* One allowlisting action by your IT team is required, and launch is subject to a security review of up to one business day.
A security questionnaire from a customer or a tender: What to answer about employee training and a phishing exercise
When you are asked whether you carry out awareness training and a phishing exercise, answer briefly what was done, when, and for how many employees, and attach evidence such as a campaign summary report. Answer only about what was actually done, because an answer you can back up with a document is stronger than a general statement.
This page is intended for businesses that received a security questionnaire from a customer, a supply-chain request, a tender requirement or an auditor's inquiry, for example offices, factories, clinics, law firms and accounting firms. It is not legal advice and does not determine what the law requires.
Questions that are usually asked
These are common questions in questionnaires, not legal requirements. Each customer and framework words them differently. The second column is what you can honestly answer after running an exercise.
| Question | How it is usually asked | What you can answer after an exercise |
|---|---|---|
| Is awareness training for employees carried out, and how often? | Usually asked as a yes/no question with a frequency | The date of the last training, the format (in person or remote) and when the next is planned |
| Are phishing exercises carried out? | Usually asked with a request for the latest date | The campaign date, the number of employees included and summarized results from the report |
| Which employees are included? | All employees, a specific team, contractors | Who was actually in the recipient list, and who was not (for example contractors or new employees) |
| What evidence can be presented? | Sometimes a document is requested, sometimes a statement is enough | An aggregate summary of the report (without a per-employee breakdown), and a certificate of participation / completion of awareness training produced at the end of the campaign |
| What do you do with someone who failed the exercise? | Asked to understand whether there is remediation, not only measurement | The report includes recommendations for action. You can add awareness training and run a repeat campaign to measure improvement |
| What happens with new employees? | Usually asked about onboarding | A procedure that the organization defines itself (for example onboarding training and inclusion in the next campaign). This is a commitment of the organization, not an automatic service |
Sample answer wording
These are templates only. Adapt them to what was done at your organization, fill in the square brackets, and use only sentences that are true. We recommend that a legal party or the organization's information security person go over the final answer.
- 1.Information security awareness training is carried out for employees in the organization. The last training took place on [date], in the [in-person / remote] format, and the next is planned for [date].
- 2.We carried out a controlled phishing exercise on [date], which was sent to [number of employees] employees. A summary document with the open and click rates is available on request.
- 3.The exercise included [all the organization's employees / the teams: specify]. Not included: [specify, or "none"].
- 4.Employees who clicked the decoy email received [training / guidance: specify what was actually done]. A repeat campaign is planned on [date] to measure improvement.
- 5.New employees go through [a description of the procedure that exists in the organization] and are included in the next exercise. [Delete if there is no such procedure].
What evidence a campaign produces
At the end of a self-serve campaign a summary report is sent, which includes:
- The campaign name, start date and end date, the template used and the number of employees
- An organizational risk score and action statistics (open, click)
- A distribution by risk level, and a risk analysis by employee (personal details with name and email, for internal use in the organization)
- Recommendations for action
- An awareness training completion certificate / certificate of participation, included in every campaign (it carries the participant's name)
Note: part of the report (the risk analysis by employee) includes names, email addresses and personal results of employees. For a questionnaire, an audit or an insurer, we recommend providing an aggregate summary only (the date, the number of employees, open and click rates, recommendations) and omitting or removing the per-employee detail, unless the receiving party truly needs it and the organization has decided to provide it.
A report and training can serve as partial evidence for awareness and training controls in the context of ISO 27001 and SOC 2, and they are not a confirmation of compliance.
The module on the explainer page adds a concrete detail to the questionnaire: what the employee learns at the moment of the click. It does not replace the report and the participation certificate. details
The certificate is evidence of awareness training that supports part of the requirements of Amendment 13. This is not a confirmation of full compliance with a law or a standard. The report does not include the organization's procedure documents, which are the organization's responsibility.
How to run this in practice, in three steps
- 1. Build a campaign in the wizard
Sign up with a code by email, choose a scenario, upload an employee list and set a date. From ₪999* per campaign, up to 100 employees, a one-time payment.
- 2. One allowlisting action by IT
Whoever manages email in the organization carries out one allowlisting action, following organized instructions and a delivery check.
- 3. A security review and launch
Our information security team reviews and approves, up to one business day*, and after the campaign ends the report is received.
* One allowlisting action by your IT team is required, and launch is subject to a security review of up to one business day.
Want training as well? Employee awareness training takes place in person (₪1,500) or remotely through Zoom/Teams/Google Meet (₪1,000). Before you start you can also Check your domain's exposure for free.
Frequently asked questions
Related: Phishing exercise and training price list, Phishing exercise for small businesses, Safe AI use training.
Do you have an open questionnaire? Get real evidence for your answer
Run a phishing exercise for your employees yourself from ₪999* per campaign (up to 100 employees), one-time with no subscription, and receive a summary report.
* One allowlisting action by your IT team is required, and launch is subject to a security review of up to one business day.