Security and Privacy Essentials, a six-unit course with Unit 1 built
Security awareness training usually arrives as a forty-minute slide deck with a quiz at the end. I designed this course as six short units that each stand on their own. From Unit 2 onwards, every unit opens by asking the learner to use something from an earlier one, so the spacing between units does the work of revision. This page sets out the outcomes, the units, the experience map and the assessment. Unit 1 is built in full and runs in a lesson shell that opens each step only after the previous one is finished.
Unit 1 takes about nine minutes on a computer or a phone. The film needs the sound on, and you don't need to sign up.
Play Unit 1The course is for all staff and takes about thirty minutes in total at the learner's own pace. It is delivered as SCORM 1.2 and on the mobile web, so a learner can stop and pick it up again later. I was the learning experience designer and did both the design and the build. The design follows backward design, with measurable outcomes written in ABCD form and tagged with Bloom levels. Assessment is constructively aligned with the outcomes (Biggs), and evaluation uses Kirkpatrick's four levels. The content draws on the published texts of ISO 27001, 27002 and 27701, the GDPR and NIS2.
The brief and the design decisions
ISO 27001 clause 7.3 requires everyone who works under the organisation's control to know the security policy and what it means if they don't follow it. ISO 27002 §6.3 describes the awareness training that gets them there. GDPR Art.32(4) requires the controller and the processor to make sure that anyone with access to personal data processes it only on their instructions. For essential and important entities under NIS2, Art.20(2) requires the members of the management body to follow cybersecurity training and asks Member States to encourage those entities to offer similar training to their staff on a regular basis. Art.21(2)(g) lists basic cyber hygiene practices and cybersecurity training among the risk-management measures those entities have to take. On an ordinary working day, employees meet phishing, unlabelled data, unlocked screens and incidents nobody reports. A policy PDF does little to change how they handle any of it.
I counted the course as a success only if it produced the behaviours the organisation needs and can show to an auditor. Every unit is set in the learner's own inbox, desk and working week, because training that ignores daily work gets clicked through without changing anything.
The course is for everyone, whether they work in the office, from home or on the front line. Digital fluency differs from person to person, no security vocabulary is assumed and nobody has much time to spare. Because prior knowledge is so uneven, the design keeps the way in easy. It also tries to show each learner within the first twenty seconds why the topic matters to them.
Training can build recognition, good small decisions and a habit of reporting. It cannot replace technical controls or fix a culture that punishes reporting, so I raised those two points with the control owner as conditions the environment has to meet.
The five outcomes the course is built around
Each outcome is written with its audience, behaviour, condition and degree. Every outcome also carries a Bloom level and a type of knowledge. The degree is what later makes the assessment criterion-referenced.
| # | Outcome | Bloom | Knowledge type |
|---|---|---|---|
| O1 | Given a realistic stream of messages, identify the signs of phishing and social engineering and choose the safe action in at least four of five scenarios | Understand → Apply | Conceptual and procedural |
| O2 | When signing in to work systems, apply the credential rules (a unique secret for each system, MFA, never sharing authentication data) in four of four cases | Apply | Procedural |
| O3 | Given a piece of information, classify it and select how to handle, label and send it for its class, with no errors on the most sensitive class | Apply | Conceptual and procedural |
| O4 | In their own workspace, demonstrate the end-of-day security habits by finding every risk planted in a scene | Apply | Procedural |
| O5 | Given a suspected incident, decide whether to report it and route it straight away, in at least four of five cases and with one item that has to be right | Apply → Evaluate | Procedural and metacognitive |
Every unit ends with a ten-second question in which learners ask themselves where this would have caught them in the past week. The question is there to tie each outcome to the learner's own working week.
The six units and how each one reuses the last
Each unit has a single objective, lasts between three and nine minutes and works on its own. The format changes from one unit to the next so that no two in a row feel the same. Spacing comes from a chain of retrieval instead of a calendar. From Unit 2 onwards, each unit opens by asking the learner to use earlier material in a new decision instead of reading it again.
| Unit | Outcome | Time | What the learner does | Learning type | What it retrieves |
|---|---|---|---|---|---|
| U1, spotting a phishing email | O1 | 9 min | Judges three realistic messages before any explanation and sees the answers. Then watches the four tells in a film, practises in an inbox, reads about the tells and answers six questions | Practice and acquisition | Nothing, because the opening probe is the hook |
| U2, passwords and signing in | O2 | 4 min | Follows one reused password to a company-wide breach, then sorts passwords into strong, weak and shared | Acquisition and practice | Spotting the tells from U1 |
| U3, classifying information | O3 | 5 min | Classifies their own documents by tapping, then learns how each class is handled and sent | Practice and inquiry | The credential rule from U2 |
| U4, the end of the working day | O4 | 3 min | Hunts for the risks hidden in an office at the end of the day and at a desk at home | Practice | Classification from U3 |
| U5, reporting a mistake early | O5 | 5 min | Plays a branching story about a file sent to the wrong client and watches two timelines play out | Practice and discussion | The end-of-day habit from U4 |
| U6, a whole working day | all | 4 min | Works through one continuous workday with five new decisions that cover O1 to O5 | Practice that integrates the course | All five outcomes together |
Units 2 and 5 begin with the experience and bring in the concept after a concrete case. The other units begin with practice and keep the concept light, so none of them is shaped like a lecture.
