For CISOs, IT, and compliance teams, "how to spot a phishing email" is not enough as a visual checklist. Comparing CIS, CISA, NIST, and NCSC shows that the minimum program combines training, reporting capability, and incident response, but practice often falls short because CIS sets a baseline for onboarding and at least annual training, while CISA, NIST, and NCSC push a continuous model that also measures reporting, not clicking, and rapid response to messages that were not caught.
What changes when the frameworks are compared
None of the source material puts each framework’s phishing requirements side by side. When they are compared, one concrete point stands out: the minimum for compliance does not stop at teaching visual cues, because several frameworks also expect reporting channels, no-interaction behavior, and response capability.
Standard
What it requires
Frequency
Reporting
Response
What can be measured
Source
CIS Control 14.1 and 14.2
Establish and maintain an awareness program and train the workforce to recognize social engineering attacks such as phishing, BEC, pretexting, and tailgating
Training at onboarding and at least annually; review and update the content annually or when major business changes occur
not specified
not specified
training coverage and content updates
CIS
CISA CPG 2.I and Phishing Guidance
Provide user training on social engineering and phishing attacks; regularly educate users to identify suspicious emails and links, avoid interacting with them, and report opening suspicious emails, links, attachments, or other lures
regularly
Use built-in reporting features in Outlook and other cloud email platforms; report phishing incidents quickly to CISA
Do not interact with the message; delete it; verify potentially legitimate messages through another channel
users who identify, do not interact with, and report suspicious messages
CISA
NIST CSF 2.0 and SP 800-61 Rev. 3
Train users to recognize social engineering attempts and other common attacks, report attacks and suspicious activity, and perform basic cyber hygiene tasks; integrate incident response into risk management activities
not specified
Report attacks and suspicious activity
Incident response includes detection, response, and recovery; a phishing program must address not only click prevention but also detection and reporting afterward
recognition, reporting, detection, response, and recovery
NIST
NCSC
Structure phishing defense around four actions: make it harder for attackers to reach users, help users identify and report suspicious messages, protect the organization against undetected email, and respond quickly to incidents
not specified
Forward suspicious emails to report@phishing.gov.uk, even when the user is not sure they are a scam
Protect against undetected email and respond quickly to incidents
identification and reporting of suspicious messages, technical control coverage, and response speed
NCSC
Why "spot a phishing email" is not enough as a program
NIST defines phishing as the use of email or other convincing messages to trick people into opening harmful links or downloading malicious software, according to NIST. That definition shifts the focus from the look of the email to behavior manipulation and operational outcomes.
CISA recommends looking for signs such as urgent or emotional language, requests for personal or financial information, untrusted shortened URLs, and wrong email addresses or links, according to CISA. But the same guidance adds that the user should not interact with the message and should report it, according to CISA. Whalemate reads that as evidence that spotting cues is only the first layer, not the end goal of the program.
Which visual cues still matter?
The NIST Phish Scale classifies email cues into five types: errors, technical indicators, visual presentation indicators, language and content, and common tactics, according to NIST. Language and content indicators include generic greetings, missing signer details, time pressure, and threatening language, according to NIST.
CISA also lists concrete signs such as suspicious or impersonated sender addresses, generic greetings and signatures, links whose destination does not match the visible text, spelling or grammar errors, inconsistent formatting, and suspicious attachments, according to CISA. The FTC adds signs such as generic greetings, notices about suspended accounts due to billing problems, or requests to update payment information, according to the FTC.
What does NIST measure when it evaluates detectability?
The NIST Phish Scale is a method for implementers to rate how hard a phishing email is for a human to detect, according to NIST. The scale combines a scoring system for observable email features and a scoring system for how closely the email’s premise aligns with its target audience, according to NIST.
That changes how a simulation or a live campaign should be viewed. Whalemate’s reading is that it is not enough to measure an aggregate click rate if the analysis does not separate how difficult the message was, what tactics it used, and which audience it targeted. Without that layer, an easy campaign and a sophisticated campaign end up mixed into the same indicator.
Where does the tension between annual minimums and a continuous model show up?
CIS Safeguard 14.1 requires onboarding training and at least annual training, and also requires content review and updates annually or after significant business changes, according to CIS. CISA, by contrast, says organizations should regularly educate users to identify suspicious emails and links, avoid interacting with them, and report suspicious emails, links, attachments, or other lures, according to CISA.
The tension is not minor. Whalemate reads a program that only meets CIS’s annual minimum as potentially falling short of CISA’s operational expectation, especially when phishing changes lure, channel, and format faster than an annual content cycle.
What happens when the program measures only clicks?
Available evidence shows that measuring clicks alone leaves out part of what the frameworks require. NIST CSF 2.0 includes outcome Ex2, which calls for training users to recognize social engineering attempts, report attacks and suspicious activity, follow acceptable use policies, and perform basic cyber hygiene tasks, according to NIST.
NIST SP 800-61 Rev. 3 says incident response includes detection, response, and recovery activities, according to NIST. NCSC organizes defense into four actions, including helping identify and report suspicious messages, protecting against undetected email, and responding quickly to incidents, according to NCSC. Whalemate’s reading is straightforward: if the main KPI is still "who clicked," the program is not measuring reporting or response capability.
Is recognizing suspicious senders enough to decide?
