Security Awareness Training
What is Security Awareness Training?
Educational programmes designed to teach employees about security risks and best practices. Training covers topics such as phishing recognition, password hygiene, data handling, and incident reporting. Required by ISO 27001, HIPAA, PCI DSS, and NIST CSF.
Terms that appear alongside security awareness training
Each of these is named in at least one of the same controls as security awareness training. The number is how many controls name both.
- security awareness 25 shared controls
- phishing 5 shared controls
- governance 3 shared controls
- nist 3 shared controls
- policy 3 shared controls
- social engineering 3 shared controls
- information security 3 shared controls
- risk assessment 2 shared controls
Frameworks that govern security awareness training
What the standards actually require on security awareness training
Requirements naming security awareness training across 6 standards, quoted from the control text.
Personnel must be trained in security awareness when hired, then again at least every 12 months; also, the program must use more than one way of communicating;
12.6.3 · 12.6.3 Security awareness training on hire and annually with acknowledgment →A cyber security awareness training register is developed, implemented and maintained.
ISM-2022 · Cyber security awareness training register →Agencies must build information security awareness training into the induction programmes for new employees.
new-zealand-information-security-manual-nzism::9.1.5.C.02 · 9.1.5.C.02 Security awareness training included in staff induction →Run an approved, documented and evaluated security awareness programme for every employee, with training refreshed on a regular basis.
cloud-security-alliance-cloud-controls-matrix-ccm-v4-1::HRS-11 · Security Awareness Training →Requirement 0024 (Part One: Governance, section 3.5 Security Planning, Incidents and Training; applies to All entities; dated 31 October 2024;
protective-security-policy-framework-pspf-release-2026::0024 · 0024 Security awareness training at engagement and annually →Training. Software security awareness training is conducted so developers and stakeholders understand secure development expectations.
T1.1 · Conduct software security awareness training →Questions people ask about security awareness training
What is Security Awareness Training?
Why is Security Awareness Training important for compliance?
Which compliance frameworks address Security Awareness Training?
Where can I learn more about Security Awareness Training?
See how Security Awareness Training applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.