--- title: "NIST, ISO and CISA Raise the Bar on Phishing | Whalemate" description: "NIST, ISO, CISA and Brazil show that click rate and an annual campaign are not enough to defend against phishing risk." url: https://www.whalemate.com/en/resources/blog/nist-iso-cisa-raise-bar/ lang: en updated: 2026-11-06 alternates: es: https://www.whalemate.com/recursos/blog/nist-iso-cisa-elevan-phishing/ pt-BR: https://www.whalemate.com/br/recursos/blog/nist-iso-cisa-elevam-phishing/ index: https://www.whalemate.com/llms.txt --- [Back to blog](https://www.whalemate.com/en/resources/blog/) Blog # NIST, ISO and CISA Raise the Bar on Phishing NIST, ISO, CISA and Brazil show that click rate and an annual campaign are not enough to defend against phishing risk. Nov 6, 2026 By [Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/) 12 min read [Awareness](https://www.whalemate.com/en/resources/blog/topic/awareness/) ![NIST, ISO and CISA Raise the Bar on Phishing](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/nist-iso-cisa-raise-bar.webp) In this article 1. [What changes when frameworks that are usually read separately are compared](#s1) 2. [What gets measured wrong when click rate is the only metric?](#s2) 3. [Why does lure difficulty change the value of the metric?](#s3) 4. [Is training enough when the problem is credential theft?](#s4) 5. [Does ISO ask less than NIST about phishing?](#s5) 6. [What does NIST 800-172 add that is not as strong elsewhere?](#s6) 7. [Is recognizing phishing enough without the ability to report it?](#s7) 8. [Is real-world practice still anchored in annual campaigns?](#s8) 9. [What do breach data say about the real weight of the human factor?](#s9) 10. [How does compliance come into play when the incident involves credentials or social engineering?](#s10) 11. [What does an HRM lens add over traditional awareness?](#s11) 12. [What decision does this enable for a CISO, IT or compliance leader in LATAM?](#s12) 13. [What minimum evidence makes a phishing program defensible?](#s13) 14. [What to read next?](#s14) The overlap between NIST, ISO, CISA and Brazil's federal guidance shows that a CISO cannot manage phishing and hacking with an annual campaign or click rate as the main metric. A defensible program must cover recognition and reporting, practical exercises aligned with current threats, behavior-change measurement, and reinforcement with [phishing-resistant MFA](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf), according to NIST SP 800-53, NIST SP 800-172, NIST SP 800-50 Rev. 1, CISA and ISO/IEC 27001:2022 Annex A 6.3. ## What changes when frameworks that are usually read separately are compared Read side by side, the sources do not say the same thing or demand the same level of rigor. The value of the comparison is that ISO calls for awareness and [regular updates](https://www.whalemate.com/en/resources/blog/iso-27001-2022-requires-continuous/), NIST adds recognition and reporting for social engineering, CISA adds phishing-resistant MFA, and Brazil's federal guidance pushes organizations to measure reporting rather than stay with annual training alone. | Standard | What it requires | Frequency | Practical exercises | What to measure | Update | Related technical control | Source | | --- | --- | --- | --- | --- | --- | --- | --- | | NIST SP 800-53 Rev. 5 AT-2 and AT-2(3) | Provide security and privacy literacy training to users, managers, executives and contractors, plus training to recognize and report potential and actual social engineering and social mining | As part of initial training and then at an organization-defined frequency, and also when the system changes or other organization-defined events occur | Includes unannounced practical exercises that simulate social engineering attempts, information gathering, unauthorized access, opening malicious attachments, or activating malicious links through spear phishing | not specified | When the system changes or other organization-defined events occur | not specified | according to NIST SP 800-53 Rev. 5 | | NIST SP 800-172 requirements 03.02.1e and 03.02.2e | Awareness training focused on recognizing and responding to social engineering threats, APT actors, breaches and suspicious behavior, and practical exercises for organization-defined roles | At an organization-defined frequency, with updates at an organization-defined frequency or when there are significant threat changes | Exercises aligned with current threat scenarios and with feedback to the people involved and their supervisors, including malicious attachment or link simulations through spear phishing | not specified | When there are significant threat changes | not specified | according to NIST SP 800-172 | | NIST SP 800-50 Rev. 1 | A cybersecurity and privacy learning program aimed at