[Insert Letterhead] Last Updated:
[Organization Name]
Employee Awareness Training
Plan
Disclaimer
Instructions: CyberSecure Canada has developed this template for your use in relation to certification
requirements for the Provide Employee Awareness Training security control area. It provides guidance as to how
information can be organized and documented for certification. CyberSecure Canada does not guarantee a
successful certification from use of this template. Organizations are not obliged to use this template and may
provide the certification requirement(s) in a documented format best suited for them.
Provide Employee Awareness Training
[Insert Letterhead] Last Updated:
Template instructions
Instructions: The purpose of this template is to help users to meet the certification requirements for the
Provide Employee Awareness Training security control area for CyberSecure Canada.
Instructions are provided in blue font within each section of this template. Upon completion of the template,
delete these instructions.
It is recommended that users review the eLearning module for the Provide Employee Awareness Training
and the completed example of this plan. Instructions end.
Overview
Instructions: Your training plan should include the following sections:
1. Employee awareness training policies
a. The employee awareness training policies outline the mandatory training, role-specific
training, and the frequency at which training needs to be administered.
2. Employee awareness training record
a. The employee awareness training record keeps track of employee training, the type of
training, and when the training is scheduled or was completed.
3. Employee awareness training outline
a. The employee awareness training outline is a sample outline for a learning activity. It
includes time for ice breakers, the specific topics that will be covered in training, and
assorted other activities. This outline can be used to standardize training within an
organization.
4. Appendix - Employee awareness training materials
a. The employee training materials will be provided during training and are meant to
support learning and retention of key concepts.
Employee awareness training policy
Revision history
Instructions: It is a best practice for organizations to ensure their policies are reviewed and updated
regularly. Document what changes are made, when, and by whom.
The Employee Awareness Training plan has been modified as follows:
Date Version Modification Modifier
[Date edited] [Document [Description of changes made] [Name of the editor]
version]
Provide Employee Awareness Training
[Insert Letterhead] Last Updated:
Policy statements
Purpose and scope
Instructions: Insert your scope statement or use the example provided.
The purpose of this policy is to provide training to [Organization Name] employees as it relates to its
Cybersecure policies and guidelines. It encompasses scheduled training, plus mandatory and role-
specific training as it relates to cyber security training.
Scheduled training
Instructions: Determine how often training will be provided.
There is [Frequency] scheduled employee training of [Organization Name]’s policies, provisions , or
other identified elements requiring training.
An employee awareness training record will be established, maintained, and updated to reflect any
changes, updates, or rescheduled training.
Mandatory training
Instructions: Insert the subjects/areas in which staff must undergo mandatory training. If appropriate,
you can use the example below.
All staff at [Organization Name] must undergo the following training:
1. Creating safe and secure passwords
2. Using the internet and social media safely
3. Using only approved software and apps on workplace devices
4. How to identify malicious links and phishing emails
Role dependant training
Instructions: Identify the roles in your organization and the mandatory training and frequency of
training required.
All staff at [Organization Name] acting in the following roles must undergo the stated training:
Role Training Frequency
Provide Employee Awareness Training
[Insert Letterhead] Last Updated:
Enforcement
Instructions: Identify who in your organization will be responsible for enforcing and developing an
enforcement statement. If appropriate, you can use the example below.
It is the responsibility of [Organization Name] to recognize when mandatory and role dependent training is
necessary for employees and provide the relevant employees with the required training.
Provide Employee Awareness Training
[Insert Letterhead] Last Updated:
Employee awareness training record
Instructions: Document the training undertaken by employees.
Role Training Topics Scheduled Staff Completed Date of
completion
Provide Employee Awareness Training
[Insert Letterhead] Last Updated:
Employee awareness training outline
Instructions: Create an outline for your training plan. If appropriate, you can use the example below and
update it as necessary for your organization.
Element Tim Description
e
(min
.)
Introducti 3:00 Welcome participants to the program. If they are unfamiliar with the location,
on explain where the washrooms and the fire exits are. Let participants know how
long the training is and what they are to do at the end (for example, go to lunch,
return to work, etc.). Ensure attendance is documented.
Ice 5:00 An activity to introduce participants to each other (if they are not already
Breaker familiar). This is also a good time to mention an interesting or dramatic fact
about the topic you are covering that day to get their attention and set the stage
for how important the topic is.
Learning 2:00 Explain the learning objectives for the session, and what participants are
Objectives expected to take away. Cover any policies relevant to the learning objectives.
At minimum, the training program must cover:
Creating safe and secure passwords
Using the internet and social media safely
Using only approved software and apps on workplace devices
How to identify malicious links and phishing emails
Explanatio 5:00 Review the content they will need to know in order to successfully complete the
n* per upcoming activities. Do they need to understand password security? Safe use of
topic the internet? How to identify malicious links and emails? Wherever possible,
instead of just telling them the information, build on what they already know by
asking questions.
Activity* 10:00 Split participants into small groups or have them work as individuals and assign
per an activity that reinforces the information just introduced.
topic Suggested activities include:
Passwords: Have participants create an ‘unguessable’ password.
Safe use of Internet/social media: Participants can audit their own social
media accounts according to the guidelines in the module to determine
if they are practicing good social media safety.
Using only approved software: Provide a list of software applications
and ask participants to determine if their use is permitted at work
according to your policies.
