HowyGuardHow do I set up yearly security and phishing training?
Pick a short security course, such as the free material on Get Cyber Safe, and have everyone who uses business email finish it once a year, including you. Keep a log of each name, course and date. If your form asks about phishing tests, add a test service that sends a harmless fake email.
Security training teaches staff to spot phishing and other scams. A phishing test sends a harmless fake one to see who clicks.
Check if you already have it
You're done if you have a log showing everyone who uses business email finished a security course in the last year, and, if your form asks, the results of a phishing test from the last year.
How to set it up
Run yearly security and phishing training
Any setup, needs everyone who uses business email or handles payments
- Pick a short course. The Government of Canada's Get Cyber Safe site at
getcybersafe.gc.cahas free material on phishing, passwords and two-step sign-in. - Ask everyone who uses business email, including you, to finish it, and set a date to have it done by.
- Make a simple log: name, course, date finished.
- If your form asks about phishing tests, sign up for a phishing test service, or ask a tech to run one. It sends a harmless fake phishing email and shows who clicked.
- Put next year's training date in your calendar, and add new staff to the log when they start.
How to show it's true: Keep the training log and, if you ran one, the phishing test results with the date.
- Your insurer offers free training: use it, and keep the completion record.
Make sure whoever pays the bills takes the course too, even if that's you. Many forms ask specifically about people who send money.
How to show it's done
Keep the training log (name, course, date finished) and any phishing test results with the date. Add new staff when they start. File it in your proof folder.
Common questions
Is a free course good enough?
Most forms ask whether training happens and how often. Write the course name in your log in case anyone asks which one.
What about someone who starts partway through the year?
Have them take the course when they start, and add them to the log then.
Does the owner need to do it?
Yes, if the owner uses business email or moves money.