19 Security Frameworks Requiring Security Awareness Training (2026)

Many regulatory frameworks explicitly require organizations to implement security awareness training as part of their compliance obligations. Failure to comply with these training requirements can result in hefty financial penalties, fines, and legal repercussions.

Under GDPR, even less severe infringements could result in a fine of up to €10 million, or 2% of the firm’s worldwide annual revenue, depending on which number is larger.

Beyond those regulatory fines, the breach itself is usually the bigger cost. According to IBM’s Cost of a Data Breach Report 2025, the average data breach now costs $4.88M. That is why the standards below treat security awareness training as a required control rather than an optional checkbox.

This guide identifies the most common standards, regulations, and frameworks that require security awareness training. Note that we do not consider this list fully comprehensive, as new standards are constantly being developed, many of them specific to certain countries or industries.

‍

Why is security awareness training required by compliance frameworks?

Security awareness training sits at the center of nearly every major compliance framework. It protects sensitive data, meets regulatory requirements, and addresses the one vulnerability no framework can engineer around: the human factor.

The human factor in cybersecurity

The human factor is behind 62% of breaches, according to Verizon’s 2026 Data Breach Investigations Report.

Regardless of how advanced your technical filters are, employees can still make mistakes. No filter catches everything: employees still click phishing links, mishandle sensitive data, or skip a security protocol.

Incident response and preparedness

Security awareness training, done right, turns employees into a fast, confident first line of defense, because they learn how to quickly report suspicious activity and follow incident response protocols, which hugely limits the damage a breach can cause.

And that “quickly” is key here: Hoxhunt’s own data shows two-thirds of trained employees report a real threat within a year, and the fastest 5% do it in just 39 seconds (Hoxhunt Phishing Trends Report 2026).

The faster your employees can spot and contain cyber incidents, the less damage they’ll cause.

Protecting sensitive data

Compliance frameworks exist to protect sensitive information: personal details, financial records, and medical history.

Security awareness training goes deeper, as it teaches employees how to handle information properly, which cuts the risk of unauthorized access or a breach.

Keeping up with the latest threats

Cybersecurity threats landscape is constantly evolving, with new attack tactics emerging regularly.

Proper security awareness training must keep employees informed about the latest tactics, so their knowledge doesn’t go stale the moment a new threat appears.

That’s why compliance frameworks require continuous training: a one-time course isn’t enough, but regular, ongoing education is how you stay ahead of potential risks.

‍

Which compliance frameworks require security awareness training?

Framework	Scope	Requires training?	What it is
ISO 27001	Global	Yes	International standard for an Information Security Management System (ISMS)
CIS Controls	Global	Yes	18 prioritized best-practice controls for cybersecurity, from the US-based Center for Internet Security
NIST Cybersecurity Framework	Global	Yes	Common-language framework built around 5 core functions: Identify, Protect, Detect, Respond, Recover
NIS 2 Directive	EU	Partial	EU directive strengthening cybersecurity resilience across critical sectors; training is mandatory for management bodies, encouraged for staff
PCI DSS	Global	Yes	Security standard for any organization that processes, stores, or transmits credit card data
GDPR	EU	Partial	EU law governing personal data protection; training is an explicit duty of the Data Protection Officer
NIST SP 800-53	US (federal)	Yes	Security and privacy controls for U.S. federal information systems
Gramm-Leach-Bliley Act (GLBA)	US (finance)	Partial	U.S. law protecting consumer financial data; training isn’t named but is required via its Safeguards Rule
FTC Safeguards Rule	US (finance)	Yes	GLBA rule requiring a comprehensive information security program
NERC CIP	North America	Yes	Standards securing North America’s bulk electric system
HIPAA	US (healthcare)	Yes	U.S. law protecting sensitive patient health information
COBIT	Global	Partial	ISACA’s IT governance framework; training isn’t named but is implied via its PO7 objective
Australian Government ISM	Australia	Yes	Framework securing Australian government information and systems
PAS 555	UK	Partial	British standard for cybersecurity risk governance; describes outcomes rather than mandating specific actions
DORA	EU (finance)	Yes	EU regulation strengthening the financial sector’s digital operational resilience
EBA Guidelines	EU (banking)	Partial	European Banking Authority guidance on ICT and security risk; expected, not strictly mandated
SWIFT CSP Requirements	Global	Yes	Mandatory controls protecting SWIFT-related infrastructure
EIOPA Guidelines	EU (insurance)	Partial	EU guidance on governance and risk management for insurers and pension funds; expected, not strictly mandated
SCORM	Global	No	A technical e-learning standard, not a compliance framework

1. ISO 27001 

What is the ISO 27001 regulation? 

