Scoping a phishing simulation programme in India

Six things have to be settled before a phishing simulation programme starts, and the order matters: the population and its cohorts, the scope boundary around them, the cadence, the channels, the exclusions and stop conditions, and the escalation contacts. All six land in one document, signed before anything is sent, because CERT-In's audit policy guidelines require it.

Specific written permissions must be obtained from the auditee organization before conducting tests that involve survivability failures, denial-of-service (DoS), process testing, or social engineering.

CISG-2025-02, Version 1.0, 25 July 2025, §13.2.7(ii), p. 50. They fall in that order because each narrows the next, and the authorisation is written last.

Population and cohorts

Start from named groups with counts. A programme scoped as "all staff" returns one figure a year and no way to read a trend. Cohorts return a result each, and they are the units the clause is written about.

The RBI Directions, 2026, issued 31 July 2026, name the cohorts. For commercial banks, ¶203 makes cybersecurity awareness programmes "mandatory for all new recruits" and annual training the rule "for lower and middle management"; ¶204 adds "annual training to all Board members and Senior Management". Urban co-operative banks under ¶156 carry new recruits plus "web-based quiz and training for lower, middle, and upper management every year". Upper management is named there. ¶156 sits in Section H of Chapter V, binding Level III and Level IV UCBs. Cohorts drawn on those lines produce evidence that maps to the paragraph.

Then size them. §15.2.2(iii), pp. 55–56, requires that testing aimed at general staff "must utilize anonymized or statistical techniques—ensuring no individual is personally identified or penalized". A percentage over a cohort of four is an individual result wearing a percentage sign. Set a minimum reporting cohort size and roll smaller teams into their parent function. Where a small population must be measured in its own right, as the executive cohort usually must, agree that the result is reported as a count within the cohort.

The scope boundary

The same clause fixes the outer edge. These tests "must only target group of employees explicitly included within the agreed audit scope", and "must not involve external entities such as customers, business partners, vendors, or other third parties, unless specific written consent is obtained from the target organization".

The hard cases are the people who sit at your desks and are paid through someone else's contract: contractors, managed service staff, an outsourced service desk, a BPO handling your customers. They read your mail and hold your credentials. The scope document settles each group in turn, as employee population or as vendor. Where the answer is vendor, the clause points at specific written consent. Settle it with the sourcing contract open, not in week three of the window.

Cadence comes from the clause

Cadence is read off the instrument binding the entity. One round gives a number, a run of them gives a direction, and a schedule that drifts leaves rounds that cannot be set against each other.

Both readings sit in the same circular, so record which one the cadence answers. One clause names the method: GV.RM Guidelines item 1(e), p. 87, standards column GV.RM.S3, applicability "All REs except small-size, self-certification REs (Mandatory)". It reads: "REs shall periodically assess level of employee cybersecurity awareness, for e.g., through phishing test success rate, etc." Quote it in the scoping note exactly as it stands.

Channels

Email is the baseline and, for most programmes, the whole of round one. It reaches the entire population, and it is the channel SEBI's guidelines point to when they call for campaigns that "stress the avoidance of clicking on links and attachments in email" (PR.AT Guidelines, pp. 103–104).

Vishing is scoped separately, only where the authorisation covers it, and it is aimed at a process. The engagement types at §6, pp. 14–17, are given as "including, but not limited to", and this work sits under (x) Process Security Testing and (xvi) Red Team Assessment. A vishing call tests whether the service desk's caller-verification procedure survives contact: were the documented steps followed, and did they produce a safe outcome? Name the procedure and its version in the scope document, and the result is a finding against a control. Left unnamed, it is an anecdote about one person on one afternoon.

Exclusions, stop conditions and escalation contacts

Exclusions are recorded when they are agreed, with the reason. Groups come out of a round on sound grounds: a treasury desk in a settlement window, a function mid-migration, a team already in a disciplinary process. An exclusion carrying no recorded reason is indistinguishable, a year on, from a population the programme quietly stopped measuring. An auditor comparing two rounds will read it that way.

Write at least one stop condition and name who may invoke it. The standard one is collision with a real incident: if a genuine phishing campaign or a live security incident is running against the organisation, the simulation pauses. A simulated message landing mid-event contaminates the response. Decide in advance who makes that call on each side, what a pause means for sends in flight, and whether the round resumes or is rerun.

Escalation contacts are named people, not role mailboxes, and they must be reachable through the execution window, out of hours included: the security contact who can confirm within minutes that a reported message is ours, the service desk owner whose queue fills, the HR partner who takes the first complaint, and the signatory. A list that routes into a ticket queue does not function at the hour it is needed.

The written authorisation

§13.2.7(ii) puts the permission before the test, so the authorisation is where every decision above is written down and signed by someone with the authority to give it. The checklist below is its contents page.

The data terms belong in it too

Signed before anything is collected, the authorisation is where the click dataset's terms are settled. The Digital Personal Data Protection Act, 2023 (Act 22 of 2023) supplies the ground: s.4(1) permits processing on consent or on a legitimate use, and s.7(i) covers processing "for the purposes of employment or those related to safeguarding the employer from loss or liability". Record which ground is relied on. s.8(5) requires reasonable security safeguards, so name where identified per-recipient data sits and who can reach it. s.8(7)(a) requires erasure "as soon as it is reasonable to assume that the specified purpose is no longer being served", so name the point at which the identified dataset is destroyed and the aggregate retained. That date is easier to fix at commissioning than once the data exists.

Pretext boundaries

Rule the themes out in advance, before there is a complaint to adjudicate. The categories that generate complaints are predictable: pay, bonus and salary revision; medical and benefits claims; redundancy, restructuring and role change; bereavement and family emergency; and any pretext impersonating a named individual inside the organisation. The list has to be written, agreed by the people who will field the reaction, and attached to the authorisation.

Band the pretext difficulty in the same document. A generic lure sent to a broad list will not return a number comparable with one built on an internal process and addressed by name. Record the band for each round, so round two can be read against round one at the difficulty it was designed for.

Before the first send

Ten things should exist in writing, signed, before a single message leaves:

1. The population, by named cohort with counts, and the reporting floor for rolling small cohorts up.
2. The scope boundary, with each third-party group inside it under specific written consent, or outside it.
3. The cadence, and the clause and paragraph it answers.
4. The authorised channels, and for vishing the procedure and version under test.
5. Every exclusion, with its reason and the date agreed.
6. The stop conditions, and who may invoke them on each side.
7. The escalation contacts, named and reachable through the window.
8. The ruled-out pretext themes and the difficulty band for the round.
9. The data terms: the ground relied on, where identified data sits, and when it is erased.
10. The §13.2.7(ii) authorisation itself, signed and dated.

A programme holding those ten before round one can answer an auditor out of the documents it ran on. Assembling them afterwards means writing the paperwork and the result at the same time, and the two will not agree.