gets easier once you know your starting number.

Dustin Collett

Put a program in place with Collett Systems

We offer security awareness training for employees as part of our cybersecurity work for small and mid-sized businesses in West Bend and across Southeastern Wisconsin. We have earned the trust of more than 150 local organizations. Our approach pairs training with 24/7 monitoring, proactive support and security management under fixed per-user pricing.

The fastest way to set your baseline is our IT & Security Assessment. If you want a quick first read, the free IT risk score takes about 60 seconds. When you are ready to run awareness, monitoring and support as one program, see our managed IT services.

FAQ

How is a security awareness program different from security awareness training?

Training is one part of the program. The program also includes risk assessment, objectives, role-based content, a schedule, tracking, measurement and annual review. NIST describes it as a managed capability with continual evaluation, rather than a single course.

How often should employees get security awareness training?

Give new hires training early, and give everyone at least annual training. Add short modules and simulated phishing between those sessions to keep awareness current. Adjust the schedule for your risk, industry and any regulatory requirements that apply to you.

What should a small business include first?

Start with phishing and email scams, passwords and sign-in habits, phone and payment fraud, remote and mobile device use, and a clear way to report anything suspicious. Add role-based content for finance staff and administrators. Then expand using your baseline results and incident history.

How do we know the program is working?

Track behavior as well as completion: phishing reports and clicks, time to report, real incidents and policy violations, and survey feedback. Compare each cycle with your baseline and review the results with leadership. NIST's research shows completion rates alone do not prove effectiveness.