Anthropic-Cybersecurity-Skills/skills/performing-phishing-simulation-with-gophish/references/standards.md

Standards & References: Phishing Simulation with GoPhish

Legal & Compliance Framework

• Computer Fraud and Abuse Act (CFAA): Ensure written authorization before conducting simulations
• GDPR (EU): Data protection requirements for handling employee email addresses and click data
• CCPA (California): Employee data privacy considerations
• Company Acceptable Use Policy: Must align simulation with organizational policies

Industry Standards

• NIST SP 800-50: Building an Information Technology Security Awareness and Training Program
• NIST SP 800-16: Information Technology Security Training Requirements
• SANS Security Awareness Maturity Model: Five levels from non-existent to metrics framework
• ISO 27001:2022: A.6.3 - Information security awareness, education and training

MITRE ATT&CK References

• T1566.001: Phishing: Spearphishing Attachment
• T1566.002: Phishing: Spearphishing Link
• T1598: Phishing for Information
• T1204.001: User Execution: Malicious Link
• T1204.002: User Execution: Malicious File

GoPhish Technical Reference

API Endpoints

Endpoint	Method	Description
/api/campaigns/	GET	List all campaigns
/api/campaigns/	POST	Create new campaign
/api/campaigns/{id}	GET	Get campaign details
/api/campaigns/{id}/results	GET	Get campaign results
/api/campaigns/{id}/summary	GET	Get campaign summary
/api/templates/	GET/POST	Manage email templates
/api/pages/	GET/POST	Manage landing pages
/api/smtp/	GET/POST	Manage sending profiles
/api/groups/	GET/POST	Manage user groups
/api/import/email	POST	Import email template
/api/import/site	POST	Import/clone website

Campaign Event Types

Event	Description
Email Sent	Email delivered to target
Email Opened	Tracking pixel loaded
Clicked Link	User clicked phishing URL
Submitted Data	User entered credentials
Email Reported	User reported via plugin

Phishing Simulation Best Practices

1. Always obtain written authorization from executive management
2. Coordinate with IT/security teams to whitelist simulation infrastructure
3. Start with easier-to-identify phishing and increase difficulty gradually
4. Never punish employees for failing - focus on education
5. Provide immediate training after user interaction
6. Run campaigns regularly (monthly/quarterly) for sustained awareness
7. Vary scenarios across campaign types (credential harvesting, attachment, link)
8. Respect opt-outs where legally required
9. Protect campaign data - treat click/submit data as sensitive
10. Report metrics anonymously when possible at department level