Everyone needs the same short baseline, then each role adds a few topics tied to the damage that role can cause or prevent. Developers, administrators, finance staff, support agents and executives each face different risks, so one generic course leaves gaps for all of them.
Why split by role
NIST SP 800-50 Rev. 1 describes a learning program covering awareness, training and education, which map to different audiences and depth. The NICE Framework from NIST also supports role based employee training and career planning, according to its resource page. The idea is the same: content follows the work.
Everyone: baseline (about 30 minutes)
- Spotting phishing and verifying requests through a known channel.
- Sign in hygiene: password manager, multi factor, no sharing.
- Data handling and classification in plain words.
- How to report, and the promise of no blame.
Developers (add about 2 hours a year)
- Secrets: never in code, how to rotate after a leak.
- Dependencies: why to review new packages, lockfiles, and what to do when an advisory lands.
- Input handling and injection, using your own stack's examples.
- Pull request review habits and protected branches.
Administrators and platform engineers
- Least privilege and time boxed access.
- Change control and logging.
- Recognizing malicious requests that arrive as urgent tickets.
- Backup and recovery basics.
Finance and procurement
- Payment detail change verification by callback to a known number.
- Fake invoice and vendor impersonation patterns.
- Who approves what, and why nobody can bypass it.
Support and customer facing teams
- Identity verification before account changes.
- Social engineering by phone and chat.
- Safe handling of customer data in tickets and screenshots.
Executives
- Targeted fraud, such as impersonation of senior staff.
- Their role in incident decisions. A tabletop is the best format. CISA offers tabletop packages with scenarios such as ransomware, insider threats and phishing.
- Setting the tone: completing the training themselves.
Making it practical
Build one page per role with five behaviors, not fifty. Assign each page an owner. Track completion per role, and review the content after incidents.
Quick check
Do contractors need role based training?
If they hold access similar to staff, yes. Match content to the access, not to the employment type.
How do we start with limited time?
Write the baseline first, then add the developer and finance pages, since those roles usually have the highest impact.
Sources
Last reviewed: 19 October 2026.
