This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.
A lesson people finish is better than a trap
Awareness is a short lesson, a date, and a record of who finished. The plan generator drafts a calendar. It does not build a phishing message. Teaching people to report a suspicious mail is the goal. Sending them a fake invoice to see who clicks is a different programme with its own ethics and labour rules, and this guide does not design that message.
Topics that earn their place: how to report, what a second factor prompt you did not start looks like, and who to call before paying a changed invoice. The phishing and vishing response guides are what happens after a report.
Completion is a number you can explain. A quiz nobody can fail does not teach. A quiz that humiliates people will not be repeated. Keep the record only as long as the privacy inventory says.
Managers hear the completion number. They do not get a list of people to embarrass unless the programme you already approved says so.
One lesson, one team, one completion list
Write a ten-minute lesson: how to report a suspicious message, and the rule that a payment change needs a callback on a known number. Deliver it to one team. Record who finished. That is the pilot.
Ask what was unclear. Change the lesson before you schedule the company. A second team is the next window.
The report button or the mailbox you tell them to use must be a mailbox someone reads. A poster with a dead address is the failure.
Do not attach a sample lure you built. If you need an example, use a description: an unexpected attachment, a new bank detail, a code sent by text.
A change you can finish
The company calendar comes after one team finished and you fixed the lesson. The policy guide is where the rule becomes a document.
Rollback is returning to the previous lesson text, which you kept.
- Write one lesson with a report path someone reads.
- Run it with one team.
- Record completion.
- Fix what they did not understand.
- Do not build a phishing lure.
- Schedule the next team only after the fix.
- Match retention of the attendance list to the privacy inventory.
Mistakes that outlive the command
security awareness fails in the same few ways. Each one looks finished on the day you type it. The list is here so the ticket can forbid them before the window, not so you can recognise them in an incident review.
- A simulated phish as the first and only training.
- A report address nobody reads.
- Shaming a list of names.
- A quiz that cannot be failed and proves nothing.
- Keeping attendance forever.
- A lesson with no next step when someone reports.
- Scheduling the whole company before the pilot.
- Copying a scare story you cannot source.
Decisions to write down before the window
One decision for security awareness: The lesson is short and has a report path. One team is the pilot. Completion is recorded and retention is defined. No lure was built. Feedback changed the lesson before a wider run. The phishing response guide is the follow-up, not this page. Managers get a rate, not a shaming list, unless a programme already says otherwise. The policy guide owns the written rule. The previous lesson text is kept. And a second person read the lesson.
The hour you stop
Write the hostname or the system name, the owner, and the clock time before you change anything for security awareness. If the system is serving people and you do not have a spare, this hour is a plan, not a change. A plan you can read tomorrow is a success. A change you cannot undo is not.
Use a lab or a copy. The log line you test with is one you created, or one you are already allowed to hold. You do not point a tool at a network, a mailbox, or an account you do not administer. The tools on this site run in the browser. They do not log in, and they do not scan.
prompt-for-this is a reminder that a secret is missing. It is not a password, a token, or a key you save. The real secret stays in the password store. If a draft, a log, or a ticket still contains a live secret, stop and rotate it. Then delete the copy.
One change. A firewall, a detection, a DNS record, and a policy do not share a window. If two things move and the outcome is wrong, you will not know which one did it. The rollback is the previous value, written down while the system still works.
A second person reads the scope aloud: which host, which domain, which account. If they cannot find it in the ticket, the ticket is not ready. Silence is not agreement.
Documentation addresses stay in the lab. 192.0.2.0/24, 198.51.100.0/24, and 203.0.113.0/24 are not your production network. example.com is not your domain. Replace them before a real record or a real rule is published.
Do not allow every address because a test failed. A rule, a header, or a detection that matches the world is a draft you delete. Management stays on the prefix you named. A service port opens when the service is ready, for the clients you named.
Keep the previous file. A generator draft is not the previous file. The previous file is what you reload if the new one is wrong. You practised the reload on the lab, with a console or a second session open when the change can lock you out.
If a step fails twice, stop. The failure is the result. Adding a command from a forum beside a half-applied config produces a system nobody can explain. Rebuild the lab from the copy you kept.
When the checks pass, the next system waits until someone else can repeat the proof from the notes. security awareness is done for this window when the proof is written, not when the tool printed a file.
This page is a planning guide. It is not legal advice, not an audit opinion, not a vendor manual, and not the text of a standard. If a lawyer, an auditor, or a regulator must see the decision, they see the ticket and the evidence, not this paragraph.
Hand the finished note to the neighbouring guide that owns the next step, and leave this system alone until that guide has its own window.
Awareness checks before the next team is invited
Confirm this before you call the change done: The lesson fits in one short sitting. The report path was tested by sending one internal note. Completion was recorded. Feedback is written down. The lesson was edited. No phishing lure exists in the materials. Retention of the list matches the inventory. The wider calendar is not sent yet. A second person finished the lesson as a learner. The incident path is the response guide. The previous text is saved. Counsel or HR is named if the programme will later include simulations. The hostname in the prompt matches the hostname in the ticket for security awareness. The result line includes the time and the person, not only the command. You can point at the rollback value without searching a chat history. And done is a sentence a second person can repeat: the proof for security awareness happened, and the next host is not started early. If one of those fails, stop.
Tools for this guide
These tools run in the browser on this site. They do not log into your machines.
Related pillar guides
Guides in this cluster
These supporting pages belong to this pillar.