Knows not toplugunknownUSBs intodevicesRecognizesasuspiciousQR codeAvoidspublicWi‑Fi forwork tasksRecognizesan “urgent”or “act now”red flagForwardsunusualemails to thesecurityteamDeletes datathey’re nolongerauthorized toretainAvoidsdownloadingunknownapplicationsNoticesspelling/grammarerrors in asuspicious emailIdentifiesa spoofedsendernameDeclines toshareinformationover thephoneCompletesannualsecuritytrainingAvoidssendingsensitive infounencryptedUses onlyapprovedtools forworkFree!Validatespayment orchangerequeststhrough asecond channelDouble-checksexternalrecipientsbefore sendingReports asuspiciousemailUses securefile transferinstead ofemailattachmentMentions“Thinkbeforeyou click”Recognizeswhensomeone asksfor too muchinformationAvoidssharingcredentialswith anyoneIdentifiessuspiciousactivity ontheir account“Thislooks likea phishingattempt”StoressensitivefilessecurelyDeletesunexpectedattachmentsKnowshow toreport anincidentLockscomputerwhensteppingawayHoveringover linksbeforeclickingVerifiessenderemailaddressUsescompany‑approvedcloud storageCreates astrongpassphrase(not just apassword)UpdatessoftwarewhenpromptedRecognizesa scam orfake offerKnows theorganization’ssecuritypolicies existShredsdocumentswithpersonal orclient infoUsesmulti‑factorauthenticationAvoids takingphotos/screenshotsof client dataRecognizesa fake loginpage“If it seemstoo good tobe true, itprobably is”Usesapprovedsystems forwork filesReports asuspicioustextmessageKnows not toplugunknownUSBs intodevicesRecognizesasuspiciousQR codeAvoidspublicWi‑Fi forwork tasksRecognizesan “urgent”or “act now”red flagForwardsunusualemails to thesecurityteamDeletes datathey’re nolongerauthorized toretainAvoidsdownloadingunknownapplicationsNoticesspelling/grammarerrors in asuspicious emailIdentifiesa spoofedsendernameDeclines toshareinformationover thephoneCompletesannualsecuritytrainingAvoidssendingsensitive infounencryptedUses onlyapprovedtools forworkFree!Validatespayment orchangerequeststhrough asecond channelDouble-checksexternalrecipientsbefore sendingReports asuspiciousemailUses securefile transferinstead ofemailattachmentMentions“Thinkbeforeyou click”Recognizeswhensomeone asksfor too muchinformationAvoidssharingcredentialswith anyoneIdentifiessuspiciousactivity ontheir account“Thislooks likea phishingattempt”StoressensitivefilessecurelyDeletesunexpectedattachmentsKnowshow toreport anincidentLockscomputerwhensteppingawayHoveringover linksbeforeclickingVerifiessenderemailaddressUsescompany‑approvedcloud storageCreates astrongpassphrase(not just apassword)UpdatessoftwarewhenpromptedRecognizesa scam orfake offerKnows theorganization’ssecuritypolicies existShredsdocumentswithpersonal orclient infoUsesmulti‑factorauthenticationAvoids takingphotos/screenshotsof client dataRecognizesa fake loginpage“If it seemstoo good tobe true, itprobably is”Usesapprovedsystems forwork filesReports asuspicioustextmessage

General Security Awareness - Call List

(Print) Use this randomly generated list as your call list when playing the game. There is no need to say the BINGO column name. Place some kind of mark (like an X, a checkmark, a dot, tally mark, etc) on each cell as you announce it, to keep track. You can also cut out each item, place them in a bag and pull words from the bag.


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
  1. Knows not to plug unknown USBs into devices
  2. Recognizes a suspicious QR code
  3. Avoids public Wi‑Fi for work tasks
  4. Recognizes an “urgent” or “act now” red flag
  5. Forwards unusual emails to the security team
  6. Deletes data they’re no longer authorized to retain
  7. Avoids downloading unknown applications
  8. Notices spelling/grammar errors in a suspicious email
  9. Identifies a spoofed sender name
  10. Declines to share information over the phone
  11. Completes annual security training
  12. Avoids sending sensitive info unencrypted
  13. Uses only approved tools for work
  14. Free!
  15. Validates payment or change requests through a second channel
  16. Double-checks external recipients before sending
  17. Reports a suspicious email
  18. Uses secure file transfer instead of email attachment
  19. Mentions “Think before you click”
  20. Recognizes when someone asks for too much information
  21. Avoids sharing credentials with anyone
  22. Identifies suspicious activity on their account
  23. “This looks like a phishing attempt”
  24. Stores sensitive files securely
  25. Deletes unexpected attachments
  26. Knows how to report an incident
  27. Locks computer when stepping away
  28. Hovering over links before clicking
  29. Verifies sender email address
  30. Uses company‑approved cloud storage
  31. Creates a strong passphrase (not just a password)
  32. Updates software when prompted
  33. Recognizes a scam or fake offer
  34. Knows the organization’s security policies exist
  35. Shreds documents with personal or client info
  36. Uses multi‑factor authentication
  37. Avoids taking photos/screenshots of client data
  38. Recognizes a fake login page
  39. “If it seems too good to be true, it probably is”
  40. Uses approved systems for work files
  41. Reports a suspicious text message