Staff security training

1. 1

   Month 1 — basic hygiene

   Password manager, 2FA everywhere, updates, screen lock.

2. 2

   Month 2 — phishing

   Recognizing emails, checking domains, phishing simulation (test campaign).

3. 3

   Month 3 — data

   Data classification, what goes where, encryption, secure file sharing.

4. 4

   Month 4 — incidents

   Who to notify and within how many minutes; 'hacked account' role-play.

5. 5

   Then quarterly

   Refreshers on new schemes, repeat simulations, metrics (phish-click rate).

Effectiveness is measured by behavior, not attendance: track the phish-click rate and response time to a test incident. Short 20-min monthly sessions beat an annual 4-hour training.