Cyber hygiene at work: 12 rules for every employee

Cyber hygiene is a set of simple, repeatable habits that stop employees from opening the door to attackers: checking the sender before clicking, confirming transfers through a second channel, using a password manager and reporting suspicious situations straight away. Below you will find 12 rules that can be explained to anyone on the team, from accounts to the warehouse, each with a short exercise to run at a meeting or as part of cybersecurity training for employees.

What cyber hygiene at work is and why it concerns everyone

Cyber hygiene at work means that every employee knows a few basic rules for working safely with email, phones, passwords and data, and applies them without having to think. It works like handwashing in a hospital: a single gesture seems minor, but it decides whether a problem spreads.

The data shows where the risk lies. In its report for 2025, CERT Polska describes 260,783 registered incidents, of which 253,238 were computer fraud. The most common type was phishing, that is tricking people into giving away logins and passwords for email, banking and social media. Globally, Verizon's DBIR 2026 report states that the human element was present in 62% of the data breaches analysed.

260,783

incidents registered by CERT Polska in 2025, 97% of them computer fraud

CERT Polska, Annual Report 2025

62%

of data breaches involved the human element

Verizon, DBIR 2026

40%

higher median click rate in SMS and phone simulations than in email

Verizon, DBIR 2026

Cyber hygiene in the KSC Act

The amended KSC Act (Dz.U. 2026 poz. 252, in force since April 2026), in the new Art. 8(1)(2), lists the measures that an essential or important entity implements in its information security management system. Under letter (i) it names "cybersecurity education for the entity's staff", and under letter (j) "basic cyber hygiene principles".

For important entities that are public entities, Annex 4 goes further. It requires employees, "including the head of the entity", to apply cyber hygiene principles, and requires training covering types of cyber threats, cyber hygiene principles, incident response and awareness of the consequences of breaches. Among the additional measures, it also lists testing employees' application of cyber hygiene principles and setting rules for using publicly available large generative AI models. We write more about these obligations in the article on NIS2 and KSC training, and about the specifics of local authorities in the article on training for local government.

Even if your company is not covered by the Act, this list is a good point of reference. Customers and partners covered by the KSC Act are increasingly asking their suppliers about the same things. You can do a preliminary check of whether the Act applies to you with the test "Does the KSC Act apply to my organisation?", and the article NIS2 and the KSC Act: who it applies to explains who the Act covers.

12 cyber hygiene rules for employees

Each rule has two parts: what to do day to day and how to practise it as a team. The exercises take between 5 and 20 minutes.

1. A text about an extra parcel fee: stop before you click

Messages about a "held parcel" and an "extra fee of PLN 1.99" are one of the oldest schemes and still work. CERT Polska describes campaigns impersonating InPost and Poczta Polska (the Polish postal service) that lead to fake pages harvesting card details. It also describes a variant in which fraudsters ask you to reply to the text, because this unlocks the link on the phone.

What to do: do not click links in texts about parcels, check the status in the carrier's app, and in Poland forward a suspicious message free of charge to 8080 (it goes to CERT Polska).

How to practise: show three screenshots of text messages, one of them genuine. The team points out which ones are fake and how they could tell. Then everyone saves 8080 in their contacts.

2. An invoice with a changed account number: confirm through a second channel

A fake invoice, or an email "from a supplier" announcing a new bank account, is a classic way to redirect a transfer. The message may even come from the supplier's real mailbox that has been compromised.

What to do: confirm every change of account number by phone, using the number in the contract or previous correspondence, never the number given in the same message. For transfers above an agreed amount, require approval from a second person.

How to practise: a role-play for the finance team: a "supplier" sends a PDF with a new account number and an urgent deadline. Participants describe the next steps, and at the end you write the procedure down on one page.

3. A call "from the bank" or "from IT": hang up and call back

The number on the display can be faked (spoofing). The Polish Ministry of Digital Affairs reminds people that a call can be spoofed even when the number matches the official one, and that a bank employee will never ask for passwords, codes or for software to be installed.

What to do: end the call and dial the number on your card or the bank's website yourself. Apply the same rule to calls "from IT": do not install remote desktop software at the caller's request.

