Federal agencies are obligated under 5 C.F.R. § 930.301 to deliver security awareness training both at onboarding and on a recurring basis, and this introductory course is designed to fulfill that mandate outright rather than to supplement something else that does. The curriculum spans the complete landscape of contemporary social engineering: alongside phishing, spear-phishing, whaling, and business email compromise, it treats SMS-based attacks, voice-based attacks including AI-generated voice deepfakes, QR code exploitation, pretexting, tailgating, badge cloning, and USB drop attacks.
The training also links social engineering awareness with insider threat warning signs, given that the two categories flow through overlapping reporting pathways. Participants examine six to eight true-to-life artifacts — emails, text messages, and voicemail transcripts — some genuine and some hostile, and render a judgment on each. The immediate-feedback answer key devotes most of its explanation to the borderline examples, since that's precisely where actual breaches take root.
