Employee Cybersecurity Awareness
Make employees a measurable human line of defense: spot phishing, social engineering, and data leaks, with a curriculum mapped to NIST SP 800-50 Rev 1, NIST CSF 2.0 PR.AT, ISO/IEC 27001:2022 Annex A 6.3, and Indonesia's PDP Law obligations, tested with NIST Phish Scale-based simulations.
- format
- In-house / online / roadshow
- duration
- 2 hrs-1 day per batch + a 3-12 month periodic program
- participants
- Scalable to thousands
- language
- Indonesian / English
Quick Answer
Employee cybersecurity awareness training is an ongoing program that trains all employees to recognize phishing, social engineering, and data leakage so human-factor risk is reduced and measurable. Its curriculum is mapped to NIST SP 800-50 Rev 1, NIST CSF 2.0 PR.AT, and ISO 27001:2022 A.6.3, measured with the NIST Phish Scale and Kirkpatrick, aligned to Indonesia's PDP Law.
Indonesia's PDP Law (UU No. 27/2022) is fully in force — employee awareness is an obligation
Since October 2024 data controller & processor obligations are fully enforceable, with administrative sanctions up to 2% of annual revenue. Employee awareness is an expected organizational measure that must be evidenced. This program translates that obligation into concrete behavior and audit documentation from day one.
Mapped to recognized awareness frameworks
Design follows NIST SP 800-50 Rev 1 (2024, 4-phase lifecycle), meets NIST CSF 2.0 PR.AT-01/PR.AT-02 outcomes, and ISO/IEC 27001:2022 Annex A 6.3 duties — documented, role-based, and ongoing, not generic 'security tips'.
The most common mistake: annual training without behavior measurement
Measuring raw click rate without the NIST Phish Scale misleads, and once-a-year training only places an organization at the 'compliance-focused' SANS Maturity stage. This program pursues behavior & culture change with normalized simulations and a report-rate metric, not just a checked audit box.
Employee Cybersecurity Awareness
Employee cybersecurity awareness training is an ongoing program that equips all employees to recognize and respond to everyday cyber threats — phishing, social engineering, data leakage — so human-factor incident risk is reduced and measurable. The curriculum is mapped to NIST SP 800-50 Rev 1, NIST CSF 2.0 Protect (PR.AT), and ISO/IEC 27001:2022 Annex A 6.3, measured with the NIST Phish Scale and the Kirkpatrick model, and aligned to UU PDP No. 27/2022 (Indonesia's PDP Law) and sector regulation (e.g. POJK 11/2022 for banking).
Measurable Outcomes
Expected Outcomes
Success indicators mapped to Kirkpatrick evaluation levels and SANS Maturity Model stages — qualitative targets, set jointly during the TNA against the organization's baseline.
- Phishing click rate (Kirkpatrick L3 — Behavior)
- A downward click-rate trend across simulation cycles, normalized with the NIST Phish Scale so comparison is fair
- Phishing report rate (L3 — Behavior)
- A rising share of employees who actively report suspicious email — a culture indicator, not merely not-clicking
- Coverage & assessment pass rate (L1-L2)
- Most employees complete mandatory modules and pass the threat & policy knowledge assessment
- Audit-evidence readiness (L4 — Results)
- Training, assessment, and simulation evidence documented for ISO 27001 A.6.3, OJK, or internal-examiner audits
- Security-culture maturity (L3 transfer)
- Movement of stage on the SANS Maturity Model — from compliance-focused toward behavior & culture change
- Monetized ROI (Phillips L5 — optional)
- Estimated avoided human-factor incident loss with isolation of training effects, when finance/risk requires a figure
Program Format
Program Format Options
Chosen by employee distribution, regulatory intensity, and culture-maturity stage — finalized after the TNA.
Multi-Site Awareness Roadshow
Short sessions (60-120 min) touring units, branches, or plants for fast mass coverage — focused on spotting phishing, social engineering, and how to report, with messaging tailored per site.
Role-Based Core Module + Baseline Simulation
Core training structured per role (general, frontline, executive, IT/privileged) followed by a baseline phishing simulation to set an honest measurement starting point.
Periodic Program (quarterly/monthly)
Continuous reinforcement on a 70-20-10 pattern: micro-learning, rolling simulations with rising Phish Scale difficulty, and per-unit trend reviews.
Human-Risk Assessment & Diagnostic
A diagnostic session: a controlled phishing simulation, a behavior questionnaire, and mapping the organization's position on the SANS Maturity Model to set program priorities.
Free Consultation
Discuss your team's cyber-awareness program needs
Start with a free training needs analysis: we map your high-risk roles, your position on the SANS Maturity Model, and your regulatory obligations, then build a proposal & budget estimate grounded in real needs.
