A simple four-week security awareness plan for small teams

Security awareness often fails because it is a single long session once a year. People forget it by the following week. Small, regular nudges work better and fit around real work.

The idea

Pick one theme a week and spend about ten minutes on it. Keep it practical: one story, one habit, one question.

Week 1: Spotting suspicious messages

Share a recent example of a scam email or text, with the clues highlighted. Ask: "What would you do if this reached you?"

Week 2: Passwords and two-step login

Check that everyone has two-step login on email and key tools, and that nobody is sharing passwords in chats.

Week 3: Handling requests for money or information

Walk through your own rule for payments and bank-detail changes. Make sure everyone knows who to ask.

Week 4: What to do when something goes wrong

Agree who people tell, how, and that there is no blame for reporting quickly. Practise with a short "what if" scenario.

Keeping it going

• Repeat the cycle a few times a year with fresh examples.

• Include everyone, from leadership to volunteers and new starters.

• Celebrate good reports. Thank people who flag something, even when it turns out to be harmless.

A note on standards

Awareness and training are part of good practice in frameworks such as the ISO/IEC 27000 family. A plan like this is a practical, everyday way to follow the same idea.

How we can help

Our Advise service can help you shape a plan that suits your size and sector. Ask our team about a security review.