promoting behavior change as part of risk management and the security and privacy culture | not specified | Describes phishing exercises as emails sent to see whether users recognize a phishing attempt, click a malicious site, or open an infected attachment | Percentage of participants who changed their workplace behavior, how many participants received a phishing test email and reported it correctly, the impact of training on recognition and reporting, and common metrics such as click-through and reports | Review and improve learning programs periodically as needs change | not specified | according to NIST SP 800-50 Rev. 1 | | ISO/IEC 27001:2022 Annex A 6.3 | Personnel and relevant interested parties must receive appropriate information, awareness, education and training in information security, plus regular updates on policies and procedures relevant to their role | Regular updates | Not specified in the control text, though a secondary guide mentions ongoing campaigns such as newsletters or phishing simulations as expected evidence | Not specified, though a secondary guide mentions questionnaire or assessment results as expected evidence | Regular updates to security policy, thematic policies and procedures | not specified | according to ISO/IEC 27001:2022 Annex A 6.3 and the ISO27001.com secondary guide | | CISA | A comprehensive anti-phishing program that includes employee awareness and training, simulated attacks and analysis of results to modify training and reduce risk, plus emphasis on reporting suspicious emails, links, attachments or lures | not specified | Simulated phishing emails sent to defined groups to assess vulnerability levels | The report can identify how many users opened or clicked the link to estimate potential impact | Modify training based on results analysis | Implement phishing-resistant multifactor authentication as part of Zero Trust, prioritizing FIDO/WebAuthn or PKI | according to CISA | | Brazilian federal guidance | An effective program goes beyond annual training with videos and phishing tests and includes frequent, updated messages and seasonal campaigns, while CIMBRA-I includes email phishing, other social engineering tactics, event and incident identification, data classification and handling, and mobile device security | Frequent and updated messages, seasonal campaigns, and periodic evaluation according to defined triggers | not specified | Monitor not only the reduction in click rate, but mainly the increase in the reporting rate to IT | Effectiveness is evaluated periodically and according to defined triggers such as system changes and external events | not specified | according to Brazil's Secretariat of Digital Government and CIMBRA-I | ## What gets measured wrong when click rate is the only metric? Sophos reported that 50% of the organizations surveyed tracked phishing email click rate and used that metric to guide awareness programs and adapt content, according to its 2021 report. NIST, by contrast, says programs often use click rate as the only metric, but [email difficulty](https://www.nist.gov/publications/phishing-user-context-understanding-nist-phish-scale) changes how that data should be interpreted, and click rates alone do not provide a full picture of employee behavior, according to its work on the NIST Phish Scale and its technical blog. Whalemate's view is that click rate is useful, but only as a partial signal. If a program does not include correct reporting, repeat clicking, [lure difficulty](https://www.whalemate.com/en/resources/blog/nist-what-measure-security-awareness/) and behavior change, it ends up producing weak evidence for both risk management and compliance defense. ## Why does lure difficulty change the value of the metric? NIST developed the NIST Phish Scale as a method to measure the human-detection difficulty of a phishing email and to contextualize differences in click rates, according to the publication on phishing user context. NIST also says difficulty context has to be included because the same click rate can mean different things if the lure was crude or if it closely matched a normal work situation. Whalemate's view is that comparing campaigns without normalizing for difficulty leads to bad decisions. A team with more clicks may be facing more complex scenarios, while another with fewer clicks may be tested with trivial lures. ## Is training enough when the problem is credential theft? Microsoft reported more than 600 million identity attacks per day in Microsoft Entra data, and password-based attacks accounted for more than 99% of identity attacks observed, according to the Microsoft Digital Defense Report 2024. The same report's executive summary added a 146% increase in adversary-in-the-middle phishing attacks and 39,000 incidents detected