Security compliance training controls: general guidance

Training is asked to carry a great deal of weight it cannot bear. A session cannot make somebody reliably distinguish a genuine message from a careful imitation, and building a program on that expectation produces a workforce that feels responsible for a judgment nobody can make consistently.

Security compliance training controls work best when training has a narrower, more useful role: teaching a response, establishing a route, and making a process rule feel normal. This page separates that role from what configuration must do, then sets out the controls a program needs to work.

What to take away

What moves each risk

Read the middle column first. Where it names a configuration change, do that before writing any material, because the material is a poor substitute for it and an expensive one. The account items belong to identity and access, the device items to endpoint security, and the copy that cannot be altered to backup and recovery.

The third column is not empty anywhere except one row, and it is worth noticing how modest each entry is. That modesty is the correct scope of a training program.

The four controls a program needs

A reporting route that takes one action. A button in the mail client, or a single well-known address that is already in everyone's contacts. Anything requiring recall will not be used under time pressure. This is the control the whole program rests on.

A named owner with an hour a month. Somebody whose job includes running the ten minutes, reading what gets reported, and keeping the record. Programs without an owner decay quietly into an annual module.

A record kept as routine. Who was trained, when, on what, and who is outstanding. Assembled continuously rather than under deadline, because the deadline is usually somebody else's questionnaire arriving with a week's notice.

A stated response to self-reported mistakes. Written down, said aloud by the most senior person, and honored the first time it is tested. This costs nothing and it is the control that determines whether the first one produces anything.

Role-specific drills, which are the part that works

General material has a general effect. Drills aimed at one role have a specific one.

Whoever handles payments. The rule is that any change of bank details, any first payment to a new payee, and any urgent request bypassing the normal process is confirmed by voice on a number held before the request arrived. Practice it by having somebody senior deliberately trigger a call-back, so the first time is not the real time. The reasoning is in business email compromise.

Whoever administers systems. What an unexpected approval or consent prompt means, and that the correct response to one is to decline and say so. Also that their own account is the one most worth protecting.

Whoever answers the phone or the shared mailbox. That it is always acceptable to say the request will be checked and called back, and that nobody will be criticised for it.

Everyone. The route, and that reporting a thing you did yourself is welcome.

What the named compliance regimes ask of training

Which requirement applies to you depends on what you do, so it helps to know where the training clause actually sits in each of them.

The cadence that satisfies most of them is short: before access on the first day, a refresh at least once every 12 months, and a short retraining after an incident or a change of role. HIPAA fixes no interval and asks instead for periodic reminders, so the interval you choose is the one you have to defend.

The records have to outlive the training. HIPAA expects the documentation behind the program to be kept for six years (45 CFR §164.316(b)(2)(i)). The usual evidence standard is a dated completion log — name, date, topic, role drill — plus a signed acknowledgement that the person received the security policy, the form most organizations call an attestation or a policy acknowledgement, signed at onboarding and at each refresh.

None of this requires a purchase. What the paperwork buys is the answer you can give when a customer questionnaire, a card assessment or a HIPAA review asks for it, and what you lose without it is the answer, and occasionally the contract.

Evidencing it to somebody outside

The controls above are general program practice; the obligation itself lives in whichever named requirement applies to you, and the details differ by industry, contract and state. Confirm the specifics with your own advisers rather than relying on a platform's claim to be compliant, and keep the mapping in writing next to the record.

A record that already exists helps in every case: dates, topics, attendance, the reporting route, and role drills with their last run dates. The United States National Institute of Standards and Technology's Special Publication 800-50 Revision 1, Building a Cybersecurity and Privacy Learning Program sets out how to build a cybersecurity and privacy learning program.

That is useful when a questionnaire asks a question you have not been asked before.

Measuring the controls rather than the training

A quarterly review of the controls takes about an hour.

Rising reports and a rule that held are the two results worth having. Completion percentages measure attendance, and attendance was never the problem. For anyone with staff or customers in the United Kingdom, the National Cyber Security Centre's Small and medium-sized organisations guidance is the counterpart to the NIST material above.

Common questions

Where should a business with nothing start?

The reporting route and the payment rule, this week. Both are configuration and process rather than training, and both do more than any session you could run. Then start the record, because the next questionnaire will ask for it on short notice.

Can training substitute for a control we cannot afford?

Rarely, and it is worth being honest about which. Where a regime names a control — the second factor, the call-back — training cannot stand in for it, and saying that it does is the claim that fails an assessment. Most of the controls in the middle column above are settings in software you already pay for rather than purchases, which is the argument security foundations makes about the order of security work.

How do we handle contractors and temporary staff?

The same route and the same rules, from the first day, and the same record. PCI DSS says all personnel rather than all employees, and contractors frequently hold access that matters, which makes the exclusion expensive.

What do we do when somebody reports something that turns out to be nothing?

Thank them, in a way other people notice. The cost of a false report is two minutes. The cost of a culture where nobody reports is the whole program, and it is the point made about blameless reporting in security compliance training.

Who has to be trained?

Everyone who can reach the systems or the money: employees, contractors, temporary staff, and anyone who reads the shared mailbox or approves a payment. HIPAA covers all workforce members, PCI DSS covers all personnel, and the NIST SP 800-171 training controls follow whoever uses the systems in scope.

How often?

On the first day, before access is granted; at least once every 12 months; and again after an incident or a change of role. HIPAA asks for periodic reminders instead of a fixed interval, so write down the interval you choose and keep to it.

What does an auditor actually ask to see?

A dated completion log with names, topics and the last run date of each role drill; the signed acknowledgement each person returned; and the training content itself, if the regime names it. Under HIPAA the documentation is kept for six years, so the log is a long-term file rather than an annual tidy-up.