The short answer
A security awareness programme that changes behaviour has five parts:
Clear goals
Real risks: phishing, accounts, data handling, quick incident reporting.
Short, regular content
Instead of one long annual session.
Role-based depth
Finance, executives, IT administrators, anyone handling sensitive records.
Practice and feedback
Including fair phishing simulations.
No-blame reporting
One-click reporting and a quick, friendly response.
Start with the behaviours you want
NIST SP 800-50 Rev. 1 (September 2024) treats training as a life cycle aimed at behaviour change, with metrics to improve it (NIST). Write goals as behaviours, not topics; they tell you what to measure.
| Instead of | Aim for |
|---|---|
| "Understand phishing" | Suspicious emails reported within minutes; payment changes verified by phone |
| "Password training" | MFA and a password manager for all; no reused work passwords |
| "Data protection awareness" | Sensitive files sent through approved tools, never personal email |
| "Incident awareness" | Lost devices and mistakes reported immediately, without fear of punishment |
Make it relevant to Nigerian staff
Generic foreign content feels irrelevant. Use lures people recognise:
- Tax authority, bank, mobile network or courier impersonation
- Fake transfer alerts and "successful payment" screenshots
- A known supplier's "new banking details"
- Executives asking for airtime, gift cards or urgent transfers
- Fake Microsoft 365 or Google sign-in pages
- Fake job offers or "account verification" by WhatsApp, SMS
ngCERT, Nigeria's computer emergency response team, publishes current local threat information. Use your staff's languages, captions, screen reader support and plain language; keep modules short and mobile-friendly.
Role-based depth
Awareness training is a baseline control everywhere: passwords, malicious email, approved software, appropriate internet use. Some roles need more:
- Finance and payroll
- Executives and assistants
- IT and administrators
- HR and client-facing staff
- New staff
What each role needs
| Role | Extra focus |
|---|---|
| Finance and payroll | Payment verification, supplier banking changes, invoice fraud |
| Executives and assistants | Impersonation, targeted phishing, travel and device security |
| IT and administrators | Privileged accounts, help desk social engineering, secure remote access |
| HR and client-facing staff | Personal data, CVs and attachments from unknown senders |
| New staff | Basics in week one, before habits form |
Phishing simulations, done fairly
Safe practice for staff, data for you. Build trust:
- Announce that simulations happen, not when.
- A click is a learning moment: explain at once.
- Never name, shame or discipline on results.
- No lures exploiting distress or promising fake benefits such as bonuses.
- Vary difficulty and themes; mirror real attacks you have seen.
- Measure reporting, not just clicks.
Make reporting easy
Fast reporting matters most: one early report protects everyone.
A report button
In the email client.
A clear contact
Lost devices, mistaken emails, anything that "feels off"; after hours if covered.
A quick thank-you
Plus feedback on the message, where possible.
People who fear blame hide mistakes: say often that quick reporting is right.
Back training with technical controls
Training reduces risk, never removes it. Pair it with MFA, email filtering, endpoint protection, least-privilege access and tested backups (common settings: Microsoft 365 security baseline).
A 12-month plan
| When | Activity |
|---|---|
| Month 1 | Baseline simulation, report button, leadership no-blame message |
| Monthly | One 5 to 10 minute module on one topic |
| Quarterly | New-theme simulation; role sessions for finance, executives and IT |
| On hire | Onboarding module in week one |
| After incidents | Short, anonymised lessons learned |
| Month 12 | Review metrics, update topics, report to leadership |
Measure what matters
Track over time:
- Report rate, simulated and real
- Time to first report
- Click rate by theme (to target modules, not rank people)
- Repeat clicks (to offer support)
- Real human-error incidents and report speed
- Completion (hygiene only)
Training and simulation data is employee personal data under the Nigeria Data Protection Act 2023: restrict access, set retention.
Programme checklist
Design
- Programme goals written as behaviours
- Higher-risk roles identified with extra content planned
- Nigerian examples and the languages your staff use addressed
Delivery
- Monthly short modules scheduled
- Onboarding module for new staff
- Quarterly phishing simulations with fair rules published
Reporting culture
- One-click reporting in email
- Clear contact for mistakes and lost devices
- Leadership statement on no-blame reporting
Measurement
- Report rate and time to report tracked
- Annual review with leadership
- Training data access and retention defined
Limitations
One control among many: it works best with visible leadership, and results take months, not weeks. For help designing or running one, see our cybersecurity awareness training service.
Sources and further reading
Product capabilities and guidance change. These are the primary sources this article relies on, checked on the review date above.
- Building a Cybersecurity and Privacy Learning Program (NIST SP 800-50 Rev. 1), National Institute of Standards and Technology
- Nigeria's computer emergency response team (ngCERT), ngCERT
This article is general information, not legal, accounting or security advice for your specific situation. Examples are hypothetical unless stated otherwise.