Phishing Simulation
What is Phishing Simulation?
Controlled tests that send simulated phishing emails to employees to measure susceptibility and reinforce security awareness training.
Terms that appear alongside phishing simulation
Each of these is named in at least one of the same controls as phishing simulation. The number is how many controls name both.
- phishing 11 shared controls
- audit 5 shared controls
- cybersecurity 5 shared controls
- nist 4 shared controls
- insider threat 4 shared controls
- remediation 3 shared controls
- security awareness 3 shared controls
- compliance 3 shared controls
Frameworks that govern phishing simulation
What the standards actually require on phishing simulation
Requirements naming phishing simulation across 6 standards, quoted from the control text.
Lloyds MS11.7 Threat Detection and Security Monitoring - 24/7/365 Security Operations Centre (SOC) capability internal or via Managed Security Service Provider (MSSP) + Security Information and Event Management (SIEM) covering identity + network + endpoint + c...
LLOYDS-MS11-Threat-Detection-Security-Monitoring-Email-Phishing-Defences-MS11-7-12-SOC-EDR-XDR-SIEM · Lloyds MS11 Threat Detection + Security Monitoring + Email + Phishing + MS11.7-12 →Operate IAM + workforce security + training across the retail enterprise per NRF framework. IAM must (a) implement multi-factor authentication for all employees + contractors + service accounts where feasible + with priority for privileged access + remote acce...
NRFCS-6 · Identity and Access Management, Workforce Security, Training and Awareness →Operate cyber hygiene + security awareness per OSFI B-13 Domain 5. Cyber hygiene must (a) maintain patch management with risk-based prioritisation + KEV-driven remediation + (b) configuration management with hardened baselines + drift detection + (c) vulnerabi...
OSFIB13-5 · Cyber Hygiene and Security Awareness →Conduct random testing (e.g. phishing simulations) to measure the effectiveness of the awareness programme.
ASIC-CR-AT-3 · Random staff testing →All personnel complete annual security awareness training with role-based content and phishing simulations.
IS-X.A.1 · Security Awareness Training →FIRST CSIRT Services Framework v2.1 Service Area 5 - Knowledge Transfer. SCOPE: building cybersecurity capacity in the constituency + the broader community through awareness + training + exercises + advisory.
FIRST-CSIRTF-SA5-KnowledgeTransfer · Service Area 5 - Knowledge Transfer (Awareness, Training, Exercises, Advisory) →Questions people ask about phishing simulation
What is Phishing Simulation?
Why is Phishing Simulation important for compliance?
Which compliance frameworks address Phishing Simulation?
Where can I learn more about Phishing Simulation?
See how Phishing Simulation applies across compliance frameworks
Our platform maps 686 frameworks with 311K cross-framework control mappings. Explore how this concept is addressed across standards.