ISO 27001 is an international standard that outlines best practices for an Information Security Management System (ISMS).

Developed and published by the International Organization for Standardization (ISO), it is a controls-based framework that helps organizations manage and protect their information assets.

ISO 27001 is part of a larger series of documents known as ISO 27000. ISO 27001 certification is voluntary in most cases, but accessing the official standard document isn’t free.

Does the ISO 27001 regulation require security awareness training?

Yes. ISO 27001 requires that all personnel (meaning employees and third parties) take security awareness training as part of its broader focus on ensuring that all members of an organization not only understand guidelines on security policies and procedures but also adhere to them.

The standard explicitly states that employees shall receive regular training on security policies, including their roles in maintaining security, and the importance of compliance with these policies to protect the organization’s data and assets. This helps embed security standards and culture across the organization.

Where is this mentioned?

ISO 27001 Annex A 6.3:

“Personnel of the organization and relevant interested parties shall receive appropriate information security awareness, education and training and regular updates of the organization’s information security policy, topic-specific policies and procedures, as relevant for their job function.”

‍

2. CIS Controls 

What are the CIS Controls? 

The Center for Internet Security (CIS) Controls is a set of best practices for cybersecurity. CIS is based in the United States, though organizations worldwide use the Controls.

Originally known as the SANS Critical Security Controls, these guidelines are designed to help organizations defend against common cybersecurity threats.

The CIS Controls consist of 18 top-level controls and cover areas such as asset management, access control, and incident response. They’re ranked by priority to guide organizations in implementing the most effective security measures first, which helps them improve their cybersecurity posture systematically.

Do the CIS Controls require security awareness training?

Yes. The CIS Controls emphasize that employees must be aware of security risks and trained to recognize, report, and respond to potential threats.

Awareness training helps employees prevent mistakes that could lead to security breaches. Human errors are hard to avoid, but organizations that successfully build a security-aware culture significantly reduce their vulnerability to cybersecurity risks by turning humans into their first line of defense.

Where is this mentioned?

CIS 14.1

“Establish and maintain a security awareness program to influence behavior through awareness and skills training.”

‍

3. NIST Cybersecurity Framework 

What is the NIST Cybersecurity Framework? 

The NIST Cybersecurity Framework is a set of guidelines developed by the National Institute of Standards and Technology (NIST), a United States federal agency, created to help organizations manage and reduce cybersecurity risks.

It provides a common language and systematic approach built around five core functions, Identify, Protect, Detect, Respond, and Recover, designed to improve cybersecurity practices across many industries and organizations, regardless of size or sector.

Does the NIST Cybersecurity Framework require security awareness training?

Yes. The NIST Cybersecurity Framework includes security awareness training as a key element within its “Protect” function.

This requirement essentially states that organizations should educate all personnel about their cybersecurity responsibilities.

The goal is to cultivate a culture of security awareness, so that individuals are aware of potential threats and learn how to mitigate cybersecurity incidents.

Where is this mentioned?

NIST PR.AT-01 & PR.AT-02: Organizations must ensure that:

“All users are informed and trained. Users are made aware of the roles they play in protecting the organization’s information and the potential risk.”

‍

4. NIS 2 

What is the NIS 2 Directive?

The NIS 2 Directive (Network and Information Systems Directive 2) is a framework established by the European Union to enhance cybersecurity across member states.

It updates the original NIS Directive, expanding its scope to cover more sectors, such as energy, transport, health, and digital infrastructure.

