Phishing Training Concept: 4 Quarterly Modules + Simulations

Main article: Section 30 BSIG: 10 mandatory measures — it explains all ten areas of measures under § 30(2) BSIG with a mapping to ISO 27001 and practical examples.

Legal framework: the training is mandatory, the cadence is practice

What is mandatory is that training and awareness-raising take place — not that this happens quarterly in four modules. Germany requires in § 30(2) no. 7 BSIG "basic training and awareness-raising measures in the field of information technology security", Austria in § 32(4)(g) NISG 2026 (BGBl. I Nr. 94/2025) "basic cyber hygiene practices and cybersecurity training". Neither wording contains a cycle, a number of modules or a form of simulation. The four-quarter structure of this concept is therefore a practice recommendation throughout — the sister article on Section 30 BSIG likewise lists "quarterly phishing simulation with click-rate monitoring" as a practice building block for the area of cyber hygiene.

In Germany, particularly important entities and important entities under § 28 BSIG are covered. A particularly important entity is — alongside operators of critical installations and some types covered irrespective of size — an organisation that can be assigned to a type of entity in Annex 1 BSIG and employs at least 250 staff or has an annual turnover of more than EUR 50 million and, in addition, an annual balance sheet total of more than EUR 43 million. An important entity is an organisation that can be assigned to a type in Annex 1 or 2 and employs at least 50 staff or has an annual turnover and an annual balance sheet total of more than EUR 10 million each, in so far as the entity is not already a particularly important entity. Austria classifies in parallel under § 24 in conjunction with § 25(2) and (3) NISG 2026: a large enterprise from at least 250 employees or more than EUR 50 million annual turnover and more than EUR 43 million balance sheet total, a medium-sized enterprise from at least 50 employees or more than EUR 10 million annual turnover and more than EUR 10 million balance sheet total.

The following table separates what is a legal norm from what this concept proposes. Rows with "—" are practice recommendations of this concept, for which no legal source is cited here.

Q0: preparation before the first simulation

Four things have to be settled before the first simulation — employee co-determination, legal basis, processing on behalf of a controller and the threshold check for the data protection impact assessment. How much time you allow for this is not prescribed by any law; the preparation starts in the quarter before Q1.

1. Co-determination (Germany). Involving the works council is mandatory under § 87(1) no. 6 of the German Works Constitution Act (BetrVG) (technical devices for monitoring conduct and performance). Even if phishing tests are evaluated in aggregate, individual click rates remain technically traceable — which is why co-determination applies. In practice, a works agreement governs the anonymisation guarantee, the maximum number of tests per year and the exclusion of any link to performance appraisal. Without the works council's consent, the test results cannot be used. For Austria, this article does not cite a corresponding legal source — the BetrVG does not apply there; this point remains open and must be clarified separately before the start.

2. Legal basis. Processing the participation and click data is lawful only if at least one of the conditions in Art. 6(1) GDPR is met. In addition, the original version cites the requirements of § 26 of the German Federal Data Protection Act (BDSG) (Germany) and the information to be given to employees. This article does not state which condition of Art. 6(1) GDPR supports the processing in the individual case; for Austria it also does not cite a source corresponding to § 26 BDSG — this point remains open and must be clarified separately before the start.

3. Processing on behalf of a controller. In so far as the provider processes personal data on your behalf, the following applies: only processors providing sufficient guarantees of appropriate technical and organisational measures are permissible; the contract must set out the subject matter, duration, nature and purpose of the processing, the type of data, the categories of data subjects and the obligations and rights of the controller (Art. 28(1) and (3) GDPR).

4. Threshold check. Clarify in advance whether the planned evaluation is likely to result in a high risk to the rights and freedoms of natural persons and therefore triggers a data protection impact assessment under Art. 35(1) GDPR; Art. 35(3) GDPR names for this, among other things, a systematic and extensive evaluation of personal aspects (profiling) producing legal effects. Only after that does the advance information to employees about the purpose, course and form of evaluation of the simulations begin.

Who does what (practice recommendation of this concept, in so far as no legal source is named in the row):

The annual plan at a glance

The twelve-month plan consists of four modules of 30 minutes each, with a simulation following directly afterwards in every case. The following table sets out what is trained, simulated and documented in each quarter. The difficulty levels are anchored to observable characteristics so that they can be commissioned and reviewed without provider terminology.