per day on Microsoft's platforms, according to Microsoft. CISA responds to that picture by recommending phishing-resistant multifactor authentication as part of Zero Trust and calls it the gold standard for MFA, according to its fact sheet. In its Cybersecurity Performance Goals 2.0, CISA prioritizes mechanisms based on FIDO/WebAuthn or PKI, and leaves SMS or voice only when no other options are available. Whalemate's view is that if the attacker's goal is to hijack identity and the volume of credential attacks is scaling this way, training alone does not close the gap. The practical decision is to combine human intervention and technical controls, especially where a compromised credential would have high impact. ## Does ISO ask less than NIST about phishing? ISO/IEC 27001:2022 Annex A 6.3 requires awareness, education, training and regular updates relevant to job function, according to the control text. NIST SP 800-53 Rev. 5 AT-2(3), by contrast, specifically requires training to recognize and report potential and actual social engineering and social mining, according to the control sheet published by NIST. The tension is not a contradiction, but a difference in specificity. Whalemate's view is that an organization that stays with the broader wording of ISO can prove that it provided awareness, but still fall short on concrete evidence of phishing and social engineering recognition and reporting. ## What does NIST 800-172 add that is not as strong elsewhere? NIST SP 800-172, in requirements 03.02.1e and 03.02.2e, requires training focused on recognizing and responding to social engineering threats, APT actors, breaches and suspicious behavior, and practical exercises aligned with current threat scenarios, according to NIST. The implementation guidance adds that those exercises can include unannounced social engineering attempts and simulations of the impact of opening malicious attachments or activating malicious links, and that rapid feedback reinforces the desired behavior. Whalemate's view is that this creates a more operational standard than generic awareness. Training is not enough. Organizations also have to test with current scenarios and give feedback while the signal is still fresh. ## Is recognizing phishing enough without the ability to report it? NIST SP 800-53 Rev. 5 AT-2(3) requires recognizing and reporting potential and actual social engineering and social mining cases, according to NIST. NIST SP 800-50 Rev. 1 also proposes measuring how many participants received a phishing test email and reported it correctly, and measuring the impact of training on recognition and reporting, according to the same publication. CISA, for its part, recommends reporting phishing instead of responding to it and extends that guidance to email, SMS, direct messages on social networks or phone calls, according to its public guidance. Brazil's Secretariat of Digital Government recommends monitoring mainly the increase in the rate of reporting to IT, rather than only the reduction in clicks. Whalemate's view is that reporting is not a soft add-on. It is an operational capability that reduces detection time and enables response before an event escalates. Whalemate Want to see Whalemate in your organization? Book a demo. We will walk through email and QRishing simulations for your team, and what CISO, IT or compliance can decide from there. [Book a demo](https://www.whalemate.com/en/demo/) ## Is real-world practice still anchored in annual campaigns? Brazil's Secretariat of Digital Government says an effective awareness program goes beyond annual training with videos and phishing tests and includes frequent, updated messages and seasonal campaigns, according to its framework guide. CIMBRA-I adds that awareness activities are evaluated periodically and according to defined triggers such as system changes and external events, and that activities are improved when appropriate, according to the GSI model. NIST SP 800-53 Rev. 5 also requires initial training and then training at an organization-defined frequency, plus repetition when the system changes or other organization-defined events occur. Whalemate's view is that the annual cadence as the only response no longer matches what the frameworks consider defensible. ## What do breach data say about the real weight of the human factor? The Verizon 2025 Data Breach Investigations Report analyzed more than 22,000 security incidents, including 12,195 confirmed breaches, according to Verizon. In that set, credential abuse appeared in 22% and vulnerability exploitation in 20% of breaches as the main initial vectors, while human involvement remained at about 60% of breaches and third-party involvement doubled from 15% to 30%, according to Verizon. An academic work hosted by the Centro