Compliance mapping for security awareness training

Compliance mapping links each training activity to the specific framework requirement it satisfies, such as SOC 2 CC1.4, ISO 27001 A.6.3 or NIS2 Article 21(2)(g). It turns “we run awareness training” into evidence an auditor can trace control by control.

This page maps RansomLeak courses and exercises to 13 regulatory frameworks and to the OWASP, CWE, MITRE ATT&CK and CIS identifiers security teams work from. Every completion is then exported with its framework tags as audit evidence.

RansomLeak training maps to thirteen major frameworks: SOC 2, ISO 27001, ISO 27701, NIST CSF 2.0, GDPR, the EU AI Act, CCPA / CPRA, HIPAA, HITRUST CSF, PCI DSS, NIS2, DORA, and CMMC Level 1. Each framework has specific requirement areas linked to relevant courses and exercises.

Eight security taxonomies sit alongside them: the OWASP Top 10 lists for web, API, LLM, agentic and MCP applications, plus MITRE CWE, MITRE ATT&CK and the CIS Critical Security Controls.

This page is the cross-reference matrix for scope comparison. For framework deep dives (audit failure modes, named enforcement actions, control-by-control coverage), see the compliance framework guides.

Yes. Every exercise carries the OWASP, CWE, MITRE ATT&CK, CIS, NIST CSF, GDPR and EU AI Act identifiers it maps to. Those identifiers show on the exercise card in the catalogue as well as in the coverage tables on this page.

The tables are generated from the same data the catalogue uses, so they track content releases instead of being maintained by hand. You can also filter the library by identifier, for example CWE-89 or T1566.

Yes. The platform exports compliance reports in PDF, CSV, and Excel formats that document training completion by employee, department, and framework requirement. Reports include timestamps, scores, and evidence of participation.

Auditors can verify that specific controls have been addressed through structured training records without manual data collection.

Most frameworks require at least annual training, but best practice is quarterly or monthly updates. SOC 2 and ISO 27001 auditors expect to see ongoing awareness activities, not just a single annual session.

RansomLeak ships new content monthly, so you can assign fresh exercises on a regular cadence without repeating the same material.

Yes. Every exercise exports as a SCORM 1.2 or SCORM 2004 package that runs inside your existing LMS. Completion data, scores, and time spent flow directly into your LMS reporting system.

Visit our SCORM integration page for details on supported platforms and deployment steps.

Yes. Our content team builds custom exercises tailored to your regulatory environment. Healthcare organizations can get HIPAA-specific scenarios. Financial institutions can focus on PCI DSS and DORA requirements.

Custom content follows the same interactive 3D format and integrates with the standard compliance reporting tools.

RansomLeak generates detailed training records that include employee name, department, exercise completed, date, time spent, score, and the specific compliance control addressed. These records are exportable and retention policies keep historical data available for multi-year audits.

For organizations using SCORM, the LMS maintains its own independent audit trail alongside RansomLeak records.