Build useful security training

Editorial update: 21 September 2026. Introductory learning material.

Training should match the work people do. Short, realistic exercises help teams practice identifying a concern and finding the correct reporting route.

• Cover sign-in protection, suspicious messages, approved sharing and lost-device reporting.
• Include new starters and people whose roles or systems change.
• Use follow-up reminders when a process or threat changes.
• Check understanding and use feedback to improve confusing instructions.
• Agree scope and handling rules before any simulated phishing exercise.

Activity: Design a ten-minute exercise for your team. State the expected action and how you will check that the reporting process worked.

Reference: CISA small-business resources. Check the source and your system provider’s current instructions before implementation.