Prepare personnel for attacks aimed at people.

Build a practical understanding of how everyday decisions affect organizational security and the information entrusted to personnel. Connect common attack paths to each participant’s role, access, and business responsibilities so protective habits and requests for help become part of routine work.

• Recognize how attackers target people, systems, and routine business processes
• Understand individual responsibilities and the limits of authorized access
• Use approved devices, applications, and communication channels
• Protect workplace information during everyday tasks and collaboration
• Recognize suspicious requests, unexpected changes, and potential exposure
• Practice pausing, seeking help, and using the established reporting process

Practice recognizing attempts to manipulate decisions through urgency, authority, familiarity, fear, or an apparently routine request. Examine realistic email, messaging, phone, and other scenarios, then apply independent verification and reporting habits appropriate to the participant’s role and organizational procedures.

• Examine sender identity, request context, links, attachments, and unusual instructions
• Recognize impersonation of executives, coworkers, vendors, and support personnel
• Identify pressure to bypass normal approvals or keep a request secret
• Verify suspicious requests through a known, independent contact channel
• Avoid interacting with suspicious content and report through approved channels
• Practice prompt reporting after an accidental click, reply, or disclosure

Strengthen the habits personnel use to protect credentials, authentication factors, and account access. Work through suspicious sign-in requests, repeated MFA prompts, and possible credential exposure so participants understand how to interrupt the activity and involve the appropriate support or security team.

• Follow approved password-manager and account-protection practices
• Protect passwords, recovery codes, and authentication information from disclosure
• Recognize credential-harvesting requests and unexpected sign-in prompts
• Respond to MFA fatigue without approving requests that were not initiated
• Use established verification procedures for account recovery and support requests
• Report suspected compromise and follow authorized account-recovery instructions

Prepare personnel to recognize and interrupt fraudulent requests that exploit trusted business relationships or compromised accounts. Practice handling payment changes, sensitive-information requests, and exceptions to normal processes using independent verification, required approvals, and timely escalation.

• Recognize executive, vendor, and business-partner impersonation scenarios
• Examine unexpected payment instructions and bank-account change requests
• Identify unusual requests for payroll, personnel, or other sensitive information
• Verify changes using established contact details and approval procedures
• Maintain required approvals despite urgency, secrecy, or apparent authority
• Escalate suspected fraud promptly and preserve relevant request details

Apply the organization’s information-handling expectations to collecting, accessing, sharing, storing, and disposing of data during everyday work. Practice recognizing possible exposure and reporting useful details promptly so the responsible team can assess the situation and coordinate the next steps.

• Recognize sensitive information and role-specific handling responsibilities
• Limit collection, access, and sharing to the authorized business need
• Use approved storage and transfer methods and verify intended recipients
• Follow established retention and disposal procedures for workplace information
• Recognize misdirected messages, lost devices, and unintended disclosures
• Report what happened, when it occurred, and affected information without further exposure