Security Awareness & Training Programme

Legislation checked · 26 June 2026 Not yet advocate-reviewed Execution steps not yet documented

Drafted by:: Lekha editorial team
Version:: v0.1
Last checked against current law:: 15 May 2026
Next scheduled review:: 15 November 2026

Statutory sources (4)

Digital Personal Data Protection Act, 2023Official statuteofficial source
Indian Contract Act, 1872Official statuteofficial source
Code of Civil Procedure, 1908Official statuteofficial source
Arbitration and Conciliation Act, 1996Official statuteofficial source

These badges show which checks this document has passed. They are not a judgment of whether it is legally valid or right for your situation — for a high-stakes matter, have an advocate review it →

After you download

Fill every [BRACKETED PLACEHOLDER] before signing — open the downloaded file and search for "[" to catch any you missed.
Check stamp duty for your state — many Indian documents are only enforceable on adequate stamp paper or e-stamp; the amount varies by state and document type.
Sign as required — check whether the document needs witnesses, and whether all parties must initial each page.
Check registration — some documents (e.g. certain leases, gift deeds) must be registered with the Sub-Registrar to be fully effective.
Keep signed originals safe and give every party a copy; note any filing, renewal, or compliance deadlines the document creates.

Generic checklist — document-specific stamping and filing steps for this template are being documented.

Generate a Security Awareness & Training Programme for India, free. Formal security awareness, competence and role-based training programme with phishing simulations, completion tracking, attestation and sanctions, mapped to ISO 27001, SOC 2 and PCI DSS. Fill a guided online form and download as PDF or DOCX — no signup, no watermark, no cost.

✅ Free, no signup

Generate and download with no account and no payment.

⬇ DOCX & PDF

Download as PDF / DOCX.

🇮🇳 India-first

Follows Indian legal conventions and state rules.

Frequently asked questions

Is the Security Awareness & Training Programme free to use?

Yes. Lekha is completely free — generate and download your Security Awareness & Training Programme with no payment and no account required.

What format do I get?

You can download the Security Awareness & Training Programme as PDF, DOCX.

Is this Security Awareness & Training Programme valid in India?

The template follows India legal conventions. For high-stakes matters, have it reviewed by a qualified lawyer — Lekha lists verified advocates for free.

Organisation details

Organisation / company name *

Programme effective date *

Programme owner (name)

Programme owner (title)

Onboarding training deadline (days from start date)

Phishing simulation frequency

Alignment

2 required fields left.

📋

Template verified May 2026 — checked against applicable central Acts and current state rules. Legal requirements can change; for property transactions above ₹5 lakh, employment disputes, or business agreements above ₹10 lakh, have a lawyer review it before signing →. Run Lekha Audit on any document you receive →

Attachments

Keep your letterhead, logo, or supporting documents handy while you fill the form. To analyse a document with AI, use Lekha Audit above.

Click or drag files here

Letterhead (PNG/JPG), Logo, PDFs — max 5 MB each

Live preview

0 of 2 essentials added — almost there · +3 optional

Effective Date: [Effective Date]
Programme Owner: ()
Review Cycle: At least annually and after any material change

1. Purpose and Scope

This programme establishes how develops the competence and awareness of everyone whose work can affect the security of information and of cardholder data. It defines the training, phishing exercises, tracking and enforcement that support a positive security culture. It applies to all employees, directors, contractors, temporary staff, interns and relevant third parties who access systems, facilities or data, from the first day of their engagement until it ends. The programme is owned by the , who is accountable for its content, delivery and continual improvement.

2. Roles and Responsibilities

The programme owner designs the curriculum, approves training material, sets the phishing simulation plan and reports outcomes to leadership. Senior management demonstrates a commitment to competence by resourcing the programme, endorsing its objectives and holding managers accountable for their teams' participation. Line managers ensure their people are released to complete assigned training on time and reinforce good practice day to day. Human Resources triggers onboarding assignments and links completion to the joiner, mover and leaver process. Every individual is responsible for completing assigned training, protecting the information entrusted to them and reporting suspected security events promptly.

3. Baseline Awareness for All Personnel

All personnel are made aware of the information security policy, of how their own actions contribute to the effectiveness of the information security management system and to the protection of account data, and of the consequences of not conforming with security requirements. Awareness content covers safe handling and classification of information, password and authentication hygiene, acceptable use of end-user technologies, physical and clear-desk practices, recognising phishing and social engineering, and how and when to report an incident. The policy and its supporting procedures are communicated through more than one channel, including the onboarding session, the policy repository, the staff handbook and periodic security communications, so the message reaches every audience.

4. Onboarding Training

Every new joiner and every contractor is assigned baseline security awareness training on their start date and must complete it, together with a written acknowledgement of the acceptable use and information security policies, no later than 30 days after that date. System, network or data access that is granted before completion is provisional; where a role touches the cardholder data environment or other sensitive systems, the relevant training and acknowledgement are completed before independent access is enabled. HR and the programme owner confirm completion as part of the onboarding checklist.

5. Annual Refresher Training

All personnel repeat security awareness training at least once every twelve months, and in any event no later than the anniversary of their previous completion. Refresher content is refreshed each cycle to reflect current threats, lessons from incidents and simulations, and any change in the environment. Ad-hoc awareness updates are issued out of cycle when a significant new threat, regulatory change or material change to systems or processes warrants immediate communication.

