Which compliance frameworks require security awareness training?
Almost every security and privacy framework an organization is likely to face expects its people to be trained. The wording differs, and so does how strictly it is enforced, but the pattern is the same: a documented program, training for everyone (including management), regular refreshers, and records that prove it happened.
This guide summarizes what the most common frameworks ask for. It is a starting point, not legal advice. Always confirm your own obligations with your auditor or counsel.
At a glance
| Framework | Who it applies to | What it expects |
|---|---|---|
| ISO/IEC 27001:2022 | Organizations certified to the standard | Awareness, education and training for staff (Annex A control 6.3), plus competence and awareness requirements in clauses 7.2 and 7.3 |
| SOC 2 | Service organizations reporting to customers | Training is not a single named control, but auditors look for it as evidence of competence and internal communication (criteria CC1.4 and CC2.2) |
| PCI DSS v4.0 | Anyone who stores, processes or transmits card data | A formal awareness program, training on hire and at least every 12 months, including phishing and social engineering (requirement 12.6) |
| HIPAA Security Rule | US covered entities and business associates | A security awareness and training program for all workforce members, including management (45 CFR 164.308(a)(5)) |
| NIS2 | Essential and important entities in the EU | Training for management bodies, and cyber hygiene and cybersecurity training as a risk-management measure (Articles 20 and 21) |
| DORA | EU financial entities | ICT security awareness programs and digital operational resilience training for all staff and senior management (Article 13) |
| NYDFS Part 500 | Financial services regulated in New York | Cybersecurity awareness training, including social engineering, for all personnel at least annually (500.14) |
| GLBA Safeguards Rule | US financial institutions under FTC jurisdiction | Security awareness training for personnel, updated as needed (16 CFR 314.4(e)) |
| NIST SP 800-171 / CMMC | US defense contractors handling controlled unclassified information | Security awareness, role-based training and insider-threat awareness (family 3.2) |
ISO/IEC 27001:2022
ISO 27001 treats awareness in two places. Clause 7.3 requires that people doing work under the organization’s control are aware of the information security policy, how they contribute to it, and what happens if they do not conform. Annex A control 6.3 asks for appropriate awareness, education and training, with regular updates on policies and procedures relevant to each person’s role.
Certification auditors usually ask to see the training plan, who has completed it, and how you check that it worked.
SOC 2
The SOC 2 Trust Services Criteria do not include a control titled “security awareness training”. In practice, though, almost every SOC 2 report includes it, because it is the most direct way to show that you develop competent people (CC1.4) and communicate security responsibilities internally (CC2.2). Expect your auditor to sample employees and ask for proof that each one completed training during the review period.
PCI DSS v4.0
PCI DSS is the most specific. Requirement 12.6 calls for a formal security awareness program that is reviewed at least once every 12 months. Personnel must receive training when they are hired and at least once every 12 months after that, and must acknowledge that they have read and understood the security policy. Since March 31, 2025, the training must also cover threats such as phishing and social engineering (12.6.3.1) and the acceptable use of end-user technologies (12.6.3.2).
HIPAA Security Rule
Under the administrative safeguards, covered entities and business associates must “implement a security awareness and training program for all members of its workforce (including management)”. The rule lists four implementation specifications: security reminders, protection from malicious software, log-in monitoring and password management. Documentation of the training must be kept for six years.
NIS2
The NIS2 Directive raises the bar for management. Article 20 requires members of management bodies of essential and important entities to follow training, and encourages entities to offer similar training to their employees regularly. Article 21 lists “basic cyber hygiene practices and cybersecurity training” among the minimum risk-management measures. Each EU member state sets out the details in its national law.
DORA
The Digital Operational Resilience Act applies to banks, insurers, investment firms and other EU financial entities from January 17, 2025. Article 13 requires them to develop ICT security awareness programs and digital operational resilience training as compulsory modules in their staff training, for all employees and senior management.
NYDFS Part 500
New York’s cybersecurity regulation, as amended in November 2023, requires regulated entities to provide cybersecurity awareness training that includes social engineering for all personnel, at least annually.
GLBA Safeguards Rule
The FTC’s Safeguards Rule requires financial institutions to make sure their personnel can carry out the information security program, including by providing security awareness training that is updated as needed to reflect risks.
NIST SP 800-171 and CMMC
Defense contractors that handle controlled unclassified information must meet the awareness and training family of NIST SP 800-171: make managers, system administrators and users aware of security risks (3.2.1), train people for their security roles (3.2.2), and train them to recognize and report insider threats (3.2.3). CMMC Level 2 assessments check these practices.
What auditors ask to see
Across all of these frameworks, the evidence looks much the same:
- A written training policy or program, and when it was last reviewed
- Training on hire and at a regular interval, usually at least annually
- Attendance or completion records for every person in scope
- Content that covers current threats such as phishing and social engineering
- Proof that people understood the training, such as quiz results or acknowledgments
An annual slide deck can technically tick the box, but most frameworks now expect training to be ongoing and relevant to each role.
How Genbay helps
Genbay’s cybersecurity awareness training runs as ongoing live sessions all year, for everyone in your organization, on one per-seat plan. On the Evidence and Total Upskill plans you also get attendance reports, quizzes and verifiable certificates to give your auditors. See pricing or contact us.
Sources
- ISO/IEC 27001:2022, International Organization for Standardization
- PCI DSS document library, PCI Security Standards Council
- 45 CFR 164.308, HIPAA administrative safeguards
- NIS2 Directive (EU) 2022/2555, EUR-Lex
- DORA Regulation (EU) 2022/2554, EUR-Lex
- NYDFS cybersecurity resource center, New York State Department of Financial Services
- 16 CFR 314.4, FTC Safeguards Rule
- NIST SP 800-171 Rev. 2, National Institute of Standards and Technology
This article is general information, not legal advice. Requirements change; check the current text of each framework and confirm your obligations with your auditor or counsel.