The directive aims to make critical entities more resilient to cyberattacks by setting stricter security requirements, enhancing incident reporting protocols, and promoting cooperation between member states.

NIS 2 also introduces tougher enforcement measures and higher penalties for non-compliance.

Does the NIS 2 Directive require security awareness training?

Yes, for management bodies. The NIS 2 Directive requires members of an organization’s management body to receive cybersecurity training, and encourages organizations to extend similar training to their employees.

Regular training and awareness programs help staff recognize and reduce the risk of human errors that can lead to security incidents.

Where is this mentioned?

NIS 2 Article 20:

“Member States shall ensure that the members of the management bodies of essential and important entities are required to follow training, and shall encourage essential and important entities to offer similar training to their employees on a regular basis, in order that they gain sufficient knowledge and skills to enable them to identify risks and assess cybersecurity risk-management practices and their impact on the services provided by the entity.”

‍

5. PCI DSS 

What is the PCI DSS framework?

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure all companies that process, store, or transmit credit card information maintain a secure environment.

The framework, developed by the PCI Security Standards Council, aims to protect cardholder data from breaches and fraud. PCI DSS applies globally, not to any single country.

It includes requirements for security management, policies, procedures, network architecture, and software design, covering areas like encryption, access control, or regular monitoring and testing of networks.

Compliance with PCI DSS is mandatory for organizations handling credit card information.

Does the PCI DSS framework require security awareness training?

Yes. The PCI DSS framework requires security awareness training to ensure that all employees understand why protecting cardholder data matters and what they personally need to do to keep it secure.

Ongoing training helps prevent human errors, like mishandling sensitive data or falling for phishing attacks, and keeps employees informed about security policies and practices, which is crucial for maintaining compliance with PCI DSS requirements.

Where is this mentioned?

PCI DSS requirement 12.6: states that organizations must:

“Implement a formal security awareness program to make all personnel aware of the importance of cardholder data security.”

‍

6. GDPR

What is GDPR?

The General Data Protection Regulation (GDPR) is a comprehensive data protection law enacted by the European Union that governs how personal data of individuals within the EU is collected, processed, and stored.

Implemented in May 2018, GDPR aims to give individuals greater control over their personal data, by ensuring transparency, security, and accountability in data handling.

The regulation imposes strict requirements on organizations, such as obtaining explicit consent for data processing, allowing data access and deletion requests, and reporting data breaches within 72 hours.

Does GDPR require security awareness training?

Indirectly. GDPR doesn’t mandate training for all employees directly, but Article 39 lists it as one of the Data Protection Officer’s core tasks: to raise awareness and train staff involved in processing personal data.

Where is this mentioned?

GDPR Article 39: states that one of the tasks of a Data Protection Officer (DPO) is to:

“raise awareness and train staff involved in processing operations.”

‍

7. NIST SP 800-53 

What is NIST SP 800-53?

NIST Special Publication 800-53 (NIST SP 800-53) is a comprehensive set of guidelines developed by the National Institute of Standards and Technology (NIST) for U.S. federal information systems and organizations.

It provides a catalog of security and privacy controls designed to protect the confidentiality, integrity, and availability of information systems against various threats.

These controls help organizations comply with federal laws and regulations, including the Federal Information Security Management Act (FISMA), the U.S. law that governs cybersecurity for federal agencies.

Does NIST SP 800-53 require security awareness training?

Yes. NIST SP 800-53 requires security awareness training as part of its “Awareness and Training” (AT) control family.

This control family states the need to ensure that all personnel are aware of the security risks associated with their activities, and that they are equipped with the knowledge and skills to mitigate those risks.

Where is this mentioned?

NIST SP 800-53 AT-2:

“The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors) as part of initial training for new users, when required by information system changes, and periodically thereafter.”

‍

8. Gramm-Leach-Bliley Act 

What is the Gramm-Leach-Bliley Act?

The Gramm-Leach-Bliley Act (GLBA, also known as the Financial Services Modernization Act of 1999), is a U.S. federal law that requires financial institutions to protect the privacy of consumer financial information.

The act mandates that these institutions explain how they share information with customers. It also requires them to implement safeguards that protect sensitive data.

