Dawkins, S.
and Jacobs, J.
(2023),
NIST Phish Scale User Guide, Technical Note (NIST TN), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.TN.2276, https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=956851
(Accessed April 28, 2024)
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (
) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
NIST Phish Scale User Guide
Published
Author(s)
,
Abstract
The phishing cyber threat exploits vulnerabilities in the U.S. and around the world across private and public sectors. Embedded phishing awareness training programs, where simulated phishing emails are sent to employees, are designed to prepare employees in these organizations to combat real-world phishing scenarios. Cybersecurity and phishing awareness training implementers and practitioners use the results of these programs, in part, to assess the security risk of their organization. The NIST Phish Scale is a method created for cybersecurity and phishing awareness training implementers to rate an email's human phishing detection difficulty as part of their cybersecurity awareness and phishing training programs. This User Guide outlines the Phish Scale in its entirety while providing instructional steps on how to apply it to phishing emails. Further, appendices include 1) worksheets to assist training implementers in applying the Phish Scale and 2) detailed information regarding email properties and associated research in the literature.Citation
Technical Note (NIST TN) - 2276
Report Number
2276
NIST Pub Series
Pub Type
NIST Pubs
Download Paper
Keywords
Business Email Compromise, Cybersecurity, Human-Centered Cybersecurity, Phish Scale, Phishing, Social Engineering, Usable Cybersecurity
Citation
Created November 15, 2023