Compliance
Find out what you actually owe.
Auditors ask two things: what you trained, and whether you kept the record. Our training gives you both. The harder question is which requirement you carry in the first place. They aren't the same, and most organizations around here have never been told which one is theirs.
Work down the list.
| Standard | Who it reaches | What it asks for |
|---|---|---|
| PCI DSS 12.6.3.1 | Anyone taking card payments, where their assessment includes 12.6.3.1. A giving page hosted entirely by your payment provider usually falls under SAQ A, a questionnaire that doesn't carry this requirement at all. | Awareness training that covers phishing and social engineering. Required in assessments after March 31, 2025. Ask whoever processes your card payments, your acquirer, which questionnaire you are on before anyone sells you training to satisfy it, ourselves included. |
| HIPAA 164.308(a)(5) | Health plans, clearinghouses, providers who transmit health information electronically for covered transactions, and their business associates, the outside companies that handle health information for them. Holding health information about the people you serve doesn't by itself make you covered. Running a self-insured employee health plan can, and that is the way it usually reaches a church or a nonprofit. | A security awareness program for the whole workforce, management included. |
| CJIS Security Policy v6.1, AT-2 | Anyone who touches criminal justice information. It reaches contractors and vendors with access, not just staff. | Training before anyone touches criminal justice information, and annually after that. AT-2(3) is the one that matters here: it requires training to recognize and report social engineering. AT-4 says you keep the records three years. |
| Ohio Revised Code 9.64 | The Auditor of State began testing counties and cities on January 1, 2026, and everyone else, villages and townships included, on July 1, 2026. | Your legislative authority, usually the council, commissioners or trustees, has to adopt a cybersecurity program consistent with accepted best practice. That part is mandatory. The six components the statute lists, employee training among them, are named as things the program may include rather than six separate duties. Training provided by the state satisfies the training piece, which is worth knowing before you pay anyone, us included. Some parts are not optional: incidents go to Ohio Homeland Security within seven days and to the Auditor of State within thirty, and paying a ransom needs your legislative authority's approval. |
| Grants and insurance | Whatever your grant or policy says. Terms vary, so read the one you actually hold. | Usually written as annual security awareness training. What gets checked is generally the completion record, not a score. |
That's the list we run into most here, not every rule there is. Tax preparers, and car dealers that finance or lease, fall under the FTC Safeguards Rule, which requires training however small the business. A contract can add its own. Whichever you carry, the obligation is yours. No vendor holds it for you. And where one applies, what gets checked is the record. That record is the same whichever goal you trained toward.
TopThe standards check coverage and a record.
These standards check three things: that training covered social engineering, who got it, and when. Social engineering means tricking a person rather than a computer. One of them goes further and names behaviors. CJIS, the FBI's security policy for anyone who touches criminal justice information, asks for training on recognizing social engineering and on reporting it. But not one of them requires that your staff become accurate at telling real from fake, and not one measures them on it. So they leave you room on the goal, and a program built on stopping, calling and waiting sits inside it rather than against it.
One exception. Some insurance questionnaires ask specifically about phishing simulations, the fake scam emails some programs send to test staff, and we don't run them yet. If your renewal turns on click-rate numbers from those tests, tell us early. Renewal is the worst time to find that out.
Whether we deliver the training ourselves or alongside your IT provider, the record runs off your own roster, on whatever interval your requirement sets. Everyone on it shows as covered, due soon, overdue, or no recorded training. So someone with no training on record is a line on it, not a name missing from a sign-in sheet. You get it as a PDF and a spreadsheet. It's a record of training delivered, not a statement that you meet any standard.
TopNext
Start with a free consultation.
Thirty minutes with a security professional. No slides. Tell us what you have and we'll tell you what we'd do first, including when the answer is nothing.