How to practise: a five-minute role-play in pairs. One person is the "consultant" and applies pressure, the other practises politely ending the call. The hardest part turns out to be simply interrupting the conversation, so it is worth repeating.

4. Your boss's voice can be faked

Voice cloning tools are easy to get hold of, and a recording from a talk or an online video is enough to create a convincing imitation. Verizon notes that pretexting, that is building trust with a made-up scenario, often carried out by voice, is becoming an increasingly common entry point for ransomware and extortion attacks.

What to do: never act on an urgent, confidential request for a transfer or data solely on the basis of a call or voice message. Call back on a known number or confirm through another channel.

How to practise: agree a procedure in the management board and finance team for verifying transfer requests, for example a call-back and a check question. Once a quarter, check that everyone remembers it.

5. MFA everywhere, and never approve a sign-in you did not start

Multi-factor authentication makes account takeover much harder, but attackers have found a way around it: MFA fatigue. The US agency CISA describes this as flooding the user with push notifications until they approve one by mistake or out of fatigue.

What to do: turn on MFA for email, VPN and cloud systems. Deny any notification you did not trigger yourself, and report a series of such requests, because it means someone knows your password. On the IT side, CISA recommends number matching and, ultimately, phishing-resistant methods such as FIDO2 hardware keys.

How to practise: show on screen what an approval request with number matching looks like. Ask: "You get a third notification at 11 pm. What do you do?" The correct answer is to deny, report and change your password.

6. One account, one password, and a password manager remembers them

Using the same password for your work email and an online shop means a leak from the shop opens your work mailbox. Human memory cannot cope with dozens of unique passwords, so you need a tool.

What to do: use the company password manager, long passphrases instead of short passwords with special characters, and never write passwords down in notes or files.

How to practise: a 20-minute workshop: everyone installs the manager, moves their three most important accounts into it and turns on MFA for them. People leave with the job done.

7. Install updates straight away, restarts included

According to Verizon DBIR 2026, exploitation of software vulnerabilities (31% of breaches) has overtaken credential theft as the most common way into systems. Some of these vulnerabilities already have patches available that nobody has installed.

What to do: do not postpone updates to the operating system, browser and apps. Restart your computer when it asks, not once a month.

How to practise: five minutes at the start of a meeting: everyone checks whether they have pending updates. This shows you how many devices are actually waiting for patches.

8. Keep files where backups are made

A backup protects against ransomware, disk failure and accidental deletion, but only for the files that are in it. A laptop's desktop is usually not backed up.

What to do: save documents to the company network drive or to cloud storage covered by backups, not locally. Speak up when a team keeps important data outside these locations.

How to practise: ask IT to demonstrate recovering a deleted file from a backup. Employees see that it works, and IT checks the restore procedure at the same time (the KSC Act requires public entities to test it).

9. Public Wi-Fi and working outside the office

A café, hotel or train means networks you have no control over. On top of that, there are people who can see your screen over your shoulder.

What to do: connect through the company VPN or a hotspot from your phone, lock your screen every time you step away from your laptop (Windows + L, on a Mac Control + Command + Q) and do not hold confidential conversations in public places.

How to practise: a scenario quiz with three scenes: an airport, a hotel, a train. For each one, ask: what do you switch on first?

10. An unknown USB device does not go into your computer

A found USB stick, a "conference freebie" or a charging cable from a stranger can contain malware.

What to do: do not plug in devices of unknown origin, and hand any you find over to IT. Use the company cloud to move files.

How to practise: name a specific person or place where found devices are handed in. A rule without an owner usually ends with someone "just checking whose USB stick it is".

11. ChatGPT and other AI tools: do not paste in company data

In Verizon DBIR 2026, 45% of employees regularly use AI on work devices (15% a year earlier), and 67% do so with personal accounts. The type of data most often sent to external models was source code.

What to do: use only AI tools approved by the company and do not paste customers' personal data, contracts, passwords, code or internal documents into them. If in doubt, ask your manager or IT.

How to practise: hand out 10 sample prompts and ask people to sort them into "allowed" and "not allowed". A discussion of borderline examples, such as an anonymised extract from a contract, teaches more than a ban on its own.

12. Report quickly and without fear of consequences

Each of the previous rules will fail at some point. Then time is what counts: the sooner IT or the SOC learns about a click, the smaller the damage. An employee who is afraid of being told off will delay.