It includes three primary components:

• The Financial Privacy Rule, which regulates the collection and disclosure of private financial information.
• The Safeguards Rule, which requires institutions to implement security measures.
• The Pretexting provisions, which protect against fraudulent access to private information.

Does the Gramm-Leach-Bliley Act require security awareness training?

No, not explicitly. GLBA doesn’t name security awareness training directly. But it does require a comprehensive information security program under its Safeguards Rule, and that program typically includes training employees to protect customer data.

Its goal is for employees to understand the risks and their responsibilities in safeguarding sensitive financial information. The financial services industry already outperforms every other sector: it has the highest employee reporting rate (66.4%) and the lowest fail rate (2.04%), according to the Hoxhunt Phishing Trends Report 2026.

Where is this mentioned?

GLBA does not explicitly mandate security awareness training.

However, the Act requires financial institutions to implement a comprehensive information security program, which typically includes security training as part of broader compliance efforts.

‍

9. FTC Safeguards 

What is the FTC Safeguards Rule?

The FTC Safeguards Rule (issued by the Federal Trade Commission) is part of the Gramm-Leach-Bliley Act (GLBA) and requires U.S. financial institutions to develop, implement, and maintain a comprehensive information security program to protect consumer information.

This program must include administrative, technical, and physical safeguards to ensure the security, confidentiality, and integrity of customer data. The rule also mandates regular risk assessments, employee training, and oversight of third-party service providers, all aimed at maintaining appropriate security measures.

Does the FTC Safeguards Rule require security awareness training?

Yes. Section 314.4 of the Safeguards Rule requires covered financial institutions to develop, implement, and maintain an information security program. It must include administrative, technical, and physical safeguards that help protect customer information.

This rule has 9 elements, including but not limited to: “providing personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment.” 

Where is this mentioned?

FTC Safeguards 314.4 (e) (1):

“Implement policies and procedures to ensure that personnel are able to enact your information security program by providing your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment.”

‍

10. NERC CIP

What is NERC CIP?

North American Electric Reliability Corporation Critical Infrastructure Protection (NERC CIP) is a set of standards designed to secure the assets critical to operating North America’s bulk electric system.

These standards address various aspects such as safeguarding physical and cyber assets, ensuring personnel are trained, and preparing for incident response and recovery. The overarching goals are to secure the electric grid from potential cyber threats and to ensure its reliability.

Does NERC CIP require security awareness training?

Yes. NERC CIP requires security awareness training to ensure that all personnel involved in the protection and operation of critical electric infrastructure are well-informed about security risks and protocols.

Security awareness training ensures employees can safeguard physical and cyber assets, prevent unauthorized access, and respond effectively to security threats.

Where is this mentioned?

NERC CIP-004-5.1 Table R1: Requires:

“security awareness that, at least once each calendar quarter, reinforces cybersecurity practices.”

‍

11. HIPAA

What is HIPAA?

Health Insurance Portability and Accountability Act (HIPAA) is a U.S. law enacted in 1996 to protect sensitive health information.

It establishes national standards for the security and privacy of health data, requiring healthcare providers, insurance companies and their business associates to safeguard medical information. HIPAA also grants patients the right to access their records and request corrections to them.

Non-compliance with HIPAA can result in significant fines and penalties.

Does HIPAA require security awareness training?

Yes. Under the HIPAA Security Rule, covered entities and their business associates must implement a security awareness and training program for all members of their workforce.

Security awareness training ensures employees understand how to safeguard electronic protected health information (ePHI) from unauthorized access, breaches, and other security threats.

Where is this mentioned?

HIPAA § 164.308 (5) (i): Under the Act, an organization must:

“Implement a security awareness and training program for all members of its workforce (including management).”

‍

12. COBIT

What is COBIT?

Control Objectives for Information and Related Technologies (COBIT) is a framework for IT management and governance, developed by ISACA (Information Systems Audit and Control Association). 

It provides organizations with a set of best practices, tools, and guidance to help them align IT with business goals, manage risk effectively, and meet regulatory compliance requirements.

