Compliance training mapped to every framework
What 14 frameworks, from SOC 2 and ISO 27001 to NIS2, DORA, CMMC and the EU AI Act, require from security awareness training.
Pick a framework
- SOC 2 SOC 2 has no training rule of its own. Auditors read it into CC1.4 and CC2.2, then sample your completion records across the whole Type II window. Read the guide
- ISO 27001 ISO/IEC 27001:2022 splits awareness across Clause 7.2 competence, Clause 7.3 awareness and Annex A control 6.3, and a certification auditor checks all three. Read the guide
- HIPAA 45 CFR §164.308(a)(5) names security awareness and training as an Administrative Safeguard, with four implementation specifications that OCR asks about one by one. Read the guide
- GDPR GDPR never says “annual training”. It puts training inside the DPO's tasks in Article 39 and the security measures of Article 32, then makes you prove both under Article 5(2). Read the guide
- PCI DSS PCI DSS v4.0.1 breaks Requirement 12.6 into five testable parts, and two of them, phishing awareness and acceptable use, became mandatory on 31 March 2025. Read the guide
- NIS2 NIS2 makes training a board matter: Article 20 requires management bodies to be trained and holds them personally liable, and Article 21(2)(g) extends cyber hygiene training to everyone else. Read the guide
- EU AI Act Article 4 of the EU AI Act has applied since 2 February 2025. Since the Digital Omnibus it asks every provider and deployer to take measures that support their staff's AI literacy. Read the guide
- DORA DORA Article 13(6) makes ICT security awareness and digital operational resilience training compulsory for every employee of an EU financial entity, and Article 5(4) adds regular training for the management body. Read the guide
- NIST CSF NIST CSF 2.0 is voluntary, but its PR.AT category asks for awareness training for all personnel and for specialised roles, and buyers, insurers and agencies keep asking how you meet it. Read the guide
- ISO/IEC 42001 ISO/IEC 42001 is the certifiable standard for an AI management system. Clauses 7.2 and 7.3 ask you to prove that the people who build and run your AI know what they are doing. Read the guide
- CMMC CMMC Level 1 asks defense contractors to affirm, every year, that 15 basic safeguards protect Federal Contract Information. None of the 15 is a training requirement, yet most of them fail when people do the wrong thing. Read the guide
- HITRUST HITRUST CSF is a certifiable framework that folds HIPAA, NIST, ISO and dozens of other sources into one control set. Workforce training sits in its Education, Training and Awareness domain, and every assessment tier tests it. Read the guide
- CCPA CCPA training is a named rule, not a best practice. Regulation §7100 says anyone handling consumer privacy inquiries must know the requirements and how to route a request. Read the guide
- ISO 27701 ISO/IEC 27701:2025 is a privacy management system you can certify on its own. Clauses 7.2 and 7.3 ask you to prove that people who handle personal data know the privacy policy and are competent to follow it. Read the guide
How we sequence framework coverage
The framework library is sequenced by the empirical buyer record, not by alphabetical order. SOC 2 leads because it is the dominant trust-attestation in the SaaS buying motion. ISO 27001 follows because it is the international ISMS standard certified to in 70+ countries and is contractually demanded by enterprise customers. HIPAA, PCI DSS, and GDPR sit beside each other because they are the three regulator-enforced regimes that already produce named penalties year over year, with documented training-failure findings.
NIS2 and the EU AI Act are newer but legally binding for in-scope entities across the European Union. NIS2 entered force October 2024 with personal liability for management bodies under Article 20 and a mandatory cyber-hygiene-and-training control under Article 21(2)(g). The EU AI Act AI literacy requirement under Article 4 took effect February 2025, applies to providers and deployers regardless of risk tier, and carries the regulation’s general penalty regime. We surface both because the controls are written, the deadlines are real, and most enterprises do not yet have a documented training program tied to either.
Each pillar follows the same structure: definition and scope, framework-specific training requirements with control references (e.g. SOC 2 CC1.4, HIPAA §164.308(a)(5), PCI DSS 12.6.3, NIS2 Art. 21(2)(g), EU AI Act Art. 4), audit failure modes drawn from named enforcement actions, the eight defensive controls that satisfy the framework, the role-based exercise sequence from the 200+ exercise catalogue that drills the human side, and a primary-source citation list. Auditors can cite the same primary sources the page does.
Turn training into audit evidence
One program, mapped to every framework you report on, with exports your auditor accepts.