Cybersecurity Deadline Looms: University Staff Face Dec. 31 Training Mandate

Colorado State University now requires all faculty, staff and researchers to finish cybersecurity training every year, and the 2025 deadline is Dec. 31. The university’s Division of Information Technology and CSU System leaders made the training annual because of a rise in cyberattacks and phishing scams aimed at higher education.

Campuses are hard to secure. They run open networks, research systems and administrative platforms side by side, and thousands of people log in every day from offices, labs, dorms and home. Training won’t fix that. It does make phishing harder.

Why CSU made the training annual

Universities have become regular targets for phishing crews, data thieves and ransomware gangs. Openness is the point of a university. It is also a way in. CSU’s announcement on Oct. 13, 2025 said the yearly requirement responds to more cyberattacks and phishing attempts against the system.

The university ties the program to its IT Strategic Plan, which aims to improve the CSU System’s security profile. Best practice in IT security, CSU says, treats educating individuals as the first line of defense.

What the training covers

The course is a self-paced online series of videos with checkpoints along the way, and it covers the basics every user should know to protect university information, from spotting a phishing email to handling confidential records with care. Short, but required.

Staff reach the platform through CSU’s Cybersecurity web page or directly, and can log in to confirm whether they have completed the 2025 cycle.

Getting it done before Dec. 31

It’s online. It comes in short segments, so it can fit around teaching and research schedules. Faculty and staff who haven’t started yet have until Dec. 31 to finish the 2025 cycle.

What other campuses can learn

Plenty of universities run awareness training as a one-time onboarding task. CSU’s move to a yearly requirement for everyone, including researchers, is a model other schools could copy.

Phishing tactics change constantly, and a lure that worked last spring, say a fake payroll notice or a shared-document alert, may look quite different by fall. Hence the yearly refresher.

One deadline, one campus

The Dec. 31 deadline is close, and staff who skip the course leave the university with one more gap. For other institutions, the question is simple: does every employee get regular phishing training, or only new hires?

Check your completion status before the holidays.

Fred Templeton, CISA, CASP, SEC+

Fred Templeton is a practicing Information Systems Auditor in the Washington DC area. Fred works as a government contractor and uses his skills in cyber security to make our country's information systems safer from cyber threats. Fred holds a master's degree in cybersecurity and is currently working on his PHD in Information Systems.