Frameworks centered on visual cues often emphasize sender addresses, generic greetings, errors, links, and suspicious attachments, according to CISA’s guidance. But CTIR Gov in Brazil says a message should not be trusted just because the sender appears familiar, since it may come from a compromised account, a fake profile, or a forged address, according to CTIR Gov.
That creates another key tension. Whalemate’s reading is that teaching "check the sender" as a nearly self-sufficient rule creates a false sense of control, because part of the risk is not an obviously fake sender but compromised accounts, convincing impersonation, or hijacked legitimate chains.
What changes with QR phishing, third parties, and more believable lures?
The need for a continuous model grows with the volume and variability of the threat. APWG observed 1,130,393 phishing attacks in the second quarter of 2025, up 13% from 1,003,924 in the first quarter of 2025, according to APWG. In June 2025, APWG recorded 35,345 unique email phishing campaigns and 1,642 brands targeted through campaigns that used QR codes, according to APWG.
Microsoft said its Microsoft Defender for Office 365 platform detected more than 145 million QR code phishing attacks between July 2025 and June 2026, according to Microsoft. Verizon reported that third-party involvement in breaches doubled from 15% to 30% in its 2025 DBIR, according to Verizon. Whalemate’s reading is that phishing can no longer be modeled only around classic email with obvious mistakes.
How strong is the human factor still?
The Verizon 2025 Data Breach Investigations Report analyzed more than 22,000 security incidents, including 12,195 confirmed data breaches, according to Verizon. In that report, the human element was involved in roughly 60% of breaches, according to Verizon.
Microsoft Incident Response said 28% of the breaches it analyzed started with phishing or social engineering, according to Microsoft. IBM identified phishing as the most common initial attack vector, present in 16% of the breaches it analyzed, with an average cost of USD 4.8 million per associated breach, according to IBM. Whalemate’s reading is that treating phishing as an isolated awareness topic understates its role in real incidents and losses.
What technical controls apply when the user does not detect the message?
NCSC structures phishing defense around four actions, and one of them is protecting the organization against undetected email, according to NCSC. CISA recommends enabling external email tagging in mail clients and gateway filters to block known malicious indicators, such as known malicious subjects and suspicious IP addresses, according to CISA.
NCSC gives an example in which a campaign sent 1,800 emails and a filtering service stopped 1,750 because it identified malware, according to NCSC. Whalemate’s reading is that the minimum program is not just training, but enough technical coverage to assume that some users will always see messages the filter did not stop.
What role does reporting play as an operational control?
CISA recommends using built-in reporting features in Microsoft Outlook and other cloud email platforms, and also reporting spam to Microsoft, Apple, and Google when appropriate, according to CISA. It also recommends reporting phishing incidents quickly to CISA, according to CISA Phishing Guidance.
NCSC recommends forwarding suspicious emails to report@phishing.gov.uk even when the user is not sure they are a scam, according to NCSC. Whalemate’s reading is that reporting is not a secondary behavior, but an operational capability that speeds up triage, containment, blocking, and learning from active campaigns.
What does this mean for CISOs, IT, and compliance teams in Latin America?
The decision enabled by this framework comparison is not to launch another general campaign on visual cues, but to decide where to intervene first. If the program today measures annual attendance or click rate, the first change should be to instrument metrics for training coverage, detectability difficulty by lure type, reporting rate, no-interaction behavior for links or attachments, use of the report button, and detection and response times.
For IT, that means checking whether the email client has reporting features, external email tagging, gateway filtering, and an incident response path for opening, clicking, or credential compromise, according to CISA, NCSC, and NIST. For compliance, it means checking whether the program meets PCI DSS 12.6’s requirement for a security awareness program, not just a one-off course, and whether execution evidence shows continuity beyond the annual minimum. For a CISO, it means prioritizing audience, lure type, reporting channel, technical filtering, or response to compromised credentials based on observed behavior and exposure.
What should a phishing program measure besides click rate?
Besides clicks, the material shows that it is advisable to measure training coverage, content updates, lure detectability difficulty, reporting rate, non-interaction with links or attachments, use of the report button, and detection and response times. This comes from comparing CIS, CISA, NIST, and NCSC, which are not limited to evaluating interaction.
Is annual training enough for phishing?
Not necessarily. CIS establishes training at onboarding and, at a minimum, annually, according to CIS. But CISA calls for regularly educating users to identify, not interact, and report, according to CISA. NIST and NCSC also incorporate reporting, detection, and response. An annual program may meet a baseline, but still fall short in operational practice.
Why does reporting suspicious emails matter as much as not clicking?
Because the frameworks analyzed treat reporting as part of the defense, not as an accessory step. CISA recommends built-in reporting features in email platforms and NIST CSF 2.0 includes reporting attacks and suspicious activity. NCSC also calls for helping identify and report, even when the user is not sure it is a scam.
Are the classic visual cues still useful?
Yes, but they are not enough on their own. NIST, CISA, and the FTC still point to errors, generic greetings, time pressure, suspicious senders, and inconsistent links. The problem is that CTIR Gov warns that a message may come from a compromised account, a fake profile, or a forged address. That is why visual detection needs support from reporting and technical controls.
Would you like to go deeper on this topic?
Open this article directly in Claude or ChatGPT —
ask questions, get a summary, or explore related ideas.
By 