Paula Souza says 68% of security violations involve some kind of human error and ties that consistently to social engineering. Whalemate's view is that phishing and hacking should not be artificially separated: the initial access can rely on human behavior and then escalate through credentials, third parties or technical exploitation. ## How does compliance come into play when the incident involves credentials or social engineering? The ANPD defines a security incident as a confirmed adverse event that compromises the confidentiality, integrity or availability of personal data, according to its enforcement findings. The ANPD also logged 24 notifications in 2023 classified as credential theft or social engineering, according to the same agency. Article 6 of Resolução CD/ANPD nº 15/2024 requires notifying the ANPD of a security incident within [three business days](https://www.in.gov.br/en/web/dou/-/resolucao-cd/anpd-n-15-de-24-de-abril-de-2024-556243024), unless specific legislation sets a different deadline, when it may cause relevant risk or harm to data subjects, according to the Diário Oficial da União. The ANPD incident notification form explicitly includes the categories credential theft, social engineering and brute-force credential compromise, according to the form itself. Whalemate's view is that a poorly measured program does not only fail at prevention. It also leaves less traceability to classify the event quickly, justify severity and sustain the response under privacy and compliance rules. ## What does an HRM lens add over traditional awareness? Whalemate's available material frames [Human Risk Management](https://www.whalemate.com/en/resources/blog/human-risk-management-what-measures/) as an approach that models context, simulates, trains, measures, intervenes and reports, instead of being limited to a security awareness course. It also says the risk score combines signals from simulations, courses, reports and behavior to prioritize interventions, not to punish. Whalemate's view is consistent with the source comparison: if NIST asks for behavior change, recognition and reporting, and Brazil recommends prioritizing reporting rate, then the useful unit of decision is no longer the campaign, but the observable signal by group, scenario and control. ## What decision does this enable for a CISO, IT or compliance leader in LATAM? The enabled decision is not to buy more generic content, but to reorder the program. According to NIST SP 800-50 Rev. 1, organizations need to measure behavior change, recognition and reporting. According to NIST SP 800-172, exercises must align with current threats and provide feedback. According to CISA, the program must be complemented with phishing-resistant MFA. According to Brazilian federal guidance, annual training is not enough and the reporting rate should be prioritized. For IT, that means instrumenting a simple reporting channel, segmenting simulations by risk and linking results to access hardening. For compliance, that means requiring evidence showing frequency, updates, exercises, reports and response, not just attendance records. For a CISO, that means prioritizing groups with observable exposure signals, such as repeat clicks, low reporting or access to sensitive assets, and combining those signals with technical controls where a compromised credential would have the highest impact. ## What minimum evidence makes a phishing program defensible? According to NIST SP 800-53 Rev. 5, NIST SP 800-172, NIST SP 800-50 Rev. 1, CISA and ISO/IEC 27001:2022 Annex A 6.3, the defensible baseline includes defined frequency, regular updates, recognition and reporting, practical exercises and periodic review. If the organization only keeps records of an [annual course](https://www.whalemate.com/en/resources/blog/security-awareness-training-measure-clicks/), the evidence falls short of what these sources support. ## What to read next? - [Awareness on the platform](https://www.whalemate.com/en/platform/advanced-simulations/) - [LATAM Awareness Platforms: What to Evaluate](https://www.whalemate.com/en/resources/blog/latam-awareness-platforms-what-evaluate/) - [NIST and CISA on social engineering](https://www.whalemate.com/en/resources/blog/nist-cisa-social-engineering/) [See the full topic guide](https://www.whalemate.com/en/platform/advanced-simulations/) Questions ## Frequently asked questions **Is measuring click rate still useful?** Yes, but not as the only metric. According to NIST, click rate alone does not provide a complete picture of personnel behavior, and its value changes depending on the difficulty of the lure. A stronger program combines clicks with correct reports, repeat clicking, and signs of behavior change. **Which technical control has the strongest support in the sources?