Curriculum
Curriculum Framework
Built with ADDIE and the NIST SP 800-50 Rev 1 Analysis & Design phase; final modules curated from the TNA and roles. Topics below are the full coverage that can be activated.
Comparison
Choosing a Program Format
A concise decision matrix — the final recommendation is set after the training needs analysis.
| Aspect | Awareness Roadshow | Core Module + Baseline Simulation | Periodic Program (quarterly) | Risk Assessment & Diagnostic |
|---|---|---|---|---|
| Primary goal | Fast mass coverage | Measurable awareness baseline | Behavior & culture change | Know the starting point first |
| Ideal participants | All distributed employees | Org building a baseline | Heavily regulated sectors | Exploratory IT/Risk leadership |
| Measurement | Coverage & brief assessment | Baseline click rate (Phish Scale) | Rolling click/report-rate trend | Diagnostic + SANS Maturity position |
| Compliance depth | Basic regulatory awareness | ISO 27001 A.6.3 fulfillment | Continuous audit evidence | Gap map vs frameworks & regulation |
| Target SANS Maturity stage | Toward compliance-focused | Strong compliance-focused | Behavior & culture change | Establishing the maturity baseline |
For Whom
Who Is This Program For?
Structured per role following the NIST CSF 2.0 PR.AT role-based pattern — because risk and attack vectors differ per function.
General employees (knowledge workers)
The first human line of defense for everyday email, credentials, and data.
Common challenges
- Inconsistently spot increasingly convincing phishing and social engineering
- Don't know the reporting path, so incidents go undetected quickly
- Unclear what data must not be shared or entered into unsanctioned tools
Frontline, service & call center
Favorite social-engineering targets because they interact with the public and hold customer data.
Common challenges
- Fast-service pressure causes security verification to be skipped
- Frequent vishing/pretexting targets impersonating a customer or superior
- Hold personal data subject to UU PDP and sector regulation
Executives & privileged-access holders
Targets of whaling, BEC, and tailored attacks due to approval authority and system access.
Common challenges
- Targeted by personalized spear phishing & deepfakes
- Financial approvals exploitable via impersonation (transfer fraud)
- No separate privileged-user training module yet (PR.AT-02 gap)
IT/Security, HR, Risk & Compliance teams
Design, run, and prove the awareness program and map human risk.
Common challenges
- Hard to measure human risk objectively (raw click rate misleads)
- ISO 27001 A.6.3 / OJK / UU PDP audit evidence incomplete & undocumented
- The program stops at annual training with no proven behavior change
Industry Context
Use Cases by Industry
One specific use case per industry, naming a real workflow, threat, and regulation in that vertical.
Anti-fraud frontliner & targeted BEC simulation against treasury/operations, mapped to the workforce-awareness duties in POJK 11/POJK.03/2022 and SEOJK 29/SEOJK.03/2022, with training & simulation evidence ready for OJK examination and ISO 27001 A.6.3 audit.
Patient-data protection & hospital ransomware vigilance (a vector that can paralyze clinical services), with a patient personal-data handling module aligned to UU PDP No. 27/2022 and clear incident reporting for medical & administrative staff.
Civil-servant awareness of citizen-data security and digital public services, aligned to BSSN guidance and public-sector UU PDP duties, with cross-unit roadshows and coverage evidence for internal examiners.
Vigilance against critical-infrastructure attacks and OT/IT boundary hygiene for plant & corporate staff, with social-engineering scenarios targeting operators and the supply chain.
Software supply-chain security and social engineering against engineers (tokens, secrets, repository access), with simulations targeting credential phishing and MFA fatigue.
An enterprise-scale awareness program across subsidiaries with an auditable governance trail, aligned to UU PDP and the NIST SP 800-50 Rev 1 framework, supporting director accountability and readiness for BPK/internal-audit examination.
Delivery Method
Delivery
Format adapts to team distribution and operational schedule; every format is interactive with exercises & simulations, not one-way passive lecture.
In-house on-site & roadshow
Facilitator comes to the office/branch/plant; interactive sessions with local case studies, tabletop social-engineering simulation, and reporting drills.
Live online & micro-learning
Interactive class via Zoom/Teams for mass coverage, reinforced by short micro-learning for periodic reinforcement (70-20-10 pattern).
Hybrid
On-site sessions for high-risk roles (frontline, executive, IT) followed by rolling online phishing simulations and per-unit trend reviews.
Engagement Flow
Engagement Path
Following the 4-phase NIST SP 800-50 Rev 1 lifecycle — qualitative durations, adapted to organization scale & distribution.
