The National Cybersecurity Authority amended Essential Cybersecurity Controls (ECC) Control 1-4-1 in April 2025, introducing two explicit simulation requirements that many regulated entities have not yet incorporated into their security-awareness programs. The NCA ECC control 1-4-1 update shifts the compliance baseline from general awareness training to documented, repeatable social-engineering exercises with measurable outcomes. CISOs and security-awareness managers at NCA-regulated entities now face a clear expectation: demonstrate through timestamped evidence that employees are tested against realistic attack scenarios and that the organization tracks improvement over time.
This article explains the two new simulation types mandated by the amendment, the quarterly frequency expectation embedded in the revised control language, and the three baseline metrics—click rate, reporting rate, and time-to-report—that auditors now verify during inspections. It also describes the evidence format that satisfies the requirement and when organizations should consider updating their training programs to align with the new standard.
What Changed in Control 1-4-1
Before April 2025, Control 1-4-1 required organizations to provide cybersecurity awareness training to employees but left the format and content largely to the discretion of the CISO. Many entities satisfied the control through annual classroom sessions, e-learning modules, or periodic newsletters. The amendment introduces two specific simulation exercises that must be conducted and documented:
Phishing simulations: Controlled campaigns that send realistic phishing emails to employees, measuring who clicks on malicious links or attachments and who reports the message to the security team.
Vishing exercises: Voice-based social-engineering tests, typically delivered via telephone, that attempt to elicit sensitive information or credential disclosure through impersonation or pretexting.
The revised control language does not prescribe a minimum number of campaigns per year, but the accompanying implementation guidance published by the NCA in the same month references a quarterly cadence as the expected baseline for continuous improvement. Auditors interpreting the control during inspections now ask for evidence of at least four phishing campaigns and four vishing exercises over the preceding twelve months, with documented metrics for each.
The Two Simulation Types and Their Scope
Phishing Simulations
A compliant phishing simulation replicates the tactics, techniques, and procedures of real-world phishing attacks without causing harm. The simulation platform or manual process must:
- Deliver emails that mimic current threat patterns, including credential-harvesting pages, malicious attachments, and business-email-compromise scenarios.
- Track individual and aggregate behavior, recording who opened the email, who clicked a link, who entered credentials on a simulated landing page, and who reported the message using the organization's designated channel.
- Generate timestamped reports that capture campaign parameters (sender domain, subject line, target population) and outcome data.
The simulation should cover a representative sample of the workforce, not just a single department. Auditors expect to see evidence that campaigns rotate through different attack vectors—payroll fraud, IT helpdesk impersonation, executive requests—so that employees encounter varied scenarios over the year.
Vishing Exercises
Vishing exercises test employees' response to voice-based social engineering. A compliant exercise typically involves:
- A trained caller or automated system that contacts employees and attempts to extract sensitive information, such as employee IDs, system credentials, or details about internal processes.
- A documented script or scenario that aligns with realistic threat actor behavior, such as impersonating IT support, human resources, or a vendor.
- A mechanism to record whether the employee disclosed information, challenged the caller's identity, or reported the suspicious call to the security team.
Vishing exercises are more resource-intensive than phishing simulations because they require human interaction or sophisticated voice-synthesis technology. Organizations often conduct vishing tests on a smaller sample of employees each quarter, rotating through departments to ensure broad coverage over the year.
The Three Baseline Metrics Auditors Verify
The April 2025 amendment does not specify numerical thresholds for success, but it requires organizations to establish and track baseline metrics that demonstrate awareness program effectiveness. Auditors now check for three specific measurements in inspection documentation:
Click rate: The percentage of recipients who clicked a link or opened an attachment in a phishing simulation. This metric establishes the initial susceptibility level and tracks improvement as campaigns continue.
Reporting rate: The percentage of recipients who reported the phishing email or vishing call to the designated security channel (email alias, ticketing system, or hotline) within a defined period. A rising reporting rate indicates that employees recognize suspicious activity and know how to escalate it.
Time-to-report: The median or average time elapsed between the moment an employee receives a phishing email (or vishing call) and the moment they report it. Faster reporting reduces the window of opportunity for a real attacker.
Organizations must document these metrics for each campaign and maintain a trend analysis that shows performance over multiple quarters. A single campaign report is insufficient; auditors expect to see evidence of continuous measurement and, ideally, improvement or stability at an acceptable level.
Evidence Format That Satisfies the Requirement
During an NCA inspection, auditors typically request:
- Timestamped campaign reports for each phishing simulation and vishing exercise conducted in the past twelve months. Each report should include the campaign date, target population size, scenario description, and the three baseline metrics.
