Cyber Awareness Campaign Checklist: Launch, Measure, Improve

A good awareness campaign has two parts: the experiences employees see and the operational work that makes those experiences useful. Posters, quizzes and phishing simulations can capture attention, but an effective programme also needs approvals, audience planning, reporting paths and a method for evaluating results.

This checklist is for security, HR, communications and IT teams organising a company-wide campaign—whether for October or as part of a year-round human risk programme. If you need weekly themes and ready-made activities, start with PhishSheriff's Cyber Awareness Month 2026 hub. This guide focuses on delivering those activities well.

Four weeks before launch: assign owners

Confirm who will lead the programme and who will support it. Typically, security owns threat relevance and simulation safety; IT confirms mail delivery and reporting mechanisms; HR or L&D manages learning access; communications handles announcements; and leadership sponsors the initiative.

Create a simple sign-off workflow for campaign content, learner lists, branding, employee privacy notices and escalation instructions. If activities use simulated phishing, agree on scope, allowed scenarios, test data and exclusions before launch.

Deliverable: a one-page responsibility matrix with an owner, reviewer and deadline for every major activity.

Three weeks before launch: segment the audience

Define the main employee groups and their risk exposure. All employees should understand phishing and reporting, while finance may need extra payment-fraud content; HR may need identity and document handling; IT may need account-recovery deception; and leadership may need impersonation and confidentiality exercises.

Check the employee import process, department attributes and LMS assignments. Test mobile access and accessibility requirements. For simulation programmes, perform approved whitelisting and mail-routing validation without unnecessarily weakening security controls.

Deliverable: a campaign audience map showing which roles receive which activities.

Two weeks before launch: prepare communications

Make the campaign easy to recognise. Use consistent visual identity, short messages and clear instructions for reporting suspicious activity. Plan a leadership kickoff, a weekly activity announcement, one midweek reminder and a short end-of-week recap.

An example kickoff line is: This month we are practising how to recognise unusual requests, verify them safely and report concerns quickly. Participation matters more than perfect scores.

Every communication should answer three questions: Why does this matter to my role? What should I do? Where should I report an issue?

Deliverable: an approved communication pack with subject lines, posters, links and support contacts.

One week before launch: test the experience

Send test emails to a small authorised group and verify that links, learning assignments, tracking and reporting functions work as expected. Confirm that mail security systems do not create misleading events in the simulation reports. Test the actual employee experience in desktop mail, webmail and on mobile where relevant.

Review training completion logic and quiz sequencing. A user who finishes a video but cannot reach the final question should not be counted as disengaged because of a course-design issue.

Deliverable: a go-live checklist signed off by the owners responsible for email, learning and reporting.

During the campaign: connect participation with habits

Use a mix of short lessons, games, scenario quizzes and authorised exercises. The central learning outcomes are recognition, independent verification and prompt reporting. Reinforce those outcomes through different topics rather than repeating the same message word-for-word.

Reward useful participation, improvement and reporting. Avoid public rankings based on unsafe clicks or exposure of sensitive employee performance. When a security concern is reported, employees should know what response to expect.

For examples of realistic multi-stage requests, see PhishSheriff's CalPhishing analysis and multi-channel simulation overview.

At the close: report outcomes fairly

Summarise the number of employees reached, activity participation, training completions, validated simulation interactions, reporting rates and time to report. Include any data-quality limitations. Compare with a baseline only when scenarios and event definitions are sufficiently similar.

Present actions alongside results: what worked, what needs changing, which roles require additional support and what the next quarter will include. PhishSheriff's board reporting guide provides a structure for communicating human risk in context.

After the campaign: keep the process alive

Choose a regular cadence for refresher modules, role-specific simulations and a review of real employee reports. Convert common mistakes into short, useful guidance and update policies that create unnecessary verification friction.

The best result is not a colourful month-end report. It is an organisation that understands how to recognise, verify and report a suspicious request on an ordinary Tuesday in February.

Frequently asked questions

Who should own a cybersecurity awareness campaign?

Security usually leads content and risk priorities, supported by HR/L&D, IT, communications and executive sponsorship.

What should be tested before launch?

Employee lists, links, LMS progress, mail delivery, reporting channels, simulation event attribution and approved privacy controls.

What should a final report include?

Participation, verified behavioural measures, reporting readiness, lessons learned and an agreed improvement plan.