The National Cybersecurity Authority's Essential Cybersecurity Controls and the Saudi Central Bank's Cyber Security Framework both require institutions to deliver security-awareness training. But when examiners review your program, they distinguish structured, role-based curricula from annual compliance videos. They look for evidence that training changes behavior, not just that employees clicked through slides.
This NCA ECC security awareness training checklist walks through the eight program elements that satisfy NCA ECC Article 5.3.1 and SAMA CSF Domain 2.1.1. Each element includes what to prepare, how to document delivery and which metrics prove effectiveness to regulators.
Why Regulators Expect More Than Completion Rates
The NCA ECC Article 5.3.1 requires organizations to implement security-awareness programs that address relevant threats and are tailored to roles. SAMA's Cyber Security Framework Domain 2.1.1 similarly mandates awareness and training activities that reflect the institution's risk profile and the responsibilities of personnel.
Both frameworks expect evidence of three outcomes: that employees understand the threats relevant to their work, that they apply secure practices in daily tasks, and that the institution measures and improves these behaviors over time. A single annual video followed by a quiz does not demonstrate any of these.
Examiners review program plans, attendance records, assessment results, remediation logs and metrics that track behavior change. The following checklist organizes these expectations into actionable items.
The Eight-Element Checklist
1. Annual Awareness Plan and Calendar
What it is: A written plan that identifies training topics, target audiences, delivery methods, responsible owners and scheduled dates for the year.
Why it matters: Regulators expect awareness to be planned, not reactive. A calendar shows that training is integrated into the institution's operations and that coverage is systematic across all user groups.
What to prepare:
- List of topics aligned to your risk register and threat landscape (phishing, social engineering, data handling, incident reporting, secure remote work).
- Role-based audience segments (general staff, managers, IT administrators, developers, executives, board members).
- Delivery schedule with quarterly or monthly sessions, not a single annual event.
- Named owners for each session and accountability for completion tracking.
Documentation: Maintain the plan as a controlled document, reviewed and approved by the CISO or equivalent, and updated when the risk profile changes.
2. Board and Executive Briefings on Emerging Threats
What it is: Periodic briefings that equip board members and senior executives to understand current cyber risks, regulatory changes and their governance responsibilities.
Why it matters: The NCA ECC and SAMA CSF both assign accountability to senior management and boards. Regulators expect evidence that these individuals receive tailored information, not the same content delivered to general staff.
What to prepare:
- Quarterly or semi-annual briefing sessions focused on strategic risks, not technical details.
- Topics such as ransomware trends in the Kingdom, regulatory updates, third-party risk, incident-response governance and cyber-insurance considerations.
- Materials in Arabic and English, depending on board composition.
- Opportunity for questions and discussion, documented in minutes.
Documentation: Attendance records, presentation decks and board minutes that reflect cybersecurity as a standing agenda item.
3. Role-Based Training Sessions for Technical Teams
What it is: Specialized training tailored to the responsibilities of IT administrators, developers, database administrators, network engineers and other technical staff.
Why it matters: General awareness content does not address the specific threats and secure practices relevant to privileged users. Regulators expect institutions to recognize that a developer's training needs differ from those of a finance officer.
What to prepare:
- Secure-coding modules for developers (input validation, authentication, session management, secrets management).
- Privileged-access and identity-management training for system administrators.
- Secure-configuration and patch-management sessions for infrastructure teams.
- Incident-detection and response procedures for security operations personnel.
Documentation: Session agendas, attendance sheets, practical exercises or labs completed, and assessment results that verify comprehension.
4. Phishing Simulations With Remediation Loops
What it is: Simulated phishing campaigns sent to employees, followed by immediate training for those who click or provide credentials, and tracking of improvement over successive campaigns.
Why it matters: Phishing remains the most common initial-access vector. Regulators expect institutions to test employees' ability to recognize and report phishing, not just to tell them it exists.
What to prepare:
- Monthly or quarterly simulated campaigns with varied lures (invoice, password reset, executive request, delivery notification).
- Immediate micro-training for users who fail, delivered at the moment of the click.
- Escalation or additional training for repeat offenders.
- Metrics that track click rates, reporting rates and trends over time.
Documentation: Campaign reports showing number of emails sent, number clicked, number reported, and remediation actions taken. Trend analysis that demonstrates improvement or identifies high-risk groups.
