TOOLBOX · DOWNLOAD
Awarenessall yearlong.
A single mandatory talk once a year changes little. Effective awareness runs throughout the year, reaches every audience with suitable content and is measured. This template helps you set up an annual plan: define audiences, spread topics across four quarters, choose formats, schedule training for management bodies and document participation and effectiveness. It is based on NIST SP 800-50 Rev. 1, module ORP.3 of the BSI IT-Grundschutz-Kompendium and, for entities subject to NIS2, § 31 NISG 2026 (Austrian Network and Information Systems Security Act 2026) and Annex no. 8 of Implementing Regulation (EU) 2024/2690.
Free PDF · Template
Security Awareness: Annual Plan for Training and Awareness
- Topic
- Security Basics
- Format
- PDF, A4
- Length
- 8 pages
- Size
- 107 KB
- Updated
- Oct 25, 2026
- Sources
- 8
- Usage
- Adaptation for your own use permitted; redistribute unchanged
WHO IT IS FOR
Who This
Is for.
Topics per quarter, audiences, formats, training for management bodies and evidence, based on NIST SP 800-50 Rev. 1, BSI ORP.3 and the NISG 2026.
- Management that approves training and takes part in training itself
- Information security officers who plan and evaluate the program
- HR departments that look after new employees and records
- Managers who model and enforce security rules
7 SECTIONS
What Is
Inside.
- 01
What is required
Obligations under the NISG 2026 and the Implementing Regulation, recommendations from the BSI and NIST
- 02
Define audiences
Who needs which content, from all employees to management
- 03
Formats: raise awareness, practice, train
The three building blocks of a program and how to mix them
- 04
Annual plan to fill in
Topics spread across four quarters, with audience, format and date
- 05
Training for management bodies
What training designed for management should cover
- 06
Evidence and effectiveness
Document participation, measure learning success, improve the program
- 07
Common mistakes
Why awareness programs fail in practice
EXCERPT
Annual plan to fill in
The topics are a TOMORIS proposal and cover the content listed in Annex point 8.1.2(c) of the Implementing Regulation: cyber threats, existing measures, points of contact and cyber hygiene practices. Adapt the order and topics to your risks, incidents and tools, and enter dates and responsible persons.
| Period | Topic | Audience | Format | Date, responsible |
|---|---|---|---|---|
| Q1 | Kickoff: goals, rules, incident reporting channel | everyone | Short training | __________ |
| Q1 | Training for management bodies | Management | Workshop | __________ |
| Q1 | Passwords, password managers, MFA | everyone | Online course | __________ |
| Q2 | Phishing and social engineering | everyone | Training | __________ |
| Q2 | Phishing exercise with evaluation | everyone | Simulation | __________ |
| Q2 | Handling data and data protection | everyone | Online course | __________ |
| Q3 | Mobile work, devices, updates | everyone | Short training | __________ |
| Q3 | Emergency: who does what? | Management, IT | Tabletop exercise | __________ |
| Q3 | Using administrative accounts securely | Admins | Training | __________ |
| Q4 | October: activities during Cybersecurity Month | everyone | Campaign | __________ |
| Q4 | Using AI tools securely | everyone | Training | __________ |
| Q4 | Evaluation and plan for the following year | Information security officer, management | Meeting | __________ |
| ongoing | Onboarding of new employees | New hires | Onboarding | __________ |
| ongoing | Alerts about current attacks | everyone | __________ |
October is European Cybersecurity Month, an annual EU campaign supported by ENISA together with the European Commission. Your own activities during this month combine well with public materials.
SOURCES
Supported
by Sources.
- NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program (September 2024) (opens in a new tab)Sections 2.4.1, 2.5, 2.7, 3.1 and 3.2, accessed October 25, 2026
- BSI IT-Grundschutz-Kompendium, module ORP.3 Information Security Awareness and Training (Edition 2023) (opens in a new tab)Requirements A1, A3, A4, A6, A8, A9, accessed October 25, 2026
- NISG 2026, BGBl. I No. 94/2025, current version in the RIS (opens in a new tab)§§ 31 to 34, 45 and 46, accessed October 25, 2026
- NISV 2026, BGBl. II No. 290/2026 (opens in a new tab)§ 2 applicability of the Implementing Regulation, accessed October 25, 2026
- Implementing Regulation (EU) 2024/2690, German version on EUR-Lex (opens in a new tab)Annex points 8.1 and 8.2, accessed October 25, 2026
- Directive (EU) 2022/2555 (NIS 2 Directive), German version on EUR-Lex (opens in a new tab)Art. 20(2), accessed October 25, 2026
- Regulation (EU) 2026/1744 (Digital Omnibus Regulation on AI), OJ L of July 24, 2026 (opens in a new tab)Art. 1(5), new version of Art. 4 AI Act, accessed October 25, 2026
- ENISA: European Cybersecurity Month (opens in a new tab)Description of the campaign, accessed October 25, 2026
Adapt this template to your company, your risks and your tools; the topics, formats and rhythm are TOMORIS recommendations. It does not replace legal advice. For entities under the NISG 2026, the text of the law, the NISV 2026 and Implementing Regulation (EU) 2024/2690 in their current versions are decisive. Clear phishing exercises and evaluations with the works council and data protection in advance.
TOOLBOX
Explore
Further.
- Kostenlos
Link checker (German)
Spot phishing signs without clicking
Check Now - Kostenlos
Email header analysis (German)
Read sender path, SPF, DKIM and DMARC
Check Now Recognizing phishing
Warning signs, verification steps and reporting channel for employees as a cheat sheet to post.
Learn MoreIT security policy
Template for the policy with goals, roles and basic rules on which training builds.
Learn More
SECURITY BASICS
More on
This Topic.
- PDF
Password Policy
Length instead of mandatory special characters, changes only on suspicion, blocklist, and MFA: a password policy to adapt, with an old-versus-new comparison and a checklist for Microsoft Entra ID.
View - PDF
IT Security Policy
Model text with placeholders for the information security policy and eight basic rules for all employees, aligned with BSI IT-Grundschutz, the NISG 2026, and the NISV 2026.
View - PDF
Phishing Cheat Sheet
Warning signs with ways to check them, CEO fraud, QR codes, calls and MFA requests, immediate steps after a click, and the reporting channels in Austria: compact, ready to share and post.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.