Assign employee training
Deliver courses through the employee portal and maintain assignment history.
FFIEC Awareness Support
Security Awareness Training for an FFIEC-Aligned Program
Help employees practice recognizing phishing threats and maintain clear records of training and simulation activity.
Phishmake supports a risk-based workflow while leaving regulatory interpretation and examination decisions to the appropriate authorities.
Risk-based training • Controlled simulations • Tracking • Reporting
01Plain-English Context
Where Security Awareness Fits Within FFIEC Guidance
The FFIEC develops principles and resources used by its member agencies to promote consistent supervision of financial institutions.
Security awareness is one element of a broader risk-based information-security program and should be interpreted in the context of the institution's regulator, size, complexity, and risk profile.
Source: FFIEC IT Examination Handbook
02Practical Support
FFIEC Security Awareness Training With Measurable Activity
Run controlled simulations
Use built-in or custom phishing scenarios to exercise everyday decisions.
Track employee activity
Review supported campaign events and training progress at employee level.
Prepare useful records
Keep campaign results and completion evidence available for internal review.
03Workflow
A Practical FFIEC Awareness Workflow
- 01Assess risk
- 02Plan
- 03Train
- 04Simulate
- 05Review
- 06Reinforce
- 07Retain records
04Evidence
Keep Training and Simulation Records Together
Phishmake centralizes campaign delivery and interaction events, assignments, progress, and completion. These records can support reporting and evidence collection, but do not prove that a program is sufficient or compliant.
05Financial Institutions
Support Awareness Programs Across Financial Teams
Banks
Connect simulations, employee learning, and organized records.
Credit unions
Create a repeatable awareness and testing workflow.
06Connected Program
Connect Awareness Training With Employee Phishing Tests
Training explains expected behavior; controlled simulations provide an opportunity to apply it. Together, they create a measurable cycle of education, practice, and reinforcement.
Common questions
What is the FFIEC?
The Federal Financial Institutions Examination Council develops uniform principles, standards, and report forms used by its member agencies in federal supervision of financial institutions.
Does FFIEC guidance require phishing simulations?
FFIEC resources support risk-based information-security and awareness practices, but phishing simulation should not be treated as a universal stand-alone mandate. Confirm expectations with the institution's regulator.
How can Phishmake support an FFIEC-aligned program?
It can help teams assign training, run controlled simulations, review employee activity, and retain useful records as part of a broader risk-based program.
Is Phishmake an FFIEC certification?
No. FFIEC does not certify Phishmake, and using the platform does not guarantee examination outcomes.
How often should phishing simulations be conducted?
There is no universal schedule. Frequency should reflect the organization's risk assessment, workforce, policies, threat environment, and applicable requirements. A repeatable program is more useful than an isolated test.
Can training and simulation results support compliance reporting?
They can provide evidence that awareness activities occurred and were monitored. Those records do not, by themselves, establish compliance or guarantee that an auditor or examiner will consider the evidence sufficient.
Published by Phishmake
Keep building your program
All resourcesPut it into practice
Build a More Measurable Financial Security Awareness Program
Connect employee training, phishing simulations, and activity records in one platform.