Security awareness training for federal government agencies is whole-of-agency training for APS staff, contractors and privileged users, run on a monthly cadence and evidenced against the Essential Eight — the baseline the Australian Government requires agencies to implement under the Protective Security Policy Framework (PSPF). What makes agencies different from a company of the same headcount is accountability: cyber security performance is self-assessed against the PSPF annually, and the assessment asks for evidence, not intent.
TL;DR
- The Essential Eight is the mandated baseline for Australian Government systems under the PSPF.
- Agencies self-assess against the PSPF annually, and training records feed that evidence.
- Verizon's 2025 DBIR puts the human element behind roughly 60% of breaches.
- Continuous training moves phishing susceptibility from a 33.2% baseline to 4.2% over 12 months (KnowBe4, 2026 benchmarking report).
- Contractors and portfolio entities carry the same exposure — enrol them, not just APS staff.
Why this matters for government agencies
Three things set a federal agency apart from a private company of the same size.
The data. Agencies hold information classified up to PROTECTED, plus citizens' personal information. A breach of that personal data triggers the Privacy Act's Notifiable Data Breaches scheme: a suspected eligible data breach must be assessed within 30 days and notified to the OAIC and affected individuals where serious harm is likely.
The threat actor. The Australian Signals Directorate's Annual Cyber Threat Report 2024-25 documents sustained state-sponsored activity targeting Australian government networks alongside criminal campaigns. Spear-phishing aimed at agency staff is the standard opening move for both.
The accountability. The PSPF requires agencies to implement the Essential Eight, report cyber security incidents to ASD and self-assess against the framework every year. Verizon's 2025 DBIR attributes roughly 60% of breaches to the human element — which places agency staff, and the training they receive, directly inside the audit boundary.
Start with a baseline, not a course
Run a phishing simulation across the agency before the first lesson lands. The baseline click rate is the number the governance reporting will be judged against.
- Simulate before you train, so the first measurement is honest.
- Segment results by division and role — executives, executive assistants and payroll always deserve their own line.
- Include contractors and outsourced IT in the first campaign.
- Use realistic lures: supplier bank-detail changes, HR portal updates, IT credential resets.
The KnowBe4 2026 industry benchmarking report puts the global baseline at 33.2%, falling to about 4.2% after twelve months of continuous training. That trajectory is the slide that answers the annual assessment.
Map the programme to Essential Eight evidence
Training supports the framework, but the records it generates are what assessors read:
- Completion records per learner, exportable per division.
- Simulation results over time, showing the falling click-rate curve.
- Framework mapping showing where the human layer sits.
- A gap assessment that locates awareness gaps against the Essential Eight before the self-assessment is due — not after.
Evidence held in spreadsheets fails quietly: when the assessment cycle opens, reconstructed completion lists from email threads do not survive scrutiny.
Train monthly, by role
- Core curriculum for every APS learner: phishing, credentials, data handling, incident reporting.
- Executive assistants and senior office staff: whaling, travel-booking scams, gift-card fraud — the most-senior inboxes are targeted first.
- Finance and procurement: invoice fraud, supplier impersonation, call-back verification of payment changes.
- Privileged IT users: credential phishing, MFA fatigue, remote-access scams.
Reminders run on schedule and overdue courses escalate automatically. Story-driven animated modules with comprehension quizzes hold completion rates up at scale — a 40-minute compliance module assigned once a year does not.
Enrol contractors and portfolio entities
A government attack surface does not stop at the APS payroll. Contractors, outsourced IT and labour-hire staff hold agency mailboxes and access, and defence-industry suppliers carry their own security obligations under the Defence Industry Security Program. Per-seat platforms enrol contractors the same way as staff — if the programme excludes them, the audit and the adversary both find the gap.
Measure human risk, report it upward
A per-learner human risk score turns overdue courses, failed quizzes and phishing clicks into one number that governance can track quarter over quarter. At agency scale the difference is between "we run training" and "click rates fell from X% to Y% across divisions" — the second is a statement an annual PSPF self-assessment can quote.
- Per-division trend lines, not just an agency average.
- Breach monitoring against known data dumps for senior inboxes.
- Exportable reports for internal audit, the CISO and portfolio-level governance.
Options for a federal agency at a glance
| Option | Best for | Key limitation |
|---|---|---|
| Cyber Aware | Australian agencies and portfolio entities that need Essential Eight-mapped training, phishing and evidence under one platform | Specialist platform — no bundled email security or backup suite |
| KnowBe4 | Agencies wanting the deepest content library and benchmark data | Published bands start at 25 seats on 3-year list terms; no public Essential Eight mapping found |
| Terranova Security | Enterprises wanting benchmarked content in 40+ languages | Quote-based pricing; no published per-seat rate |
| Huntress SAT | Organisations wanting a fully managed monthly programme | Tiers start at the 50-99 learner band; co-branding rather than white-label |
Vendor facts come from each vendor's public materials as reviewed in the 2026 buyer's guide, last verified July 2026.
Common mistakes
- Annual-only training. The benchmark reductions all come from continuous cadences, not one course a year.
- Excluding contractors. Third-party mailboxes are inside the attack surface regardless of payroll status.
- No baseline simulation. Without a starting number, no annual assessment can show progress.
- Evidence in spreadsheets. Assessment cycles ask for per-learner records; email-thread reconstruction fails.
- Training treated as an IT project. The accountability sits with governance, and governance needs the reporting.
FAQ
What is security awareness training for federal government agencies? Whole-of-agency training for APS staff, contractors and privileged users, run monthly and evidenced against the Essential Eight and the PSPF's information security requirements.
Is security awareness training mandatory for Australian Government agencies? The PSPF requires agencies to implement the Essential Eight and self-assess annually; awareness training is the human layer of that implementation, and auditors increasingly ask for its records.
How often should agency staff be trained? Monthly. The published benchmark falls from 33.2% baseline susceptibility to about 4.2% after 12 months of continuous training and simulation (KnowBe4, 2026) — no annual cadence produces that curve.
Do contractors need to be included? Yes. Contractors, labour hire and outsourced IT hold agency access and mailboxes, and per-seat platforms enrol them the same as staff.
What evidence should an agency's programme produce? Per-learner completion records, simulation results over time, Essential Eight mapping and exported reports for governance and internal audit.
Does the training support incident reporting obligations? It prepares the people: staff learn to recognise and escalate suspicious activity quickly, which is what the PSPF's incident reporting to ASD depends on in practice.
One last thing
Time the first gap assessment to land one assessment cycle before the annual PSPF self-assessment. A gap found in March is a plan; a gap found the week the assessment is due is a finding.