Phishing Simulation
What is Phishing Simulation?
Controlled tests that send simulated phishing emails to employees to measure susceptibility and reinforce security awareness training.
Terms that appear alongside phishing simulation
Each of these is named in at least one of the same controls as phishing simulation. The number is how many controls name both.
- phishing 11 shared controls
- audit 5 shared controls
- cybersecurity 5 shared controls
- nist 4 shared controls
- insider threat 4 shared controls
- remediation 3 shared controls
- security awareness 3 shared controls
- compliance 3 shared controls
Frameworks that govern phishing simulation
What the standards actually require on phishing simulation
Requirements naming phishing simulation across 6 standards, quoted from the control text.
Operate IAM + workforce security + training across the retail enterprise per NRF framework. IAM must (a) implement multi-factor authentication for all employees + contractors + service accounts where feasible + with priority for privileged access + remote acce...
NRFCS-6 · Identity and Access Management, Workforce Security, Training and Awareness →Operate cyber hygiene + security awareness per OSFI B-13 Domain 5. Cyber hygiene must (a) maintain patch management with risk-based prioritisation + KEV-driven remediation + (b) configuration management with hardened baselines + drift detection + (c) vulnerabi...
OSFIB13-5 · Cyber Hygiene and Security Awareness →Conduct random testing (e.g. phishing simulations) to measure the effectiveness of the awareness programme.
ASIC-CR-AT-3 · Random staff testing →FIRST CSIRT Services Framework v2.1 Service Area 5 - Knowledge Transfer. SCOPE: building cybersecurity capacity in the constituency + the broader community through awareness + training + exercises + advisory.
FIRST-CSIRTF-SA5-KnowledgeTransfer · Service Area 5 - Knowledge Transfer (Awareness, Training, Exercises, Advisory) →Audit + Drills + Training operationalise the Directions through ongoing assurance + cyber preparedness. (1) CERT-In Cyber Security Audit: organisations should undergo periodic cyber security audit by CERT-In Empanelled Information Security Auditing Organisatio...
CERTIN-Audit-Drills-Training-AwarenessProgram-CERTInExercises-CISO · CERT-In Audit + Cyber Security Drills + Training + Awareness + CERT-In Cyber Exercises + CISO + Information Security Auditor Empanelment →Standard 7 per Section 35 + the Schedule of the Jamaica Data Protection Act 2020: Personal data shall be processed in a manner that ensures appropriate security including protection against unauthorised or unlawful processing + accidental loss + destruction or...
JM-DPA2020-Standard7-Security-Sec35-Appropriate-Technical-Organisational-Confidentiality-Integrity-Availability-Resilience · Jamaica DPA 2020 Standard 7 - Security + Section 35 + Appropriate Technical and Organisational Measures + Confidentiality + Integrity + Availability + Resilience + Encryption + Pseudonymisation + Risk-Based Security →Questions people ask about phishing simulation
What is Phishing Simulation?
Why is Phishing Simulation important for compliance?
Which compliance frameworks address Phishing Simulation?
Where can I learn more about Phishing Simulation?
See how Phishing Simulation applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.