NIST, ISO and CISA Raise the Bar on Phishing

The overlap between NIST, ISO, CISA and Brazil's federal guidance shows that a CISO cannot manage phishing and hacking with an annual campaign or click rate as the main metric. A defensible program must cover recognition and reporting, practical exercises aligned with current threats, behavior-change measurement, and reinforcement with phishing-resistant MFA, according to NIST SP 800-53, NIST SP 800-172, NIST SP 800-50 Rev. 1, CISA and ISO/IEC 27001:2022 Annex A 6.3.

What changes when frameworks that are usually read separately are compared

Read side by side, the sources do not say the same thing or demand the same level of rigor. The value of the comparison is that ISO calls for awareness and regular updates, NIST adds recognition and reporting for social engineering, CISA adds phishing-resistant MFA, and Brazil's federal guidance pushes organizations to measure reporting rather than stay with annual training alone.

What gets measured wrong when click rate is the only metric?

Sophos reported that 50% of the organizations surveyed tracked phishing email click rate and used that metric to guide awareness programs and adapt content, according to its 2021 report. NIST, by contrast, says programs often use click rate as the only metric, but email difficulty changes how that data should be interpreted, and click rates alone do not provide a full picture of employee behavior, according to its work on the NIST Phish Scale and its technical blog.

Whalemate's view is that click rate is useful, but only as a partial signal. If a program does not include correct reporting, repeat clicking, lure difficulty and behavior change, it ends up producing weak evidence for both risk management and compliance defense.

Why does lure difficulty change the value of the metric?

NIST developed the NIST Phish Scale as a method to measure the human-detection difficulty of a phishing email and to contextualize differences in click rates, according to the publication on phishing user context. NIST also says difficulty context has to be included because the same click rate can mean different things if the lure was crude or if it closely matched a normal work situation.

Whalemate's view is that comparing campaigns without normalizing for difficulty leads to bad decisions. A team with more clicks may be facing more complex scenarios, while another with fewer clicks may be tested with trivial lures.

Is training enough when the problem is credential theft?

Microsoft reported more than 600 million identity attacks per day in Microsoft Entra data, and password-based attacks accounted for more than 99% of identity attacks observed, according to the Microsoft Digital Defense Report 2024. The same report's executive summary added a 146% increase in adversary-in-the-middle phishing attacks and 39,000 incidents detected per day on Microsoft's platforms, according to Microsoft.

CISA responds to that picture by recommending phishing-resistant multifactor authentication as part of Zero Trust and calls it the gold standard for MFA, according to its fact sheet. In its Cybersecurity Performance Goals 2.0, CISA prioritizes mechanisms based on FIDO/WebAuthn or PKI, and leaves SMS or voice only when no other options are available.

Whalemate's view is that if the attacker's goal is to hijack identity and the volume of credential attacks is scaling this way, training alone does not close the gap. The practical decision is to combine human intervention and technical controls, especially where a compromised credential would have high impact.

Does ISO ask less than NIST about phishing?

ISO/IEC 27001:2022 Annex A 6.3 requires awareness, education, training and regular updates relevant to job function, according to the control text. NIST SP 800-53 Rev. 5 AT-2(3), by contrast, specifically requires training to recognize and report potential and actual social engineering and social mining, according to the control sheet published by NIST.

The tension is not a contradiction, but a difference in specificity. Whalemate's view is that an organization that stays with the broader wording of ISO can prove that it provided awareness, but still fall short on concrete evidence of phishing and social engineering recognition and reporting.

What does NIST 800-172 add that is not as strong elsewhere?

NIST SP 800-172, in requirements 03.02.1e and 03.02.2e, requires training focused on recognizing and responding to social engineering threats, APT actors, breaches and suspicious behavior, and practical exercises aligned with current threat scenarios, according to NIST. The implementation guidance adds that those exercises can include unannounced social engineering attempts and simulations of the impact of opening malicious attachments or activating malicious links, and that rapid feedback reinforces the desired behavior.

Whalemate's view is that this creates a more operational standard than generic awareness. Training is not enough. Organizations also have to test with current scenarios and give feedback while the signal is still fresh.

Is recognizing phishing enough without the ability to report it?

NIST SP 800-53 Rev. 5 AT-2(3) requires recognizing and reporting potential and actual social engineering and social mining cases, according to NIST. NIST SP 800-50 Rev. 1 also proposes measuring how many participants received a phishing test email and reported it correctly, and measuring the impact of training on recognition and reporting, according to the same publication.

