AW005Simulated exercises on live staff

The testing of the workforce by means of a staged event.

Control	Jurisdiction	Source	What it establishes	Prerequisite or recommendation
Recommended	Belgiumwhere written	CyberFundamentals 2025, EssentialCentre for Cybersecurity Belgium · read 29 Aug 2026	What the Belgian centre sets out for the heaviest of its assurance levels, and the only place in this record where a national authority names the insider as something the detection tools are there to catch.	Phishing simulations are to be run regularly to reduce the risk of social engineering, and simulated phishing or social engineering tests are named again among the methods by which an awareness program is evaluated.