Timeline within the quarter (practice recommendation of this concept):

The evaluation and coaching deadlines are set out in the row "Click in the simulation" in the section "Escalation plan". Exclude sending periods in which a large part of the workforce is unavailable — company holidays, public holidays, year-end closing. The specific sending date is not announced in advance, otherwise the simulation measures the announcement rather than attentiveness; all that is announced is that simulations will take place during the year (which is part of the advance information from Q0 in any case).

Structure of a 30-minute module

All four modules follow the same minute-by-minute structure. The quarterly topics from the annual plan table fill this structure, they do not replace it.

Fixed parameters across all four modules (practice recommendation): ten quiz questions, a pass mark of eight out of ten, one opportunity to retake within two weeks. Whether the module is run as a classroom session or as e-learning is open — in both cases the date, participation and quiz result are documented.

What runs all year round

Two building blocks run continuously alongside the quarterly modules and have to be set up before Q1, not at the end of the year: the monthly "lessons learned" newsletter and the phish reporting button. A newsletter with a reading time of around five minutes keeps the examples present between the modules. Content structure for each issue (practice recommendation): one anonymised case from the previous month's reports plus one detection characteristic from the current quarterly topic. The phish reporting button in the email client supplies the second metric: the number of reported phishing attempts is the positive counter-metric to the click rate and belongs in the quarterly dossier alongside it. Because Q3 measures the reporting rate, the button must be in place before the third simulation at the latest. Both building blocks are practice recommendations, not a legal obligation.

Q1: fundamentals + first simulation

Q1 lays the foundation for the three following quarters and produces the metric with which you can later demonstrate effectiveness.

What to do: include all employees. For Austria, § 31(2) NISG 2026 expressly requires the entity to offer its employees appropriate training on a regular basis; the NIS2 Directive requires Member States to impose the same requirement (Art. 20(2) Directive (EU) 2022/2555). Simulation 1 is sent as a full survey to all employees so that the baseline is robust for later comparisons. New joiners are covered retrospectively through onboarding training — the sister article on Section 30 BSIG names the first four weeks for this and annual training for all employees with a quiz.

Why: without a starting value, no improvement can be shown later. The baseline click rate is the anchor for assessing the effectiveness of risk management measures, which § 30(2) no. 6 BSIG requires as a separate area of measures. Documentation starts with Q1, not retrospectively; what belongs in the quarterly dossier and which evidence is due when is set out in the section "Evidence".

Q2: spear phishing + whaling

Q2 addresses the targeted attacks that hit roles with payment, contract and approval authority.

What to do: tailor the role-specific part separately for financial accounting, procurement and the management body; participation by the management level is not a voluntary extra here but a separate legal obligation — the legal sources and reasoning are set out in the section "Supervision, management body and fine framework". Simulation 2 again goes to all employees, but is evaluated separately for the three roles trained in depth. As a practice recommendation: if the click rate of the roles trained in depth is not below the overall click rate of the same send, the role-specific part is repeated before Q3 rather than being postponed to the next annual cycle; the result of the role comparison belongs in the quarterly dossier as a separate row.

Why: supplier fraud links this module to the catalogue area of supply chain security — § 30(2) no. 4 BSIG, in Austria § 32(4)(d) NISG 2026. Anyone training on the attack vector "forged supplier communication" should also review the contractual side; the sister article names supplier assessment with risk classification, cybersecurity clauses in standard contracts, right-to-audit for critical suppliers and incident notification by suppliers within a maximum of 24 hours.

Q3: voice phishing + smishing

Q3 moves the exercise from email to telephone and mobile device — to where technical filters barely reach.

What to do: run through the MFA bypass in practice (push confirmation on request, asking for one-time codes by phone, helpfulness towards alleged IT colleagues) and practise the internal reporting channel as well: who reports where when a call was suspicious, and what happens in the first hour afterwards? Because the voice component is more demanding than an email send, a sample of the employees with a company phone or MFA access is sufficient here. As a practice recommendation: at least 10% of this target group, but at least 20 people, spread across all sites and departments; the sampling is documented and belongs in the quarterly dossier as a separate artefact, otherwise the reporting rate cannot be put into context for the supervisory authority. What is measured is the reporting rate via the internal reporting channel — the phish reporting button from the section "What runs all year round" must already be in place for this. Unlike in the other quarters, the evaluation window here runs from the last contact, not from the end of the sending period.

Why: multi-factor authentication, continuous authentication and secured communication form the tenth area of measures in Germany (§ 30(2) no. 10 BSIG) and appear in the catalogue of § 32(4) NISG 2026 in Austria. A technically rolled-out MFA loses its value if employees approve confirmations on request — this remainder is training material, not a configuration problem. If a genuine incident in this category reaches the reporting threshold, the deadlines from the section "Escalation plan" apply.

