Skip to main content

TN 2276Final2023

NIST Phish Scale User Guide

At a glanceA method for rating how hard a phishing email is to recognize, so click and report rates from phishing exercises can be read in context. It explains why a rising click rate may reflect a harder email, not worse staff. Check NIST's license terms before using it in a program.

Reading level
Practitioner
Length
47 pages · about 30 min for the key parts
Best for
Technology directors, IT staff and service partners
CSF 2.0
Protect
Read it on NIST DOI 10.6028/NIST.TN.2276 ↗

Browse the full library. 70 NIST publications summarized for school districts.

NIST library

When it applies. NIST describes the Phish Scale as free for academic use under a research license agreement, with a separate license for commercial use. Confirm the terms with NIST before building it into a district or vendor program.

Key concepts

The Phish Scale combines the number of visible cues in an email with how well its premise fits the recipient's work. The guide walks through rating an email, interpreting results and using a worksheet. NIST states the scale is free for academic use under a research license and needs a commercial license for commercial use, so districts should confirm which terms apply.

How it is organized

  • Purpose and introduction
  • The method: cues and premise alignment
  • Applying and interpreting ratings
  • Appendix A: scoring worksheet
  • Appendix B: cue descriptions

What a school district should take from it

  • Compare phishing results only between emails of similar difficulty.
  • Emails that match staff work (a parent message, a substitute request) are hardest to spot; train for them.

How to use it in your district

  1. Rate each simulated phishing email before sending and record its difficulty with the results.
  2. Report click and report rates alongside difficulty to the cabinet.
  3. Use high-difficulty results to target coaching, never to punish staff.

Common misconceptions

A lower click rate always means better training.
Click rates also depend on how difficult the email was.

Rubric categories and K12 Cyber Forward tools

Cybersecurity Rubric 2.0 categories

  • PR.ATAwareness & Training

Tools in the program portal

Related publications

Citation and source

TN 2276, NIST Phish Scale User Guide. National Institute of Standards and Technology. 2023. https://doi.org/10.6028/NIST.TN.2276.

Topics: Awareness and training, Email security. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.