CISA, for its part, recommends reporting phishing instead of responding to it and extends that guidance to email, SMS, direct messages on social networks or phone calls, according to its public guidance. Brazil's Secretariat of Digital Government recommends monitoring mainly the increase in the rate of reporting to IT, rather than only the reduction in clicks.

Whalemate's view is that reporting is not a soft add-on. It is an operational capability that reduces detection time and enables response before an event escalates.

Is real-world practice still anchored in annual campaigns?

Brazil's Secretariat of Digital Government says an effective awareness program goes beyond annual training with videos and phishing tests and includes frequent, updated messages and seasonal campaigns, according to its framework guide. CIMBRA-I adds that awareness activities are evaluated periodically and according to defined triggers such as system changes and external events, and that activities are improved when appropriate, according to the GSI model.

NIST SP 800-53 Rev. 5 also requires initial training and then training at an organization-defined frequency, plus repetition when the system changes or other organization-defined events occur. Whalemate's view is that the annual cadence as the only response no longer matches what the frameworks consider defensible.

What do breach data say about the real weight of the human factor?

The Verizon 2025 Data Breach Investigations Report analyzed more than 22,000 security incidents, including 12,195 confirmed breaches, according to Verizon. In that set, credential abuse appeared in 22% and vulnerability exploitation in 20% of breaches as the main initial vectors, while human involvement remained at about 60% of breaches and third-party involvement doubled from 15% to 30%, according to Verizon.

An academic work hosted by the Centro Paula Souza says 68% of security violations involve some kind of human error and ties that consistently to social engineering. Whalemate's view is that phishing and hacking should not be artificially separated: the initial access can rely on human behavior and then escalate through credentials, third parties or technical exploitation.

How does compliance come into play when the incident involves credentials or social engineering?

The ANPD defines a security incident as a confirmed adverse event that compromises the confidentiality, integrity or availability of personal data, according to its enforcement findings. The ANPD also logged 24 notifications in 2023 classified as credential theft or social engineering, according to the same agency.

Article 6 of Resolução CD/ANPD nº 15/2024 requires notifying the ANPD of a security incident within three business days, unless specific legislation sets a different deadline, when it may cause relevant risk or harm to data subjects, according to the Diário Oficial da União. The ANPD incident notification form explicitly includes the categories credential theft, social engineering and brute-force credential compromise, according to the form itself.

Whalemate's view is that a poorly measured program does not only fail at prevention. It also leaves less traceability to classify the event quickly, justify severity and sustain the response under privacy and compliance rules.

What does an HRM lens add over traditional awareness?

Whalemate's available material frames Human Risk Management as an approach that models context, simulates, trains, measures, intervenes and reports, instead of being limited to a security awareness course. It also says the risk score combines signals from simulations, courses, reports and behavior to prioritize interventions, not to punish.

Whalemate's view is consistent with the source comparison: if NIST asks for behavior change, recognition and reporting, and Brazil recommends prioritizing reporting rate, then the useful unit of decision is no longer the campaign, but the observable signal by group, scenario and control.

What decision does this enable for a CISO, IT or compliance leader in LATAM?

The enabled decision is not to buy more generic content, but to reorder the program. According to NIST SP 800-50 Rev. 1, organizations need to measure behavior change, recognition and reporting. According to NIST SP 800-172, exercises must align with current threats and provide feedback. According to CISA, the program must be complemented with phishing-resistant MFA. According to Brazilian federal guidance, annual training is not enough and the reporting rate should be prioritized.

For IT, that means instrumenting a simple reporting channel, segmenting simulations by risk and linking results to access hardening. For compliance, that means requiring evidence showing frequency, updates, exercises, reports and response, not just attendance records. For a CISO, that means prioritizing groups with observable exposure signals, such as repeat clicks, low reporting or access to sensitive assets, and combining those signals with technical controls where a compromised credential would have the highest impact.

What minimum evidence makes a phishing program defensible?

According to NIST SP 800-53 Rev. 5, NIST SP 800-172, NIST SP 800-50 Rev. 1, CISA and ISO/IEC 27001:2022 Annex A 6.3, the defensible baseline includes defined frequency, regular updates, recognition and reporting, practical exercises and periodic review. If the organization only keeps records of an annual course, the evidence falls short of what these sources support.

What to read next?

• Awareness on the platform
• LATAM Awareness Platforms: What to Evaluate
• NIST and CISA on social engineering