Q4: AI phishing + deepfakes

Q4 closes the cycle with the AI-supported variants, in which the classic detection characteristics such as spelling mistakes no longer apply.

What to do: shift detection characteristics from the surface of the text to the process — calling back on known numbers instead of the one given in the message, the four-eyes principle for payment approvals, a defined return channel for unusual instructions from management level. Simulation 4 again goes to all employees as a full survey so that the year-on-year comparison with the baseline from Q1 uses the same population.

Regulatory context: the AI Act (Regulation (EU) 2024/1689) has applied in principle since 2 August 2026; different dates apply to individual chapters (Art. 113 AI Act). Art. 50(4) AI Act obliges deployers who generate or manipulate deepfakes to disclose that the content has been artificially generated or manipulated; Art. 50(2) requires providers to mark synthetic audio, image, video or text content in a machine-readable format as artificially generated. Whether and how these obligations carry over to simulation content used internally is a question of the individual case — clarify this with a lawyer before you generate deepfake material yourself for Q4. The question only arises if you produce your own synthetic material: Q4 can also be run without self-generated content — with documented case examples, with the material of the awareness platform in use and with a pure process exercise (calling back on the known number, the four-eyes principle for payment approvals).

Tool comparison: providers and transfer basis

The following table summarises the providers named in the original version, with location and transfer basis. Whether the list reflects the market in full is not stated by this article.

All market figures in this article — the list of providers, location and transfer basis, the suitability assessments below the table and the indicative click-rate values in the section "Evidence" — come from the original version (as at: 2 May 2026) and were not newly researched for this update. This article does not name prices: they depend on the number of employees, the scope of modules and languages, the simulation channels (email, telephone, SMS) and the contract term, and are to be requested from the provider as a quote.

On suitability, the original version comments on only two providers, as a practical assessment without its own testing: it names SoSafe for small and medium-sized enterprises in the DACH region because of multilingualism (German, English, French, Italian) and anonymised evaluation, and KnowBe4 for entities certified to ISO 27001 because of its extensive reports. Whether the anonymisation supports a works agreement under § 87(1) no. 6 BetrVG is something you check against the following set of criteria.

What procurement asks before placing an order. Because the original version does not state suitability for the remaining providers, the decision is driven not by the list but by a set of criteria — derived from what this concept already requires elsewhere:

• Anonymisation that supports a works agreement under § 87(1) no. 6 BetrVG: aggregated evaluation without any inference about individual employees (Q0, point 1).
• A data processing agreement with the minimum content of Art. 28(1) and (3) GDPR (Q0, point 3).
• Hosting location or transfer basis — the second column of the table.
• The languages in which the workforce actually works; otherwise the module and the simulation reach only part of the target group.
• A phish reporting button for the email client, otherwise the reporting rate as the second metric is missing (section "What runs all year round").
• Evaluation broken down by role, otherwise the Q2 comparison for financial accounting, procurement and the management body cannot be made.
• A change of channel to telephone and SMS, otherwise Q3 cannot be carried out with the tool.
• Separately reportable proof of participation for the management level, otherwise it has to be maintained outside the tool.

The three data protection checkpoints from Q0 — legal basis, data processing agreement and threshold check for the data protection impact assessment — belong in time before the contract is signed, not in the roll-out phase.

Escalation plan

The escalation plan separates two cases that are often mixed up in practice: the response to a click in the simulation and the response to a genuine incident. A click in the simulation is an occasion for learning; the reporting obligations in the following table, by contrast, attach to a significant security incident or to a personal data breach.

For a genuine incident, the threshold is defined by law: what must be reported is the significant security incident — an incident that has caused or is capable of causing severe operational disruption of the services or financial loss for the entity, or that has affected or is capable of affecting other natural or legal persons by causing considerable material or non-material damage (§ 2 no. 11 BSIG; in Austria § 35(1) no. 1 and 2 NISG 2026, where no. 1 refers to "severe financial losses").

The Austrian legal sources in this table apply from 1 October 2026 (§ 51(1) and (2) NISG 2026); the German obligations have applied since 6 December 2025. The reporting channels also differ: in Germany, incident reports go to the joint reporting office of the Federal Office for Information Security (BSI) and the Federal Office of Civil Protection and Disaster Assistance (BBK) (§ 32(1) BSIG), in Austria to the competent sector-specific CSIRT and, in the absence of one, to the national CSIRT (§ 34(1) NISG 2026). The deadlines in Art. 33 and 34 GDPR apply in both countries irrespective of this.

