Foundation: only with a prompt

Foundation is the lowest proficiency band in DigComp. It means the user can perform a task only with direct guidance or a clear prompt. For example, if a colleague says 'Look at the sender's email address' and the user then spots the misspelt domain, that is Foundation. The user does not independently configure security settings or decide to report the email; they simply recognise the warning when told what to look for. Contrast this with Intermediate, where the user would spot the phishing attempt alone, or Advanced, where they would set up filters to block such emails.

A quick elimination trick: if the question says 'with help', 'when prompted', or 'with guidance', the answer is almost always Foundation. Another hint: Foundation users can follow a step-by-step instruction but cannot adapt it. For instance, they might click 'Report phishing' if the button is highlighted, but they would not know to forward the email to IT without being told. Watch out for distractors that describe a user who can explain why the email is phishing—that moves the level to Intermediate or above, because explanation requires independent understanding.

To lock this in, remember the one-word test: 'prompted'. If the user needs a prompt to recognise the warning, it is Foundation. No prompt means a higher band. This rule applies across all Foundation scenarios, not just phishing.