Cybersecurity Awareness Program

The Office of Municipal and School Technology (OMST) administers this program to improve cybersecurity posture through end-user training, evaluation, and simulated phishing campaigns. Please review the program eligibility details and application instructions below.

Local government agencies apply to participate in the program through a competitive application process each fall. Program costs are covered by the Executive Office of Technology Services and Security. OMST monitors participation and provides ongoing support via 'Ask Me Anything' sessions with our program coordinator, our SharePoint site, and the [e-mail] email. Organizations have full access to content, tools, user management, and reports to help engage their users.

What is the program?

The Executive Office of Technology Services and Security's (EOTSS) Office of Municipal and School Technology procures licenses and manages the Cybersecurity Awareness Program – making the program free to participating organizations. Our program improves overall cybersecurity posture through end-user training and simulated phishing campaigns.

Information about the program learning paths:

We pre-design four different learning paths to save Local Coordinators time and allow them to choose the right training for different groups of employees based on prior cybersecurity training. The same topics are covered in each path. Local coordinators will be able to enroll employees in one or more of the learning paths below.

• Foundational: This learning path will include one 45-minute module covering the latest cyber threats employees face and the attack methods cybercriminals use to gain access to sensitive information.
• Comprehensive: This learning path includes more in-depth modules, each approximately 5-15 minutes.  The target audience for this path may include new employees, all employees, or employees demonstrating a lack of mastery of cybersecurity best practices.
• Traditional: This learning path includes short modules, each no longer than 6 minutes. Ideally, the target audience for this path includes employees who have already taken the Comprehensive training in prior years.
• Advanced: The target audience for this path is IT staff with limited time to meet compliance requirements and have a solid foundation of cybersecurity knowledge. Employees enrolled in this path may test out of modules.  Should they fail the test, they must complete the full-length modules, which may take 15 minutes each.

Why use the program?

AI is adding an even greater sense of urgency to educating your employees regarding cyber criminals' tactics.

• AI-automated phishing emails achieve a 54% click-through rate, versus 12% for standard phishing attempts — a 4.5× improvement in attacker effectiveness (Microsoft Digital Defense Report 2025). 
• Vishing (voice phishing) attacks surged 442% year-over-year in 2025, driven by AI voice-cloning tools reducing the cost and skill required (CrowdStrike 2025 Global Threat Report). 
• AI-generated text in malicious emails doubled year over year (Verizon DBIR 2026).

You can't afford to not train your employees.  With our support you will not only be able to deliver effective training, but build a strong program with a security focused culture.

Who is eligible?

The 2027 program is open to local government agencies in the Commonwealth of Massachusetts:

• Cities/Towns
• Public school districts
• Municipal libraries
• Police departments and fire departments
• Planning commissions
• Municipally-run utility departments, airports, and housing authorities
• Massachusetts Public Pension Systems (PERAC)

Employees in municipal functions that have a government network-specific domain are eligible to participate. 

Municipal/local government agencies that demonstrate commitment from leadership for full engagement from their organization will be most successful with this program. Each organization must designate a local coordinator who will be responsible for administering this program. After initial setup, Local Coordinators spending less than an hour a week will be able to monitor training and phishing progress. Additional time will be  required to effectively communicate expectations and progress to both employees and leadership, follow-up with employees who fail phishing campaigns, and generate and maintain engagement in your program.

Home Course

A free cybersecurity awareness course is available to Massachusetts residents. Learn about phishing, social engineering, how to protect your data, and more. Email [e-mail] to access the training. 

Where can I learn more?

Should you have any further questions about the program, please click below to check out our Frequently Asked Questions (FAQ) or you can email us at [e-mail]. 

Cybersecurity Awareness Program FAQ 

How to apply

Organizations are encouraged to apply through a competitive application process which opens during October, Massachusetts Cybersecurity Awareness Month. Program costs are covered by EOTSS. OMST partners with participating organizations by advising and assisting with initial setup, monitoring progress, and providing ongoing support and guidance via Ask Me Anything meetings.

Cybersecurity Awareness Program Application 

Next steps

Local government agencies are accepted into the program on a rolling basis after the application period opens. Applications will be reviewed on a rolling basis until all licenses have been allocated.

Review Process

The staff at the Executive Office of Technology Services and Security will review applications based on factors such as: 

• A commitment to communicate and partner with EOTSS to better understand the importance of cybersecurity at the local level
• A willingness to assign and support the Local Coordinator in their oversight of the program
• An assurance that an email is assigned from your organizational domain for each user