Evidence: what you can present to the supervisory authority

What is presented is one dossier per quarter: date, attendance list and content of the module, quiz result, aggregated click rate compared with the baseline, reporting rate via the internal reporting channel, follow-up measures taken such as coaching or a repeat session, and the separately maintained proof of participation for the management level (practice recommendation of this concept). Which evidence is due when is shown by the deadline table in the section "Austria (NISG 2026)".

Those who did not take part (practice recommendation). The attendance list is the central artefact of the dossier — and it becomes patchy as soon as illness, parental leave or shift work intervene. Therefore set a catch-up deadline for missed quarterly modules, for example by the end of the following quarter, and document every non-participation with the reason and the catch-up date. For new joiners, the onboarding rule from Q1 applies.

Anyone already certified to ISO/IEC 27001:2022 will find training and awareness as a separate control in Annex A of the standard. ISO 27001 addresses the requirements of Section 30 BSIG structurally in all ten areas, but congruently in none; the sister article rates the likelihood of a gap in this area as medium.

How to measure the result. For the documented click rate to be assessable, it needs a yardstick. The following indicative values are not statutory thresholds; the original version bases them on the KnowBe4 Phishing Industry Benchmarks Report 2025 (as at: 2 May 2026, not newly researched for this update).

Supervision, management body and fine framework

Supervision is exercised in Germany by the BSI and in Austria by the Federal Office for Cybersecurity (Bundesamt für Cybersicherheit); the management body is subject to its own implementation and monitoring duty, and a breach of the risk management obligation is subject to fines in both countries.

Who supervises

Supervision is exercised in Germany by the Federal Office for Information Security (§ 1 BSIG) and in Austria by the Cybersecurity Authority (Cybersicherheitsbehörde, Austria) — the Federal Office for Cybersecurity, directly subordinate to the Federal Minister of the Interior (§ 3a(1) and (2) NISG 2026). In Germany, the BSI is at the same time the competent administrative authority for fines (§ 65 BSIG); in Austria, the district administrative authority (Bezirksverwaltungsbehörde) imposes the administrative penalties (§ 44(1) NISG 2026), while supervision remains with the Cybersecurity Authority.

What affects the management body personally

The management body is under a twofold obligation: it must implement the risk management measures under Section 30 BSIG and monitor their implementation (§ 38(1) BSIG); if it breaches these duties, it is liable to its entity for culpably caused damage under the rules of the company law applicable to the legal form (§ 38(2) BSIG). The NISG 2026 contains no corresponding express internal liability rule in § 31 — this is the sharpest difference between the two legal systems for the management level. For this concept that means: the proof of participation for the management level under § 38(3) BSIG and § 31(2) NISG 2026 is maintained separately from the workforce dossier, because it evidences a separate obligation and, in the event of a dispute, supports the monitoring duty under § 38(1) BSIG.

Fine framework

What is subject to fines is the breach of the risk management obligation under Section 30 BSIG as a whole — and therefore also the area of measures "training and awareness-raising" under § 30(2) no. 7 BSIG; the sister article on Section 30 BSIG records that breaches of duty are subject to fines irrespective of the individual area, and, in its practical assessment, lists the absence of a phishing simulation as a typical audit finding in 2026. The framework for infringements of the risk management and reporting obligations: in Germany up to EUR 10 million against particularly important entities (§ 65(5) sentence 1 no. 1(a) BSIG) and up to EUR 7 million against important entities (§ 65(5) sentence 1 no. 1(b) BSIG); the turnover variant of 2% or 1.4% of total worldwide turnover applies only from a total turnover of more than EUR 500 million (§ 65(6) and (7) BSIG). In Austria the framework is up to EUR 10 million or 2%, or up to EUR 7 million or 1.4% of worldwide annual turnover, whichever amount is higher (§ 45(2) and (3) NISG 2026). The classification of the frameworks in other respects is dealt with by the article on Section 30 BSIG.

Austria (NISG 2026): same training obligation, different legal source

In substance the training obligation works the same way — it is set out in a different norm and becomes applicable later; which legal source applies to what is set out in the section "Legal framework". What appears only here is the schedule: Germany has been in enforcement since December 2025, Austria only starts in October 2026, and all further deadlines depend on that.

For the quarterly concept only one thing follows from this: the way the modules and simulations are cut can be used unchanged in both countries; what differs is the legal source, the supervisory authority and the point in time from which the dossier has to be available.