How do I answer the cyber insurance question about phishing training?

What exactly does the form ask?

These are the forms' own words, with the form and page each comes from.

How often do you conduct interactive social engineering (i.e., phishing) training?

Do you require all employees at your company to complete social engineering training that includes phishing simulations?

Do you simulate phishing attacks to test employees at least annually?

Annual privacy and information security training for employees

What does it mean for a small firm?

Training is a course or session. A simulation is a test email sent to staff to see who clicks. One form asks for both. Another gives three answers: never, once a year, or twice a year or more.

How do I answer it truthfully?

Find the dates of the last sessions and who attended. Answer with the frequency those dates show. If not every employee took part, the answer to an "all employees" question is No.

Can an outside reading check this?

An outside reading cannot see training. An outside reading can see registered domain names that differ from yours by a letter or two, the names used to send a forged invoice or a change of bank details. Those are worth showing staff in the next session.

Which questions sit next to this one?

• Fraud training for payment staff
• Supplier bank detail changes
• Email filtering