Security awareness training: what auditors expect

What training should cover

Frameworks do not prescribe a curriculum, but auditors expect coverage of phishing and social engineering, password and credential hygiene, acceptable use of company systems, data classification and handling, incident reporting (how to report something suspicious), and any role-specific topics such as secure coding for developers or HIPAA handling for clinical staff.

Evidence auditors sample

An auditor will sample completion records across the organisation and check for gaps. They look for training at onboarding, annual refreshers, evidence that the training is current (not the same video from three years ago), and records showing what happens when someone does not complete it.

• Completion records with name, date and topic
• Onboarding training within the first week or month
• Annual refresher with updated content
• Phishing simulation results (if used)
• Follow-up for staff who do not complete training

Tracking training in your programme

In Certifyi, security awareness training is a control with evidence attached: completion exports from your training platform, phishing simulation reports and policy acknowledgements. The control maps to every framework that requires it.

• Compliance software: training evidence beside your other controls.
• Policy acknowledgement: confirming staff read the policy.
• Personnel security: the broader set of people controls.

Related terms

Personnel security

Controls covering people: screening where the law allows it, onboarding and offboarding, training, acceptable-use acknowledgement, and removing access when someone leaves.

Policy acknowledgement

A recorded confirmation that a person has read and accepted a policy. Auditors sample acknowledgements to check that policies are communicated, not just written.

Control

A specific safeguard or activity that reduces a risk, such as requiring MFA on privileged accounts or reviewing access every quarter. Frameworks are, in large part, lists of controls.