- Trend analysis in the form of a summary document or dashboard that aggregates metrics across campaigns, showing click rate, reporting rate, and time-to-report over time. A simple table or line chart is acceptable; the key is to demonstrate that the organization monitors progress.
- Remedial training records that link employees who failed a simulation (clicked a link, disclosed information, or did not report) to follow-up training or coaching. This demonstrates a closed-loop process: test, identify gaps, train, retest.
- Policy or procedure documentation that describes the simulation program's scope, frequency, escalation process, and the channel employees should use to report suspicious messages or calls.
The evidence does not need to come from a commercial simulation platform. Organizations that conduct simulations manually using internal IT resources can satisfy the requirement if they produce the same timestamped reports and trend data. However, manual processes often struggle to scale and maintain consistency, which is why many entities adopt dedicated platforms after the first or second campaign cycle.
When to Update Your Training Program
Organizations should prioritize updating their security-awareness programs if any of the following conditions apply:
- The current program relies solely on classroom training or e-learning modules without any simulation component.
- Phishing simulations are conducted sporadically or only in response to an incident, rather than on a regular schedule.
- Vishing exercises have never been conducted, or the organization has no documented process for testing voice-based social engineering.
- Baseline metrics are not tracked, or campaign reports are stored informally without a centralized repository or trend analysis.
- The next NCA audit or inspection is scheduled within the next six months, and the organization cannot produce twelve months of simulation evidence.
Entities that fall into any of these categories face a compliance gap that will be identified during the next inspection. Addressing the gap requires more than purchasing a simulation tool; it requires designing a program that aligns with the revised control language, training staff to interpret results, and establishing a remediation process for employees who fail simulations.
How a Structured Security-Awareness Program Addresses the Amendment
A structured security-awareness program that meets the April 2025 amendment typically includes the following components:
Program design: Define the simulation cadence (quarterly is the baseline expectation), select phishing and vishing scenarios that reflect current threats, and identify the target population for each campaign. The design phase also establishes the three baseline metrics and the reporting format.
Campaign execution: Conduct phishing simulations and vishing exercises according to the defined schedule. Each campaign should be documented with a timestamped report that captures scenario details, target population, and outcome data.
Metric tracking and trend analysis: Aggregate results from each campaign into a centralized repository. Produce a quarterly or annual trend analysis that shows click rate, reporting rate, and time-to-report over time. This analysis becomes the primary evidence document for audits.
Remedial training: Identify employees who failed a simulation and enroll them in targeted training that addresses the specific weakness (recognizing phishing indicators, challenging caller identity, reporting suspicious activity). Document completion of remedial training in the same system that tracks simulation results.
Policy and procedure documentation: Maintain a written procedure that describes the simulation program, the escalation channel for reporting suspicious messages or calls, and the process for linking simulation failures to remedial training.
Organizations that lack internal resources to design and execute this program often engage external support to establish the initial framework, conduct the first cycle of campaigns, and train internal staff to sustain the program over time.
Preparing for the Next Inspection
Auditors conducting NCA inspections after April 2025 will ask for evidence of the simulation program during the review of Control 1-4-1. The typical audit request includes:
- A list of all phishing simulations and vishing exercises conducted in the past twelve months, with dates and target populations.
- Campaign reports for a sample of simulations, including the three baseline metrics.
- The trend analysis document that shows performance over time.
- Evidence that employees who failed simulations received remedial training.
Organizations that cannot produce this evidence will receive a finding or observation that requires remediation within a specified timeframe, typically ninety days. Remediating the finding involves conducting the missing simulations, establishing the metric-tracking process, and producing the required documentation—all of which takes several months if the organization starts from zero.
The most efficient approach is to begin the simulation program immediately after the amendment takes effect, so that by the time of the next inspection, the organization has accumulated at least three or four quarters of evidence. Waiting until an audit is scheduled leaves insufficient time to demonstrate a continuous program.
Closing: Building a Compliant Security-Awareness Program
The April 2025 amendment to NCA ECC Control 1-4-1 reflects a broader regulatory shift toward measurable, behavior-based security controls. Classroom training alone no longer satisfies the expectation; organizations must now demonstrate through documented simulations that employees can recognize and report social-engineering attacks in realistic conditions.
CISO Consulting delivers customized training programs to build a security-first culture across your organization. If your entity needs to establish a compliant simulation program, document baseline metrics, or prepare evidence for an upcoming NCA inspection, the firm's Security Awareness service provides the structured approach required to meet the revised control language and sustain the program over time.
