Training you can prove to an auditor.
Most security frameworks expect staff awareness training and a record that it happened. The Academy keeps that record for you.
Frameworks that ask for awareness training
| FRAMEWORK | REFERENCE | WHAT IT ASKS FOR |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 6.3 | Information security awareness, education and training |
| SOC 2 | CC1.4 and CC2.2 | Commitment to competence and internal communication of responsibilities |
| NIS2 Directive | Article 21(2)(g) | Basic cyber hygiene practices and cybersecurity training |
| PCI DSS v4.0 | Requirement 12.6 | A formal security awareness programme for all personnel |
| HIPAA Security Rule | 45 CFR 164.308(a)(5) | Security awareness and training for the workforce |
| GDPR | Article 39(1)(b) | Awareness-raising and training of staff involved in processing |
Training supports these requirements but does not on its own make an organisation compliant or certified. Your auditor decides what evidence they accept.
What you can hand to your auditor
Completion records
Who finished which module, and when, exported as a CSV or PDF.
Scores and trends
Average results by module and team, month over month.
Phishing simulation results
Click and report rates for each campaign, with no staff shaming.
Policy acknowledgement
Optional sign-off that each person has read your security policy.
Audit-ready pack
One download that summarises the programme for your auditor.
Keep it with the rest of your evidence
Optimus GRC can hold your training records beside policies, risks and controls, so audits start from one place.
See the platform →Not sure what you need yet?
Run a free readiness check for the framework you are working towards, and see where training fits.
Free framework checks →Need training evidence for your next audit?
Tell us about your company. Our team will set up a demo and a trial for your staff.