What the learner goes through from start to finish
This is the map I built the course from. For each stage it shows what the learner is doing and how much load the moment can carry. It also shows how the moment should feel and what might make the learner give up.
| Stage | Event | Cognitive load target | How it should feel | Risk to motivation and the answer to it |
|---|---|---|---|---|
| Entry | The assignment lands in the LMS | Not applicable | Expect scepticism and some annoyance | The unit opens with a first impression of three messages, trust or report, before anything is explained |
| U1 probe | The learner misjudges a phish | Low, with simple content on uncluttered screens | A useful jolt when they realise the message got them | Feedback that never shames: it says the message was built to fool people and points to the tell |
| U2 to U4 | Short practice that the learner gets right | Medium, with one concept per unit and a worked example first | Competence that grows in small, visible steps | Monotony is the risk, so the formats rotate and no two units in a row are alike |
| U5 | The branching story about the wrong file | The hardest content in the course | A planned dip with some anxiety in the timeline where the learner sits on the mistake, resolved by rehearsing the report | This dip is the centre of the course, because it is where the learner has to feel that reporting is safe and simple |
| U6 | A day that brings everything together | Medium to high, with outcomes interleaved | Framed as a test of confidence | A fail sends the learner back to one unit only, which keeps the cost of failing low |
| After | An optional booster and a commitment at exit | Low | A nudge to see themselves as part of the security system | The commitment stays concrete enough to check, such as "I'll set up MFA on X today" |
To keep the load manageable, each unit has one objective and a worked example comes before independent practice. The labels for the tells sit on the message itself, so attention never has to split between two places. Scenes are visual with short text, and the narration never repeats the words on screen. The whole course fits into sessions the length of a commute.
How the course is assessed
Learners are assessed against criteria and never ranked against each other. Unit 6 gives five new scenarios that each combine several outcomes. A learner passes with at least four of the five, as long as the critical item is correct. The critical item asks them to report a suspected breach of personal data straight away, even though they caused it. Under the GDPR the organisation has 72 hours to notify the supervisory authority of a personal data breach that puts people at risk, and an entity covered by NIS2 has 24 hours to send an early warning about a significant incident. A breach that someone keeps quiet about uses up that time before anyone can act on it, so knowing the password rules cannot make up for getting this item wrong. A learner who fails goes back to the unit that owns the outcome and gets one more attempt at a variant.
The three probes at the start of Unit 1 are diagnostic. They come before any teaching and are not scored, and each answer shows the learner how far a first impression can be trusted before the film explains the case. Every unit is formative practice in making decisions, with as many retries as the learner wants. The feedback explains the tell behind each verdict. Only Unit 6 is summative.
| Outcome | Taught by | Assessed by | Bloom match |
|---|---|---|---|
| O1 phishing | The U1 probe and the worked example in the film | The decisions in U1 and U6 | Understand and Apply ✔ |
| O2 credentials | The case and the sort in U2 | The sort in U2 and U6 | Apply ✔ |
| O3 classification | Practice on the learner's own documents in U3 | The items in U3 and U6 | Apply ✔ |
| O4 workspace | The hidden-risk scenes in U4 | The hunt in U4 and U6 | Apply ✔ |
| O5 reporting | The branching timelines in U5 | U5 and the critical item in U6 | Apply and Evaluate ✔ |
Evaluation follows Kirkpatrick's four levels. Two exit questions cover level 1, and the criterion pass covers level 2, with the pass rate on the critical item reported separately. At level 3 I look at the click rate and report rate in phishing simulations and at how long people take to report real incidents. Level 4 is the share of all incidents caught early, and it is level 3 that decides what gets redesigned.
Unit 1 as it is built
Unit 1 runs in a lesson shell I built, with a list of steps, a progress bar and progress saved on the learner's device. Each step opens only when the one before it is finished: the three probes answered, the film watched to the end, every tell in the inbox flagged without a false alarm, and five of the six final questions right.
- The unit opens with three messages that the learner trusts or reports before anything has been explained. These answers are not scored, and each one explains the tell behind it.
- A film of about two minutes works through the four tells scene by scene. Near the start it pauses for a few seconds so the learner can pick out the fake email.
- In the inbox simulator the learner opens three messages and flags the nine tells hidden in them. Every message also has normal parts, and flagging one counts as a false alarm, so clicking everything does not pass. A second attempt keeps the flags that were correct.
- A longread of about 450 words explains the four tells to a reader who is short of time.
- Six questions after the lesson check the four tells, and each answer explains why it is right or wrong.
- The unit closes with one habit to keep and a private question about which message came closest to fooling the learner this week.
Play Unit 1 It takes about nine minutes, and the film needs the sound on.
What exists beyond Unit 1
Units 2 and 3 are built in the same shell but are not published here. Units 4 to 6 exist as lesson plans without built screens. The course belongs to a catalogue of 25 courses on compliance, security, privacy and health and safety, designed at programme level. I took this one as far as built units to show how a performance gap turns into something a learner can play. All of the content is based on published standards and EU legislation.