Security awareness training and phishing simulations for agency staff

Reference article · 5 min read

A training requirement usually arrives from somewhere else. An audit finding, a cyber insurance renewal questionnaire, a grant condition, or an updated statewide policy lands on IT or HR, and the fastest path to compliance is to buy a video library, assign one annual course, and record the completions. It rarely changes what a payroll clerk does at 4:45 on a Friday when a message arrives saying a vendor's bank account has changed.

A program that changes behavior is short and frequent rather than annual, gives different content to different roles, uses simulated phishing to coach rather than to catch, and rewards reporting. The records auditors and insurers ask for fall out of such a program as a byproduct.

Where the requirement comes from

Most agencies are covered by more than one source: the FBI CJIS Security Policy for staff with access to criminal justice information, IRS Publication 1075 for agencies receiving federal tax information, the HIPAA Security Rule for workforce members handling protected health information, and PCI DSS for staff who touch cardholder data. Statewide security policies and grant conditions add obligations, and insurance applications ask about training frequency, simulation, and privileged users. These documents are revised and differ on audience and recordkeeping, so confirm current text with the issuing authority or counsel.

Short and recurring instead of one annual sitting

People absorb one behavior at a time. A few minutes each month or quarter, each covering a single topic, beats a long course completed once and forgotten. Keep the annual course for policy acknowledgment and the formal record, and carry the teaching load in the short sessions. Teach from real mail: examples pulled from your own reporting mailbox, with names removed, land better than stock scenarios.

Role based content for the staff attackers target

Finance and accounts payable. Teach the procedure, not just the warning signs: verify any change to banking details by calling a number already on file, never one supplied in the message, and require a second approver. Urgency and secrecy are the cue to slow down.
Human resources and payroll. Direct deposit changes, personnel record requests, and attachments that arrive as resumes.
Privileged administrators. Repeated multi-factor prompts, help desk impersonation aimed at a password reset, consent prompts from unfamiliar applications, and approaches by text message.
Clerks, permit counters, and records staff. They open mail from strangers by design, so instincts built on recognizing a sender do not help. Focus on link and attachment handling.

Simulations that teach rather than punish

A simulation program that feels like a trap produces resentment and quiet non-reporting, which is worse than no program at all.

Announce the program before it starts and publish the rules, including that results drive training rather than discipline.
Start easy and increase difficulty. The point is a gradient over time, not a high failure rate on day one.
Avoid lures that damage trust. Fake bonuses, benefit terminations, and messages exploiting a real emergency cost more in goodwill than they teach.
Land on a coaching page that explains the cues that were present and what to do next.
Coordinate each campaign with the help desk, communications, and dispatch, and avoid periods of operational stress. Handle repeat clicks as coaching, escalating only under a policy HR and counsel have reviewed.

An easy report button and the numbers worth tracking

Put a one click report button in the mail client on desktop, web, and mobile, and use the same button for simulated and real mail. Route reports to a monitored queue with a defined response time, acknowledge every report, and never make someone feel foolish for a false alarm. Then measure reporting, not only clicking:

Reporting rate and time to first report, which decide how fast you can pull a live campaign out of other inboxes.
Click rate and the narrower credential submission rate, which are different problems.
Repeat clickers as a coaching list, not a discipline list.

Report trends to leadership and avoid public department rankings, which teach people to hide mistakes.

Covering officials, part time staff, and contractors

Elected officials and board members often sit outside HR onboarding and use personal email. Offer a short briefing after each election cycle and make it easy to accept.
Part time, seasonal, and volunteer staff, including seasonal crews, volunteer firefighters, and election workers, need training tied to account creation with a firm deadline.
Contractors with agency accounts belong in the contract: require agency training or documented equivalent training, permit their inclusion in simulations, and set offboarding terms.
Reconcile the training roster against the identity directory and HR system so anyone holding an account is counted.

Records, vendor questions, and how to start

Auditors and insurers generally want completion records by person with dates, coverage against the current roster, topics covered, the policy in force and its acknowledgment, campaign summaries, and documentation of exceptions. Keep these under your retention schedule and confirm you can export them yourself. Questions worth asking before you buy:

Does the report button work on our mail platform across desktop, web, and mobile?
Can content be assigned by role, and can we insert our own procedures?
What is the accessibility conformance, and are captions, transcripts, and other languages included?
How are users counted and priced, and how are seasonal staff and contractors handled?
What is exportable, and what happens to our data at contract end?

To start, write down which requirements apply, get a clean roster of everyone with an account, turn on the report button and staff the queue before any simulation, take a quiet baseline, publish the rules, then set the cadence and role assignments.

HQT helps state and local agencies design awareness programs, simulation rules of engagement, and the records that follow.

Frequently asked questions

How often is security awareness training required for government employees?

It depends on which requirements apply to your agency. The CJIS Security Policy, IRS Publication 1075, the HIPAA Security Rule, and statewide information security policies each set their own expectations, and many agencies meet them with an annual course plus shorter recurring sessions through the year. These documents are revised over time, so confirm the current requirement with the issuing authority or your counsel rather than relying on a vendor's summary.

Do elected officials, part time staff, and contractors have to take the training?

Anyone holding an agency account or handling protected data generally falls within the same requirements, but officials and part time staff are often missed because they sit outside normal HR onboarding. Contractors are best handled in contract language that requires either agency training or documented equivalent training and permits their inclusion in simulations. Reconciling the training roster against the identity directory is the practical way to catch everyone with an account.

Are phishing simulations allowed for public sector employees?

Simulations are common in state and local government and insurers frequently ask about them, but the rules should be written before the first campaign. Coordinate with HR, counsel, and any union representation, publish how results will be used, and state plainly that outcomes drive coaching rather than discipline. Avoid pretexts involving pay, benefits, layoffs, or a real emergency, since those damage trust more than they teach.

What training records do auditors and cyber insurers ask for?

Typically completion records by individual with dates, coverage against the current roster, the topics covered, the policy in force and its acknowledgment, simulation campaign summaries, and documentation of exceptions and how they were resolved. Keep these under your records retention schedule. Confirm during procurement that you can export the records yourself rather than depending on the vendor to produce them at audit time.

Is click rate the right measure for a phishing simulation program?

Click rate alone rewards a quiet workforce that notices nothing and says nothing. Track the reporting rate and the time to first report alongside it, because fast reporting is what lets your team pull a live campaign out of other inboxes. It also helps to separate the narrower credential submission rate from clicks, since those are different problems with different fixes.