By 
An awareness campaign, seen from the CISO, IT, and compliance perspectives, crosses three layers that source documents often treat separately: minimum compliance, operational measurement, and risk pressure. The comparison shows that ISO calls for awareness of policies and requirements, PCI DSS and CIS set onboarding and annual minimums with updates, and NIST, ENISA, and California push for measurement of real behavior through exercises, KPIs, and time-based comparison. With sustained exposure to phishing and the training gap in LATAM, treating the campaign as an annual course or a completion rate is not enough to prove effectiveness or prioritize interventions.
Placed side by side, the sources reveal something they do not show as clearly on their own. The standards set a floor for coverage and evidence, but operational frameworks also call for behavior observation, tracking over time, and targeted decisions by group or function.
| Standard | What it requires | Minimum frequency | What to measure | Audit evidence | Decision it enables | Source |
|---|---|---|---|---|---|---|
| ISO Annex SL 7.3 Awareness | That people under the organization's control are aware of the management system policy, requirements, and any situation or aspect that could affect intended results | not specified | not specified | not specified | Ensure awareness coverage for relevant policies and requirements | ISO |
| PCI DSS 4.0 requirement 12.6 | Ongoing awareness education, a formal program so all personnel know policies, procedures, and their role, program review, onboarding training, inclusion of phishing, related attacks and social engineering, use of multiple methods, and annual acknowledgment of reading and understanding | Onboarding and at least once every 12 months, program review at least once every 12 months | not specified | Staff acknowledgment, at least once every 12 months, that they read and understood policies and procedures | Update content for new threats and vulnerabilities that could affect the cardholder data environment | PCI Security Standards Council |
| CIS Control 14 | Establish and maintain a security awareness and skills program to influence workforce behavior and reduce risk, train people to recognize social engineering including phishing, BEC, pretexting, and tailgating, train on authentication and credential management | Onboarding and at least annually, review and update content annually or when significant business changes occur | Percentage of compliant members calculated as M6/M3; if training age exceeds 12 months, the safeguard receives a score of 0 and fails | Training age and safeguard compliance score | Identify objective noncompliance when training exceeds 12 months and update content for business changes | Center for Internet Security |
| NIST SP 800-50 Rev. 1 | A cybersecurity and privacy learning program as an adaptable life-cycle approach, include metrics and assessment methods to improve the program regularly and update it as needs change, use tactics such as phishing exercises, newsletters, webinars, scenarios, smishing, vishing, games, quizzes, tabletop exercises, and virtual labs | not specified | Current click rates by group or job function, whether the person reported the email as phishing, clicked a link, opened an attachment, percentage of participants who changed a workplace behavior | Program metrics and assessment methods, observable phishing exercise results | Determine whether more focused training is needed by group or job function and improve the program regularly | NIST |
| California SIMM 5320-A and state phishing guidance | Document a plan and policy for simulated phishing exercises, develop key performance indicators and thresholds, record metrics during the exercise, produce a summary report to compare campaigns over time, run quarterly controlled campaigns to test real-time recognition | The guidance recommends quarterly campaigns; the standard does not specify a general minimum frequency | Open rate, click rate, credential submission rate on a simulated page, report rate, time-based comparison between campaigns | Exercise reports must be kept accessible because they may be requested during an audit | Require additional training for staff who do not reach the minimum threshold defined by the entity | California Department of Technology, California Cybersecurity Integration Center |
| ENISA | Run regular phishing simulations, combine capability development, regular assessments of trends and challenges, measurement of cybersecurity behavior, and campaign planning | Regular phishing simulations | Reach, number of people reached, number of incidents reported, positive test results, knowledge increase, qualitative feedback, resources used, and costs | not specified | Identify staff who need additional training and adjust campaigns according to trends and challenges | European Union Agency for Cybersecurity |
| Risk pressure and LATAM gap | not specified | not specified | ESET reported in its 2020 telemetry that Brazil accounted for 26.4% of enterprise phishing detections in Latin America, Peru 22.8%, Mexico 12%, Colombia 9.1%, and Argentina 7.1%; ESET 2022 described phishing as a stable infection vector with an average of about 10,000 detections per day; Kaspersky reported that 47% of companies in Latin America do not train employees to detect online scams | not specified | Prioritize countries, areas, or populations with higher exposure and close training gaps without using regional figures as a universal benchmark for effectiveness | ESET, Kaspersky |
Is meeting PCI DSS and CIS annual minimums enough?
No. PCI DSS 12.6.3 requires training at onboarding and at least once every 12 months, plus annual acknowledgment of reading and understanding policies, according to the PCI Security Standards Council. CIS Control 14.1 also requires training at onboarding and at least annually, according to the Center for Internet Security. Whalemate's reading is that this floor works for frequency and traceability, but does not by itself prove behavioral change or operational effectiveness.
Why does CIS itself undercut the idea that an annual course is enough?
The tension appears within the same control family. CIS sets an annual minimum in Control 14.1, but also warns that a prepackaged annual video paired with periodic phishing tests is not, by itself, a robust program, according to the Center for Internet Security. Whalemate's reading is that the annual minimum organizes compliance, but the program design has to be more frequent, more contextual, and more specific to the real risk.
What do NIST, ENISA, and California add that the minimum standard does not?
NIST SP 800-50 Rev. 1 proposes a life-cycle approach, with metrics and assessment methods to improve the program regularly, according to NIST. ENISA recommends regular phishing simulations and behavior measurement, according to the European Union Agency for Cybersecurity. California requires a plan, KPIs, thresholds, metric logging, and reports that can be compared over time, and its guidance recommends quarterly campaigns, according to the California Department of Technology and the California Cybersecurity Integration Center. Whalemate's reading is that these sources move the conversation from delivering training to observing whether behavior changes.
What is actually measured in an awareness campaign?
Separating coverage from behavior is the critical step. For coverage, PCI DSS and CIS make it possible to look at onboarding, annual validity, content review, and acknowledgment of policies, according to the PCI Security Standards Council and the Center for Internet Security. For behavior, NIST proposes measuring clicks by group or function, reports, attachment opens, and observable change at work, while California adds opens, clicks, credential submission, and reporting, according to NIST and the California Cybersecurity Integration Center.
Do opens and clicks work as the main KPI?
They do, but not by themselves. CISA describes campaign reports that show how many users opened and how many clicked, according to the Cybersecurity and Infrastructure Security Agency. SANS identifies click rate and report rate as two core metrics, according to the SANS Institute. But NIST warns that evaluating effectiveness using only click rate poorly isolates the human factor and the difficulty of the message, according to NIST. Whalemate's reading is that clicks and opens are signals, not a verdict.
Why does NIST question a linear reading of click rate?
Because the same rate can mean different things if the difficulty of the email or the human context changes. NIST describes the NIST Phish Scale as a measure of the human-detection difficulty of a phishing email, created in 2019 with empirical real-world data, according to NIST. Whalemate's reading is that comparing campaigns without weighing difficulty can lead to bad decisions, for example overreacting to a high click rate in a much more sophisticated simulation.