Training Needs Analysis & Diagnostic (Plan & Strategy)
Mapping high-risk roles, regulatory duties (UU PDP/POJK/sector), the starting position on the SANS Maturity Model, and a measurement baseline. Output: a needs profile + simulation scope.
Initial stageRole-Based Program Design (Analysis & Design / ADDIE)
Defining measurable learning objectives, a per-role syllabus (general/frontline/executive/privileged), local scenarios, and a compliance map to NIST/ISO 27001/UU PDP.
Before deliveryBaseline Simulation
A controlled phishing simulation to set the starting point, rated with the NIST Phish Scale so the baseline is honest and later comparable.
Program startDelivery — Roll-out per Role & Site
Core training and cross-unit/branch/plant roadshows; high-risk roles get deeper modules (70-20-10 pattern, led by a security-champion group).
Rolling per batchReinforcement & Periodic Simulation Cycles
Micro-learning and rolling simulations with gradually rising Phish Scale difficulty; per-unit click & report-rate trend reviews.
Periodic (quarterly/monthly)Evaluation & Institutionalization (Assessment & Improvement)
Kirkpatrick L1-L4 evaluation (Phillips L5 on request), re-mapping the SANS Maturity stage, audit evidence, and a security-culture maturity roadmap.
After each cycle & ongoingCase Studies
Typical Outcome Patterns
Indicative impact patterns based on similar program structures — illustrative, with no named clients or promised numbers. External benchmarks (e.g. Verizon DBIR) are cited as industry references, not Neksus result claims.
A financial-services institution with thousands of employees across many branches
Intervention
Multi-site roadshow + a baseline phishing simulation then rolling cycles with Phish Scale difficulty raised gradually
Result
A downward click-rate trend across cycles and a rising report rate; training evidence assembled for regulator examination
A multi-unit healthcare network
Intervention
Quarterly program + a UU PDP-aligned patient-data protection module + a simplified reporting path
Result
Comprehensive training coverage and more complete compliance-audit documentation; ransomware awareness improved among non-technical staff
An agency/state-owned enterprise with many work units
Intervention
SANS Maturity Model position assessment + a phased program with a champion network (70-20-10 pattern)
Result
Movement from a compliance-focused stage toward behavior change, with trend metrics reportable to leadership
Procurement Info
Information for Procurement & Vendor Management
What procurement, finance, legal, and information-security teams need.
Registered PT under the Selestia ecosystem (Eduprima group); complete tax ID & legal documents; ready for service agreements and vendor onboarding.
Structured proposal: measurable learning objectives, role-based syllabus, compliance map (NIST SP 800-50 Rev 1 / CSF 2.0 / ISO 27001 A.6.3 / UU PDP / POJK), simulation methodology, facilitator profiles, schedule, and a TNA-based cost breakdown.
TNA-based — flat per program, per session, per participant, tiered, or custom. No standard figure without a needs analysis; an estimate follows the TNA and once simulation scope is agreed.
Flexible terms (deposit + balance / per-batch or per-quarter terms); tax invoice (PPN/VAT) and PO documentation support available.
Familiar with state-owned-enterprise/agency procurement stages: vendor documents, e-procurement, owner's estimate/bid, and compliance clauses.
Kirkpatrick Level 1-3 evaluation report (attendance, assessment, click/report-rate trend with Phish Scale) and SANS Maturity stage mapping; Phillips ROI Level 5 on finance/risk request.
NDA signing, participant data confidentiality clauses, an agreed & controlled phishing-simulation scope, and practice aligned to UU PDP and your internal security policy.
Scenarios, materials, and reports built for the company belong to the company; training-material usage rights are agreed in the contract.
FAQ
Frequently Asked Questions
Next Step
Discuss your team's cyber-awareness program needs
Start with a free training needs analysis: we map your high-risk roles, your position on the SANS Maturity Model, and your regulatory obligations, then build a proposal & budget estimate grounded in real needs.
- Complimentary training needs analysis — the natural first step
- Proposal, role-based syllabus, and a compliance map within a few business days
- An honest, auditable NIST Phish Scale-based phishing-simulation methodology
- Procurement-ready documents (company profile, tax ID, NDA, VAT invoice)
Discuss your team's cyber-awareness program needs
Start with a free training needs analysis: we map your high-risk roles, your position on the SANS Maturity Model, and your regulatory obligations, then build a proposal & budget estimate grounded in real needs.
- Complimentary training needs analysis — the natural first step
- Proposal, role-based syllabus, and a compliance map within a few business days
- An honest, auditable NIST Phish Scale-based phishing-simulation methodology
- Procurement-ready documents (company profile, tax ID, NDA, VAT invoice)