5. Quarterly Refreshers and Topical Campaigns
What it is: Short, focused sessions or communications throughout the year that reinforce key messages and address emerging threats or seasonal risks.
Why it matters: A single annual training session does not sustain behavior change. Regulators expect ongoing reinforcement aligned to the threat environment.
What to prepare:
- Quarterly refresher sessions (15 to 30 minutes) on topics such as password hygiene, mobile-device security, travel security or social-media risks.
- Topical campaigns triggered by events (new ransomware variant, regulatory update, observed increase in phishing targeting the sector).
- Posters, emails, intranet articles and other campaign materials that keep security visible.
Documentation: Campaign calendar, distribution lists, open rates for emails, attendance for live sessions, and feedback or questions received.
6. Attendance and Completion Records
What it is: A centralized record of who attended which sessions, when, and whether they completed required assessments.
Why it matters: Regulators audit coverage. You must demonstrate that all employees, contractors and relevant third parties received appropriate training within the required timeframe.
What to prepare:
- Roster of all personnel, segmented by role and training requirements.
- Attendance sheets or learning-management-system logs for each session.
- Tracking of overdue or incomplete training, with follow-up actions.
- Records of training provided to new hires during onboarding.
Documentation: Spreadsheet or system report showing training status by individual, by department and by role. Evidence of follow-up for non-compliance.
7. Assessment Results That Verify Comprehension
What it is: Quizzes, practical exercises or scenario-based assessments that measure whether participants understood and can apply the training content.
Why it matters: Completion is not the same as comprehension. Regulators expect evidence that training achieved its learning objectives.
What to prepare:
- Short assessments (5 to 10 questions) at the end of each session, with a passing threshold (for example, 80 percent).
- Practical exercises for technical training (configure a firewall rule, review code for a vulnerability, respond to a simulated incident).
- Scenario-based questions for executives (how would you escalate a ransomware event, what questions would you ask the CISO).
- Remediation for individuals who do not pass, followed by reassessment.
Documentation: Assessment scores by individual and by session, analysis of common wrong answers to improve content, and records of remediation.
8. Annual Program Review and Continuous Improvement
What it is: A formal review of the awareness program's effectiveness, conducted annually, that examines metrics, feedback, incidents and regulatory changes, and results in an updated plan.
Why it matters: Both the NCA ECC and SAMA CSF expect institutions to measure and improve their controls. An annual review demonstrates that the program is managed, not static.
What to prepare:
- Metrics summary: training completion rates, phishing-simulation trends, assessment scores, incident reports linked to user behavior.
- Feedback from participants, managers and the security team.
- Gap analysis against regulatory updates or new threats.
- Recommendations for the next year's plan (new topics, different delivery methods, additional role-based content).
Documentation: Annual program-review report, presented to senior management or the board, with approval of the updated plan and budget.
What to Prepare Before an Examination
When regulators review your awareness program, assemble the following evidence:
- Current annual awareness plan and calendar.
- Attendance and completion records for the past 12 months, segmented by role.
- Phishing-simulation reports showing trends and remediation.
- Assessment results and evidence of follow-up for low scores.
- Board and executive briefing materials and attendance records.
- Annual program-review report with metrics and improvement actions.
- Samples of campaign materials (emails, posters, intranet articles) in Arabic and English.
Organize these documents in a folder structure that mirrors the checklist elements. Label each file with the date, audience and topic. This preparation reduces examination time and demonstrates program maturity.
How We Build Awareness Programs That Satisfy Regulators and Change Behavior
Our Cybersecurity Awareness & Training service delivers awareness programs, executive briefings and role-based training that meet regulatory requirements and change behavior. We build programs around your real risks, equip boards to ask the right questions and deliver role-based training for technical teams. Our deliverables include an annual awareness plan and calendar, board and executive briefing, role-based training sessions, awareness metrics and reporting, and campaign materials. Content is available in Arabic and English. We offer annual programs or individual sessions, and sessions can be delivered at your premises in Riyadh or elsewhere in the Kingdom, or remotely.
If you are responsible for an awareness program at an NCA-regulated or SAMA-regulated institution and need to demonstrate compliance with structured evidence, we can help you build, document and measure a program that satisfies examiners and reduces risk.