What to do: know one reporting channel (a button in your email client, an address, a phone number) and report your own mistakes too. Managers thank people for reporting, even false alarms.

How to practise: after every phishing simulation, show the team not just the click rate but also the number of reports and the time to the first report. This is the metric worth improving.

Why one-off training is not enough

A single two-hour session once a year produces a signature on an attendance list, but changes little in behaviour. Participants remember a general impression, while details such as the 8080 number or the invoice verification procedure fade within a few weeks. Fraudsters, meanwhile, change their scenarios: the CERT Polska report shows how SMS campaigns adapt to new phone security features.

A habit forms through repetition at short intervals and practice on realistic examples. That is why learning spread over time works better:

• Short: a 3–5 minute micro-lesson instead of a lecture.
• Regular: one rule a month, reinforced a few weeks later with a quiz.
• Practical: a phishing simulation or role-play, after which the employee immediately gets an explanation.
• Measured: quiz results, click rates and report rates over time, not just attendance.

A sample 12-month plan

New starters complete a condensed package covering all 12 rules in their first week and then join the cycle. If you are covered by the KSC Act, keep the results from each stage: the auditor will ask for evidence of staff education, not just a declaration. We have collected the list of evidence the auditor will ask for in the NIS2/KSC checklist.

How to check whether it works

Measure your starting point: run one phishing simulation before the programme starts and repeat it every quarter with a different scenario. Track three numbers: the click rate, the report rate and the time to the first report. A good programme lowers the first and raises the other two. You can also do a quick check of knowledge levels with our short quiz.

How it works in ZeroLayer Academy

ZeroLayer Academy turns these rules into a series of remote training sessions: video micro-lessons, games and quizzes, phishing simulations modelled on real campaigns, and certificates for employees. The manager's dashboard shows teams' progress and generates training reports, and the onboarding path covers new employees from day one. You will find the full list of topics in the training topics section. You will find the available options, starting with a pilot for one department, in the Options section.

FAQ

What are the basic cyber hygiene rules at work?

The basic cyber hygiene rules at work are: do not click links in texts about parcels, confirm every change of account number and every urgent request through a second channel, call back on a known number, turn on MFA and deny notifications you did not initiate, use a password manager, install updates straight away, keep files where they are backed up, connect through a VPN outside the office, do not plug in unknown USB devices, do not paste company data into unapproved AI tools and report incidents quickly.

What is the difference between cyber hygiene and cybersecurity?

Cybersecurity in a company covers everything: technology, processes, monitoring and incident response. Cyber hygiene is the part of it that concerns users' everyday habits, such as verifying the sender, passwords, updates and reporting suspicious situations.

Does the KSC Act require cyber hygiene training?

Yes, for essential and important entities. Art. 8(1)(2) of the amended Act (Dz.U. 2026 poz. 252) lists cybersecurity education for staff (letter (i)) and basic cyber hygiene principles (letter (j)). For public entities, Annex 4 also specifies training topics.

How often should employees be trained in cybersecurity?

Short and regular is better than once a year. One micro-lesson or exercise a month, quarterly phishing simulations and an annual review with a test work well. New employees should cover the basics in their first week.

Don't phishing simulations put employees off?

They can, if they are used to point out mistakes. A well-designed simulation ends with an immediate explanation of what the warning sign was, and results are discussed in aggregate, without singling anyone out. Rewarding reports builds trust in the programme.

Sources

• Act of 23 January 2026 amending the National Cybersecurity System Act and certain other acts (Dz.U. 2026 poz. 252) — Journal of Laws of the Republic of Poland, 2 March 2026 (in Polish)
• Annual report on the activities of CERT Polska in 2025 — CERT Polska / NASK, 8 April 2026 (in Polish)
• 2026 Data Breach Investigations Report: Executive Summary — Verizon Business, 2026
• Breach entry point, 2026 DBIR finds (press release) — Verizon, 19 May 2026
• Implementing Number Matching in MFA Applications — CISA, 31 October 2022
• What spoofing is, how to recognise it and how not to be fooled — Ministry of Digital Affairs, gov.pl, 4 August 2022 (in Polish)