COBIT focuses on managing and optimizing IT processes, improving information security, and ensuring that IT investments deliver value to the organization.

Does COBIT require security awareness training?

Not directly. COBIT doesn’t name security awareness training specifically, but its PO7 objective requires organizations to ensure personnel have the skills and competencies to perform their roles. This includes building and maintaining security awareness, and helping employees understand and adhere to information security policies and procedures. 

Well-informed employees are less likely to make costly security mistakes, which reduces risks associated with human error.

Where is this mentioned?

COBIT PO7:

“Ensure that personnel possess the skills and competencies necessary to perform their roles”

And organizations must be:

“establishing and maintaining a framework for competency development.”

‍

13. Australian Government InfoSec Manual 

What is ISM?

Australian Government InfoSec Manual (ISM) is a framework designed to assist government agencies in protecting their information and systems from cyber threats. It provides guidelines and controls for securing data, ensuring system integrity, and maintaining confidentiality.

The ISM covers a wide range of topics, including access control, risk management, and incident response, and is regularly updated to address emerging threats and technologies.

Does the ISM require security awareness training?

Yes. The ISM mandates security awareness training to ensure that all employees are knowledgeable about their responsibilities in protecting sensitive information and systems.

Training is essential for reducing human error and for ensuring that staff are aligned with the ISM’s security requirements.

Where is this mentioned?

ISM-02522; Revision: 7:

“Agencies must ensure that all users are provided with appropriate information security training and education to enable them to fulfill their information security responsibilities.”

‍

14. PAS 555 Cyber Security Risk: Government and Management 

What is PAS 555?

PAS 555, short for Publicly Available Specification, is a British standard that provides a framework for managing and governing cybersecurity risks within an organization. It emphasizes a comprehensive, outcomes-focused approach to cybersecurity. The approach integrates risk management with business processes.

PAS 555 is designed to help organizations understand their cyber risk exposure, establish effective governance, and implement strong security controls. It covers areas such as leadership responsibilities, risk assessment, incident management, and continuous improvement.

Does PAS 555 require security awareness training?

Not exactly. PAS 555 doesn’t specify exact actions, but it describes what effective cybersecurity looks like, including a workforce that’s aware of cyber risks and understands its role in managing them.

Organizations that integrate security awareness into daily operations strengthen their overall cybersecurity posture.

Where is this mentioned?

PAS 555 doesn’t actually specify actions. Instead, it defines what effective cyber security looks like.

It advocates for organizations to ensure that all personnel are informed about cybersecurity risks and understand their roles in managing these risks.

‍

15. Digital Operational Resilience Act (DORA) 

What is DORA?

The Digital Operational Resilience Act (DORA) is a European Union regulation that strengthens the financial sector’s resilience to digital disruptions. It aims to ensure that financial entities, such as banks, insurers, and investment firms, can withstand, respond to, and recover from all types of information and communications technology (ICT) disruptions and threats.

DORA establishes requirements for ICT risk management, incident reporting, and third-party risk management. It strengthens the financial sector’s resilience against increasing cyber threats and digital dependencies.

Does DORA require security awareness training?

Yes. Security awareness training is needed to stay compliant with DORA. It ensures that employees in the financial sector can effectively recognize, respond to, and manage ICT-related risks and threats.

Where is this mentioned?

DORA Article 13 (6):

“Financial entities shall develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. Those programmes and training shall be applicable to all employees and to senior management staff, and shall have a level of complexity commensurate to the remit of their functions.”

‍

16. EBA Guidelines on ICT and security risk management 

What are the EBA Guidelines?

The EBA Guidelines on ICT and security risk management, issued by the European Banking Authority (EBA), provide guidance for financial institutions on how to manage and mitigate risks associated with ICT and security.

These guidelines set out requirements for risk management frameworks, incident reporting, business continuity, and governance. It aims to ensure that institutions can effectively withstand, respond to, and recover from ICT disruptions and cyber threats.

Do the EBA Guidelines require security awareness training?

It’s expected, not strictly mandated. The EBA Guidelines say institutions should establish a training program, including periodic security awareness sessions, for all staff and contractors.