Identifying malicious links and emails: Provide examples of phishing
emails and have participants identify what reveals them as fake.
Debrief 5:00 After participants have completed the activity, they should compare their results
Activity* per with one another.
topic
Group 10:00 Ask one or more questions to generate a group discussion on the topic and
Discussion reinforce the content of the class.
Summary 5:00 Summarize what participants have learned, remind them of the learning
Conclusio objectives they have just achieved, thank them for their time, and close the
Provide Employee Awareness Training
[Insert Letterhead] Last Updated:
n training session.
*For each topic, first explain (5 min.), then run activity (10 min.), then debrief (5 min.) before moving on
to the next topic.
Employee awareness training topics
Instructions: List the areas/topics in which employees are to undergo training.
Provide an outline for each topic/area. If appropriate, you can use the example below.
Use of effective password
Ensuring all work devices and accounts are protected by effective, secure passwords is an
important part of any cyber security program, and should be a key focus of your training.
Use passcodes of pins
When possible, use a Passcode or PIN on a work device, or a personal device with work access.
Use two factor authentication
Two Factor Authentication (2FA) is crucial when dealing with sensitive information.
Organizations should always set up 2FA where possible and not skip this process. Employees
should also be made aware of 2FA and its benefits.
Passwords
A good activity for employee training is to have participants develop an unguessable password.
Creating secure passwords also includes protecting your passwords from being guessed or found
out, and avoiding common mistakes in setting a password.
Protect your passwords and PINs by not sharing them with others or writing them down in
places where they could be found. Using a password manager is a best practice.
Avoid common mistakes such as using the same password for multiple sites, or using simple,
easy to guess passwords.
Complex passwords should be a minimum of 12 characters, and contain upper and lowercase
letters, numbers, and special characters.
Identification of malicious emails and links
Fraudulent emails
Fraudulent emails containing malware or malicious links can be subtle, sophisticated, and hard
to detect for someone not properly trained in how to identify them.
Phishing emails
Phishing emails look legitimate, but are mass emails, sent to multiple recipients. They usually
contain a link or attachment that is malicious that enables threat actors to gain access to
security credentials, or to the computer or its network when the attachment is opened or the
link is clicked.
Spear phishing emails are designed to target groups and people with specific interests or types
of employment.
Provide Employee Awareness Training
[Insert Letterhead] Last Updated:
Phishing email messages often appear to be both relevant to the target and sent by a credible
source, but they contain links that when clicked, enable threat actors to gain access to
credentials, computers, or networks.
What makes spear phishing so effective?
Spear phishing emails are effective because they generally contain branding and logos of
legitimate organizations, and the subject line is relevant and encourages trust.
Malicious software can also be contained in PDFs, images or other files that look legitimate.
Making employees aware of how to identify phishing and spear phishing emails and links is an
important part of any employee awareness training program.
Being able to identify which links are legitimate and which are phishing links is crucial to your
employees being able to navigate the internet safely at work.
When on a desktop or laptop browser, hovering your mouse over the link without clicking it will
show the whole URL. From there, look for the telltale signs that the link is fraudulent.
Fraudulent links often do not match the domain name of the sender. For instance, an email
claiming to be from Microsoft contains a link with a domain name from a lawyer’s office.
They can also contain misspelled domain names from common brands, such as Microsoft with a
missing O, or Apple with an extra p.
Fraudulent links also often contain extra terms such as [Link].
Phishing and Spear Phishing emails don’t just contain malicious links. They also can contain
attachments that when opened, can infect your network with viruses, including ransomware.
Malware is often disguised as invoices or purchase orders and may appear to come from trusted
sources.
Never open an attachment you were not expecting. Compose a separate email – not a reply - to
a known address of the sender to ask if the attachment is legitimate.
Use of approved software
Authorized applications
A good exercise for this lesson is to list a selection of software applications and ask participants
to determine if they are authorized.
Organizations must develop clear policies for safe internet use at work, and communicate those
policies to employees prior to them participating in cyber security training. These may include
prohibitions on:
o Criminal activity online
o Instigating or propagating malware or viruses
o Downloading software without permission
o Sharing credentials without authorization
o Connecting to the dark web, or other inappropriate sites
These policies should be clearly explained in your training program, with examples and case
studies or scenarios for employees to work through and apply their knowledge. This can include
showing various websites and asking if they are acceptable to visit under the company policy.
Provide Employee Awareness Training
[Insert Letterhead] Last Updated:
Safe use of social media
Social media
Social media is an increasingly important part of marketing any business, but it comes with its
own unique set of risks.
Ensuring employees are trained on the nature of those risks and how to avoid them can prevent
costly and embarrassing cyber incidents. To ensure the safe use of social media:
o Apply all possible security steps to accounts, including securing all devices and
eliminating unused accounts.
o Use good judgement based on cyber security best practices when accessing unknown
websites or accounts.
o Avoid sharing unnecessary personal information on company social media feeds.
Risks on social media can include threat actors gaining access to your profile. Using every
available security feature for log-ins can help prevent this.
Social media can contain malware hidden on seemingly harmless links. Make sure any links you
click are from trusted sources, and that those sources themselves haven’t been recently hacked.
Sharing information like birthdays, children’s names, pets’ names, and other details can make it
easy for threat actors to compromise your accounts.
A good training exercise is to ask participants to audit their own social media accounts to see if
they comply with best practices.
Provide Employee Awareness Training