Skip to content

Phishing Awareness & Simulation Program Guide

Overview

While every organization's security architecture, technology stack, and operational constraints differ, initial access via email compromise remains the primary threat vector across all sectors. Attackers routinely target the human layer through credential harvesting, spear-phishing, and Business Email Compromise (BEC) to bypass technical perimeter controls.

Static, annual security awareness training establishes baseline compliance, but it rarely changes real-time behavior. A mature security program pairs continuous education with regular, workforce-wide phishing simulations to turn passive awareness into active muscle memory.

Core Program Architecture

An effective phishing training framework combines structured learning with continuous behavioral conditioning across four main pillars:

  • Onboarding Integration: Mandatory foundational security awareness modules assigned to all new hires within their first week.
  • Quarterly Refresher Modules: Short, 5-to-10-minute micro-learning modules focused on emerging threat vectors and practical identification techniques.
  • Workforce Phishing Simulations: Controlled, quarterly campaigns that test real-time recognition, measure organizational baseline risk, and track failure/reporting trends.
  • Role-Based Training: Advanced, tailored scenarios designed for higher-risk personnel, including Finance, HR, IT Administration, and Executive Leadership.

State Compliance Mandates (SIMM 5320-A)

For California state entities, simulated phishing exercises must adhere to the requirements set forth in SAM 5320 and SIMM 5320-A:

Requirement Area SIMM 5320-A Standard Specification
Cadence & Scope Continuous monitoring approach requiring 100% workforce participation at least once per quarter.
Approval Workflow Written approval from the entity Information Security Officer (ISO) or Chief Information Officer (CIO) prior to execution.
Legal & HR Alignment ISO must coordinate with HR and Legal to ensure exercises comply with labor rules, union agreements, and do not cause undue employee anxiety.
Brand & Trademark Use Strict prohibition on using third-party, union, or external agency logos/trademarks without express written consent.
Technical Controls Configure domain blocks to prevent exercise emails from forwarding outside the organization. Domain ownership must be verified via ICANN or CDT.
Targeted Remediation Mandatory, targeted retraining for personnel who fail baseline security thresholds.

Remediating High Failure Rates

When campaign metrics show elevated vulnerability (such as high click-through or credential submission rates), execute the following remediation protocol:

  1. Automated Retraining: Configure platform automation to immediately assign short, targeted remediation modules to users who click links or submit credentials.
  2. Deploy One-Click Reporting: Implement an accessible Outlook add-in (e.g., Report Phishing button) to remove friction and encourage active user reporting.
  3. Enable Adaptive Learning: Leverage adaptive features within the simulation platform to scale scenario difficulty dynamically based on historical user performance.
  4. Track Key Metrics: Monitor four baseline Key Performance Indicators (KPIs) over time to measure program progress:
  5. Open Rate: Percentage of targets who opened the simulation email.
  6. Click Rate: Percentage of targets who clicked a link within the simulation.
  7. Credential Submission Rate: Percentage of targets who entered credentials on a simulated landing page.
  8. Reporting Rate: Percentage of targets who reported the suspicious email using approved channels.

References & Documentation

  • SIMM 5320-A: Statewide Information Management Manual Section 5320-A (Phishing Exercise Standard)
  • SAM 5320: State Administrative Manual Section 5320 (Training and Awareness)
  • NIST CSF 2.0: Governance (GV.PO) and Protect (PR.AT) Functions
  • ICANN Domain Lookup: lookup.icann.org