Where is this mentioned?

EBA 3.4.7 (49):

“Financial institutions should establish a training programme, including periodic security awareness programmes, for all staff and contractors to ensure that they are trained to perform their duties and responsibilities consistent with the relevant security policies and procedures to reduce human error, theft, fraud, misuse or loss and how to address information security related risks.”

‍

17. SWIFT Customer Security Program Requirements 

What are the CSP Requirements?

The SWIFT CSP Requirements are a set of mandatory security controls that help financial institutions around the world protect their SWIFT-related infrastructure against cyber threats. SWIFT stands for Society for Worldwide Interbank Financial Telecommunication, and CSP for Customer Security Program.

The program focuses on three areas: environment security, access management, and incident detection and response.

Complying with the CSP Requirements keeps the global financial messaging network secure and makes institutions more resilient against cyber attacks.

Does SWIFT require security awareness training?

Yes. Security awareness training is required as part of the controls to ensure that all personnel involved in managing SWIFT-related infrastructure understand their role in safeguarding the system and are aware of potential threats.

Implementing training will prevent human errors that could compromise the security of financial transactions. It also helps ensure employees can recognize and report suspicious activity, which strengthens the SWIFT network’s overall security.

Where is this mentioned?

SWIFT 7.2: The guidelines require that:

“Annual security awareness sessions are conducted for all staff members with access to Swift-related systems. All staff with privileged access maintain knowledge through specific training or learning activities when relevant or appropriate (at management’s discretion).”

‍

18. EIOPA Guidelines 

What are the EIOPA Guidelines?

The EIOPA Guidelines are a set of recommendations from the European Insurance and Occupational Pensions Authority (EIOPA). They promote sound governance and risk management across insurance and pensions sectors in the EU.

These guidelines cover areas such as system governance, outsourcing, product oversight, and cybersecurity. They help institutions comply with EU regulations, maintain financial stability, protect consumers, and improve transparency.

Do the EIOPA Guidelines require security awareness training?

It’s expected, not strictly mandated. The EIOPA Guidelines recommend that undertakings establish periodic security awareness programs to educate their staff.

Where is this mentioned?

EIOPA 13 (41):

“Undertakings should establish and implement periodic security awareness programmes to educate their staff, including the AMSB, on how to address information security related risks.”

‍

19. SCORM

The Sharable Content Object Reference Model (SCORM) is a set of technical standards for e-learning software products. It standardizes how online learning content and Learning Management Systems (LMS) communicate, so they remain compatible.

SCORM makes learning content reusable and easy to share across systems. It tracks learner progress and performance, and it supports the sequencing of learning activities. These capabilities make SCORM a widely used standard in online education and training programs.

Does SCORM require security awareness training?

No. SCORM is a technical standard for e-learning, not a regulatory or compliance framework, so it doesn’t inherently require security awareness training.

However, if SCORM-compliant e-learning courses are used to deliver security awareness training within an organization, then the content and structure of the training would have to adhere to SCORM standards and be compatible across various Learning Management Systems.

Following SCORM standards makes it easier to track employee progress in mandatory security awareness training programs.

‍

How to maintain security awareness training compliance?

Maintaining compliance across multiple frameworks is an ongoing process, not a one-time checklist. The recommendations below will help your organization stay aligned as regulations and training requirements evolve.

Understand the requirements

Thoroughly review what is actually included in each framework

Conduct a detailed analysis of each compliance framework and its regulatory requirements to identify the specific training requirements related to security awareness.

Consult experts if needed

If in doubt, you can always reach out to legal or compliance experts to clarify any ambiguities and ensure that your interpretation of the requirements is accurate.

Develop a comprehensive training program

Tailor content to your specific needs

Make sure your training addresses the specific security risks and regulatory requirements outlined in each framework.

Your training will most likely need to cover core topics like data protection, phishing prevention, incident response, and privacy regulations.

Use interactive modules

Incorporate interactive elements such as quizzes, simulations, and case studies to engage employees and reinforce learning outcomes.

