Map Security Training to Every Framework

The framework library is sequenced by the empirical buyer record, not by alphabetical order. SOC 2 leads because it is the dominant trust-attestation in the SaaS buying motion. ISO 27001 follows because it is the international ISMS standard certified to in 70+ countries and is contractually demanded by enterprise customers. HIPAA, PCI DSS, and GDPR sit beside each other because they are the three regulator-enforced regimes that already produce named penalties year over year, with documented training-failure findings.

NIS2 and the EU AI Act are newer but legally binding for in-scope entities across the European Union. NIS2 entered force October 2024 with personal liability for management bodies under Article 20 and a mandatory cyber-hygiene-and-training control under Article 21(2)(g). The EU AI Act AI literacy requirement under Article 4 took effect February 2025, applies to providers and deployers regardless of risk tier, and carries the regulation’s general penalty regime. We surface both because the controls are written, the deadlines are real, and most enterprises do not yet have a documented training program tied to either.

Each pillar follows the same structure: definition and scope, framework-specific training requirements with control references (e.g. SOC 2 CC1.4, HIPAA §164.308(a)(5), PCI DSS 12.6.3, NIS2 Art. 21(2)(g), EU AI Act Art. 4), audit failure modes drawn from named enforcement actions, the eight defensive controls that satisfy the framework, the role-based exercise sequence from the 100+ exercise catalogue that drills the human side, and a primary-source citation list. Auditors can cite the same primary sources the page does.