** Phishing-resistant multifactor authentication. CISA recommends it as part of Zero Trust and calls it the gold standard for MFA. In addition, its Cybersecurity Performance Goals 2.0 prioritize options based on FIDO/WebAuthn or PKI, leaving SMS or voice for scenarios where there are no better alternatives. **Is ISO 27001 enough to justify an annual campaign?** No, based on what emerges from comparing the sources. ISO/IEC 27001:2022 Annex A 6.3 requires awareness, education, training, and regular updates relevant to the role. Brazil's federal guidance explicitly says that an effective program goes beyond annual training, and NIST adds recognition, reporting, and practical exercises. **What changes if the incident ends in credential theft?** The urgency and the traceability change. According to the ANPD, the notification form includes categories such as credential theft and social engineering, and Resolução CD/ANPD nº 15/2024 requires notification within three business days when the incident may cause relevant risk or harm to data subjects. That forces fast classification backed by evidence. **What should a CISO in LATAM decide tomorrow?** They should review whether their program measures only clicks or also reporting, repeat clicking, and behavior change, according to NIST and Brazil. They should also verify whether simulations reflect current threats, according to NIST SP 800-172, and whether the groups with the highest exposure already have phishing-resistant MFA, according to CISA. Whalemate Is this risk in your program? If this article describes something you already faced — or that the board is asking you to explain — book a demo. [Book a demo](https://www.whalemate.com/en/demo/) ## Would you like to go deeper on this topic? Open this article directly in Claude or ChatGPT — ask questions, get a summary, or explore related ideas. - [Open with Claude](https://claude.ai/new?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CNIST%2C%20ISO%20and%20CISA%20Raise%20the%20Bar%20on%20Phishing%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.) - [Open with ChatGPT](https://chatgpt.com/?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CNIST%2C%20ISO%20and%20CISA%20Raise%20the%20Bar%20on%20Phishing%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.) In this article 1. [What changes when frameworks that are usually read separately are compared](#s1) 2. [What gets measured wrong when click rate is the only metric?](#s2) 3. [Why does lure difficulty change the value of the metric?](#s3) 4. [Is training enough when the problem is credential theft?](#s4) 5. [Does ISO ask less than NIST about phishing?](#s5) 6. [What does NIST 800-172 add that is not as strong elsewhere?](#s6) 7. [Is recognizing phishing enough without the ability to report it?](#s7) 8. [Is real-world practice still anchored in annual campaigns?](#s8) 9. [What do breach data say about the real weight of the human factor?](#s9) 10. [How does compliance come into play when the incident involves credentials or social engineering?](#s10) 11. [What does an HRM lens add over traditional awareness?](#s11) 12. [What decision does this enable for a CISO, IT or compliance leader in LATAM?](#s12) 13. [What minimum evidence makes a phishing program defensible?](#s13) 14. [What to read next?](#s14) Whalemate Is this risk in your program? [Book a demo](https://www.whalemate.com/en/demo/) ## Related articles [!\[CISA and NIST on cyberattack simulations\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/cisa-nist-cyberattack-simulations.webp)](https://www.whalemate.com/en/resources/blog/cisa-nist-cyberattack-simulations/) Awareness Nov 10, 2026 By Federico Hombre ### CISA and NIST on cyberattack simulations CISA, NIST, and ISO/IEC 27001 show what to measure in simulations: clicks, reports, opens, difficulty Read more [!\[Phishing types need separate metrics\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/phishing-types-need-separate-metrics.webp)](https://www.whalemate.com/en/resources/blog/phishing-types-need-separate-metrics/) Awareness Nov 9, 2026 By Federico Hombre ### Phishing types need separate metrics CISO, IT, and compliance teams should manage phishing by channel, target, control, and metric, not as a list of labels. Read more [!\[NIST on What to Measure in Security Awareness\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/nist-what-measure-security-awareness.webp)](https://www.whalemate.com/en/resources/blog/nist-what-measure-security-awareness/) Awareness Nov 4, 2026 By Federico Hombre ### NIST on What to Measure in Security Awareness NIST says clicks alone are not enough. A useful dashboard also tracks reports, opens, data entry, response time, and message difficulty. Read more [See all articles](https://www.whalemate.com/en/resources/blog/)