Social engineering preparedness
Simulated social engineering tests behaviour, and it carries a privacy duty.
What the published 2016 guidance says
Simulated social engineering tests behaviour, and it carries a privacy duty. The construct proposes four figures: the share who clicked; one minus the share who reported the message through the proper channel; the share who followed the instruction after clicking; and a weighted combination. Illustrative bands are red from 0 to 60, yellow from 60 to 80 and green from 90 to 100. Evidence is the activity on a simulated control address, with participants anonymised so that no one fears a penalty. It is collected monthly to annually, depending on the risk. The security lead owns it and a trained collector runs it.
What it means in practice
Simulated phishing is a behaviour measure, and it carries privacy risk. Anonymise the data, define the response categories in advance, and report the weighted result with the test method. A click rate alone can shame people and teach them to hide the next click.
Status of this record. For B.15, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Agree the test method, the response categories and the privacy rules before the exercise. Anonymise the results. Report the weighted outcome with the test detail and the agreed treatment. Do not use the result to name individuals.
Evidence an assessor asks for
- Awareness and trainingSimulation design and anonymisation approach
- Incident managementClick, report and credential-entry counts
- PrivacyTest report with recommendation and agreed treatment
The question an assessor will ask
An assessor will ask for simulation design and anonymisation approach. The test for B.15 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Individuals named in results, defeating the privacy safeguard
- Reporting channel not measured, so only clicks are counted
Before the next review
Before the next review, test this against one live record: individuals named in results, defeating the privacy safeguard.
What to check when the revision publishes
When DIS 27004 is published, compare the B.15 Social engineering preparedness record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.