Cybersecurity
Security Awareness Programs
Training that staff actually remember, measured by behavior rather than attendance.
What this covers
Most incidents start with a person: a clicked link, a reused password, a wire transfer request that looked legitimate. A good awareness program changes behavior and gives staff a simple way to report suspicious activity.
Typical activities
- Role-based training for general staff, finance, HR, executives, and IT
- Phishing simulation campaigns with coaching rather than punishment
- Short, regular communications instead of one annual session
- Reporting mechanisms such as a report-phishing button
- Metrics on click rates, report rates, and time to report
- Content aligned to CJIS and HIPAA training requirements where applicable
What you receive
A program plan, training content, campaign results, and reporting suitable for leadership and auditors.
Why it matters
Awareness programs are inexpensive relative to nearly every other control and are required by several compliance regimes. Done well, they also give the security team an early warning network across the whole agency.
Signals that an existing program needs rework
- Completions cluster in the last days of the assignment window, and the same people are late every cycle.
- The assignment roster is built from a spreadsheet rather than the directory, so seasonal staff, volunteers, poll workers, contractors, and elected officials are missing from it.
- Finance or payroll has acted on a vendor banking change or a direct deposit change that arrived by email alone.
- Simulated mail is delivered through a blanket transport rule that bypasses filtering, so the results describe conditions staff never face.
- An insurance questionnaire or an audit asked for per-person training records and assembling them took weeks.
- Suspicious messages reach the help desk as screenshots or forwarded attachments, with no consistent path into whatever queue triages them.
How simulation design goes wrong
Themes that impersonate layoffs, bonus payments, benefits changes, or a named employee produce a low click rate and a durable trust problem, and in a unionized workforce they can produce a grievance. Reusing the same template quarter after quarter produces improvement that reflects familiarity rather than skill, so record a difficulty rating with each campaign and compare like with like. Circulating a list of repeat clickers to supervisors suppresses the reporting the program is trying to build. Running more campaigns than the team can respond to teaches staff that reporting goes nowhere. Lures should mirror the mail the agency actually receives: vendor banking changes, payroll diversion, multifactor approval prompts, gift card requests sent to department heads, attachments dressed as public records requests, and messages aimed at counter and permitting staff.
Fitting the mail platform, directory, and LMS you already have
Microsoft 365 and Google Workspace each document a supported configuration for delivering third-party phishing simulations without turning protections off. Using that path rather than a transport rule keeps filtering intact for genuine mail and keeps campaign results comparable to real conditions. Decide before the first campaign where reported mail lands, whether that is a shared mailbox with a named owner, an internal security team, or a managed detection provider, and route what turns out to be malicious back into filter tuning and block lists.
Most agencies already run a learning management or HR training system for harassment prevention and safety courses. Delivering awareness content into it in a package format that system already accepts, such as SCORM, usually beats standing up a second portal with separate credentials, and it keeps completion evidence where auditors are used to finding it. Assignment accuracy depends on directory hygiene, so account cleanup for contractors, seasonal hires, and departed employees belongs in the scope. Where CJIS, HIPAA, IRS Publication 1075, or PCI DSS obligations apply, settle early which system holds the records a reviewer will ask to see.
What to specify in a solicitation or contract
- Cadence and volume: campaigns per year, minutes of content by role, and how often results are reported to leadership.
- Template governance: the agency approves themes in advance and may prohibit categories such as layoffs, benefits, or compensation outright.
- Accessibility: modules and simulation landing pages conforming to WCAG 2.1 Level AA, with captions, transcripts, and keyboard and screen reader testing. The Department of Justice rule under Title II of the Americans with Disabilities Act adopts that standard for the web content and mobile applications of state and local government entities, with compliance dates that depend on the size of the entity.
- Data handling: who holds per-employee click and completion data, how long it is kept, whether it is deleted at contract end, and whether it may be used in personnel actions. Settle that last question with counsel and human resources, and notify bargaining units where that is required.
- Records: state whether campaign results are agency records under your state public records act, and identify any security exemption you intend to rely on.
- Exit terms: raw campaign exports, per-person training history retained as audit evidence, and ownership of content the agency paid to have customized.
Working with HQT on this
HQT scopes this kind of work as a fixed-price or time-and-materials engagement with a written statement of work, named staff, and a defined acceptance process. We are candid about what we can take on and prefer a well-run project to an oversized one. Contact us to discuss a requirement, a draft scope, or an upcoming solicitation.
Frequently asked questions
How often do government employees need security awareness training?
It depends on which regimes cover the agency, so start by listing them. PCI DSS and IRS Publication 1075 state an annual expectation for the personnel in scope, the CJIS Security Policy carries its own awareness training requirement for people with access to criminal justice information, and the HIPAA Security Rule calls for a security awareness and training program with periodic reminders rather than naming an interval. Check the current version of each policy that applies to you, since intervals and role definitions change between revisions. Compliance intervals and behavior change are separate questions, and the annual module is rarely the part that changes behavior.
Are phishing simulation results public records?
It depends on your state public records act and on what the agency chose to keep. Per-employee results can implicate personnel record provisions, and many states exempt records that would reveal security vulnerabilities or procedures, though the wording and scope vary. Decide with counsel before the first campaign whether you will retain individual results at all or only aggregate figures, then write that decision into the vendor contract and your retention schedule.
Should employees be disciplined for failing a phishing test?
Coaching is the safer default. Discipline attached to simulation clicks tends to suppress reporting, and where a collective bargaining agreement applies it can raise labor issues. If repeated clicks are going to carry consequences, put that in policy before the first campaign, apply it consistently, and give notice to bargaining units where that is required. A click that gets reported quickly is recoverable, so the policy should reward the report rather than only penalize the click.
Does a commercial awareness platform satisfy CJIS training requirements?
Not automatically. The CJIS Security Policy sets security awareness training requirements for personnel with access to criminal justice information, and your state CJIS systems agency can add content, timing, or recordkeeping requirements on top of them. Ask a vendor to map its modules to the specific policy areas and roles rather than accepting a general claim of alignment. Confirm as well that completion records can be produced in the form your state auditor expects.
How do we measure whether an awareness program actually worked?
Compare campaigns of similar difficulty and look at behavior rather than completion percentages. The measures worth tracking are the share of suspicious mail that gets reported, how long the first report takes, how the repeat-click population changes over consecutive campaigns, and how many real campaigns were contained because someone reported them. An easy template flatters every one of those numbers, which is why difficulty has to be recorded alongside the results. Finance and payroll deserve a separate measure, such as near misses caught by a call-back procedure before money moved.