These interactive elements keep the training engaging so it doesn’t feel like a box-ticking exercise.

Use SCORM-compliant content

Standardize your training content

Implement SCORM-compliant e-learning content to facilitate compatibility with various Learning Management Systems (LMS).

This standardization allows for consistent delivery, tracking, and reporting of training across different platforms.

Use customizable modules

In order to keep the training relevant and effective, opt for SCORM content that can be easily updated and customized to reflect changes in compliance requirements or organizational policies.

Regularly update your training

Stay on top of regulatory changes

Your training content will need to be aligned with any updates to key requirements, so make sure you stay informed about updates to relevant compliance frameworks by subscribing to industry news, participating in webinars, and consulting with regulatory bodies.

Keep content up-to-date with the latest threats

Security threats are always evolving, so your training should be updated continuously to cover new and emerging risks. Regularly review and refresh training content to address new threats.

Make sure you have the necessary documentation and tracking in place

Don’t forget about record-keeping

Keep detailed records of who has completed training, when it was completed, and what content was covered.

This documentation is crucial for demonstrating compliance during audits.

Set automated reminders

Set up automated reminders and notifications to ensure that employees complete their training on time.

‍

Stay compliant with Hoxhunt

Want to easily manage and customize your security awareness training based on your company policies?

Hoxhunt was specifically designed to meet your security awareness and compliance needs with modern and engaging training.

• Boost security knowledge: Make training relevant by educating employees based on their role and location. Automatically trigger mandatory training for new joiners.
• Cover every training need: Meet your compliance and awareness requirements with an always up-to-date training library. When unique needs arise, use our powerful generative AI to create content tailored to you.
• Achieve compliance easily: Our training library contains ready-made and easily customizable training content packages to meet regulatory requirements.

‍

‍

Go beyond compliance and measurably change behavior

Effective security awareness programs do more than tick a compliance box.

Building a true security-first culture, one where employees are genuinely committed, not just compliant, means engaging, educating, and rewarding each individual.

And that’s exactly what Hoxhunt is built for. It automatically adapts training content to each employee’s role, department, and location, which keeps you compliant while making sure your message actually lands.

1. Embed your training into your employees’ workflowAutomatically train your employees during their workday with micro-training moments delivered in their workflow.
2. Reach employees across multiple channelsEnhance your security awareness with intuitive training that integrates directly into employees’ daily tools. Activate Hoxhunt with a single click on platforms like Microsoft Office, Google Workspace, Slack, and Microsoft Teams.
3. Increase your training engagementCreate a self-reinforcing training experience with reward-based incentives that motivate employee participation.
4. Track your progress with powerful dashboardsGain real-time visibility into your program performance with modern dashboards and next-level metrics. Set your priorities with data-driven decisions, and report to leadership with ease and confidence.

‍

Compliance frameworks for security awareness training FAQ

_Sources

^{GDPR Fines · GDPR.eu, 2024
Cost of a Data Breach Report · IBM, 2025
Data Breach Investigations Report (DBIR) · Verizon, 2026
ISO/IEC 27001 Standard · ISO, 2022
CIS Controls · CISecurity, 2023
NIST Cybersecurity Framework · NIST, 2023
NIS2 Directive · Digital Strategy, European Commission, 2023
PCI Security Standards · PCI Security Standards Council, 2023
GDPR Info · GDPR-Info, 2024
NIST SP 800-53 Revision 5 · NIST, 2023
Gramm-Leach-Bliley Act · FTC, 2023
FTC Safeguards Rule · FTC, 2023
NERC CIP Overview · TechTarget, 2023
HIPAA Overview · HHS, 2024
COBIT Framework · ISACA, 2023
Australian Cyber Security Centre’s ISM · ACSC, 2023
‍PAS 555 Cybersecurity Governance · EN Standard, 2013
Digital Operational Resilience Act (DORA) · EIOPA, 2023
Guidelines on ICT and Security Risk Management · EBA, 2023
SWIFT Customer Security Program · SWIFT, 2023
EIOPA Guidelines on ICT Security and Governance · EIOPA, 2023
SCORM Overview · SCORM.com, 2023}