6. Role-Based Training

Beyond the baseline, training is matched to the ways a person could plausibly affect the security of information or account data in their role. Software and development personnel receive secure-coding training at least once every twelve months, covering common vulnerabilities, threats relevant to the technologies and languages they use, and secure design and coding techniques for custom software and interfaces. Staff who handle personal or regulated data receive privacy and data-protection training on lawful handling, minimisation, retention and breach response. Personnel with privileged, administrative or cardholder-data responsibilities receive targeted training on the specific controls, threats and handling rules that apply to their function.

7. Phishing and Social Engineering Simulations

runs simulated phishing and social-engineering exercises at least once each quarter across the workforce to measure and strengthen resilience against these threats. Simulations vary in theme, difficulty and channel so that results reflect genuine susceptibility rather than familiarity. Individuals who interact with a simulated lure are directed to short, supportive corrective learning rather than blame. Results are aggregated and trended to identify at-risk groups, to shape future awareness content, and to demonstrate that the programme addresses phishing and social engineering as required.

8. Competence Assessment

determines the competence needed by people whose work affects security and ensures, through education, training, assessment or relevant experience, that they possess it. Where a role requires demonstrable ability rather than mere awareness, competence is verified through knowledge checks, practical assessment, certification or supervised experience, and gaps are closed with targeted development. Records of the qualifications, certifications and assessment outcomes that evidence competence for security-relevant roles are retained.

9. Completion Tracking and Attestation Records

Assignment and completion of every training activity are tracked centrally, typically through a learning management system, capturing the person, the course, the completion date and the assessment result where applicable. Personnel attest, on completion, that they understand and will comply with the relevant policies, and these attestations are stored as evidence of both awareness and competence. Records are retained for the period defined below and are made available to internal and external auditors on request. The following records are maintained as evidence:

Record	Content captured	Purpose
Onboarding completion	Person, course, completion date, policy acknowledgement	Evidence of timely induction
Annual refresher log	Person, cycle, completion date, score	Evidence of at-least-annual training
Role-based training log	Role, curriculum, completion date, result	Evidence of secure-coding & privacy depth
Phishing simulation results	Campaign, click/report rate, corrective action	Evidence of threat resilience
Competence & certification file	Qualifications, certifications, assessments	Evidence of competence for key roles
Attestations	Signed acknowledgement of policies	Evidence of understanding & consent

10. Programme Metrics and Reporting

The programme owner reports on the health of the programme to leadership at least each quarter. Core metrics include the on-time completion rate for onboarding, refresher and role-based training; the proportion of the workforce overdue; phishing simulation click and reporting rates and their trend over time; the volume and timeliness of staff-reported suspicious messages; and the closure of remedial actions. These metrics inform the annual review and drive continual improvement of content, cadence and targeting.

11. Sanctions for Non-Completion and Repeat Failures

Completing assigned training and acting on its guidance is a condition of continued access. Personnel who miss a deadline receive automated reminders and manager escalation, and access to relevant systems may be suspended until the training is complete. Repeated failure to complete mandatory training, or a repeated pattern of failing phishing simulations after corrective learning, is addressed through the disciplinary process on a graduated basis, up to and including additional supervised training, withdrawal of privileged access and, for persistent or serious cases, formal disciplinary action. Sanctions are applied consistently, proportionately and in line with applicable employment law and any collective agreements.

12. Programme Review and Continual Improvement

This programme, and the awareness and training content that supports it, is reviewed at least once every twelve months and updated as needed to address new threats and vulnerabilities and to reflect changes to the organisation, its systems and applicable obligations. The review considers programme metrics, incident and simulation outcomes, audit findings and workforce feedback. Material changes are approved by the programme owner and communicated to affected personnel.

13. Documentation and Retention

This programme and all records generated under it are retained as documented information for a minimum of the current plus the two preceding assessment periods, or longer where law, contract or the applicable framework requires. Records are protected against unauthorised alteration and are legible, identifiable and retrievable for the duration of their retention.

Prepared by (Programme Owner)

Approved by (Management)

___________

Connected legal intelligence

Everything on Lekha that relates to this document — the clauses inside it, what to do next, the law to learn, and the risks to watch. Educational, not legal advice.

Clauses inside, explained

Data protection (DPDP)Definition of Confidential Information Indemnity Governing law & jurisdiction

Full clause library →

Acts this document touches

Trace each Act to the clauses and other templates connected to it.

Digital Personal Data Protection Act, 2023 Indian Contract Act, 1872 Code of Civil Procedure, 1908 Arbitration and Conciliation Act, 1996

Common risks to watch

Data protection (DPDP). Allocates responsibilities for handling personal data under Indian law.
Definition of Confidential Information. Defines exactly what information the recipient must keep secret.
Indemnity. Allocates who bears the cost if a third party brings a claim.
Governing law & jurisdiction. Fixes which State's courts and which body of law decide any dispute under the document.

Learn the law

🛡️ DPDP Act 2023 & Indian Privacy LawEverything a startup, SME, or CA needs to know about India's new data law

📖 GuidesDPDP Act 2023: what every Indian website now needs →

Applicable compliance

Track these in your organisation's compliance register.

DPDP Act 2023 readiness

Published privacy policy

Open compliance register →

Related templates

Vendor DPA Information Security Policy HIPAA Security Rule Policy HIPAA Notice of Privacy Practices (NPP)HIPAA Business Associate Agreement (BAA)HIPAA Breach Notification Policy

🤖 Ask Vidhi about this documentor use the ✨ Ask AI bubble on any page.

Security Awareness & Training Programme

After you download

Frequently asked questions

Organisation details

📎Attachments

Connected legal intelligence

⚖️ Clauses inside, explained

🏛️ Acts this document touches

⚠️ Common risks to watch

📚 Learn the law

✅ Applicable compliance

📄 Related templates