New Hire Security Awareness Training
Give every new employee the annual Cybersecurity Awareness course before they get access to systems, email or client data. It is self-paced and takes about an hour, includes a knowledge check, and issues a named certificate of completion with a unique ID that anyone can verify at simpletrainingcenter.com/verify. Onboarding training is not a separate orientation video, it is the same annual course your team already takes, and completing it starts that employee's own annual renewal clock.
What a new hire receives
- An assigned course with a due date, visible in their own dashboard
- About an hour of self-paced lessons, with progress saved between sittings
- A knowledge check at the end of the course
- A named certificate with a unique ID and public verification link
- Their own 12-month renewal date, tracked from completion
Your first 30 days
What to assign in the first 30 days
Everyone starts with the baseline course. The rest depend on the role. If a new hire only takes one course in their first month, make it Cybersecurity Awareness.
Course
Who needs it
Why assign it in the first 30 days
Who needs it
Every employee, on or before day one
Why
The annual baseline. Covers phishing, social engineering, passwords and MFA, ransomware, safe browsing, data privacy, remote-work risk and incident reporting.
Who needs it
Anyone who handles email, payments or client contact
Why
Goes deeper on the attacks that reach a new hire's inbox in their first weeks: impersonation, invoice and payment requests, urgency pressure and malicious links.
Who needs it
Everyone with an account, especially new administrators
Why
Sets the account habits you want from day one: strong passphrases, password managers, multi-factor authentication and how to respond when an MFA prompt looks wrong.
Who needs it
Remote and hybrid staff
Why
Covers working away from the office: home Wi-Fi, shared spaces, device handling and the practical steps that keep client data out of view and off unmanaged devices.
Who needs it
Everyone, with emphasis on managers
Why
New hires need to know how to raise a problem quickly. Explains what counts as an incident, who to tell, and what to do in the first few minutes.
Who needs it
Roles that touch personal, health, card or client data
Why
Explains how to handle sensitive information correctly, from collecting and storing it to sharing and disposing of it, including what never belongs in an email.
Each course is a separate seat and a separate certificate. If you would rather cover the whole catalog for one person, the all-access plan does that. See pricing and plans for how seats and all-access compare.
Hire date, not just anniversary
Why onboarding training matters, not just annual training
A yearly refresher only covers the people who were already on staff when it ran. New employees, the ones least familiar with your systems and most likely to receive a convincing first-week phishing email, sit outside that cycle unless training is tied to the hire date.
Frameworks expect exactly that: training at hire as well as on a recurring schedule. A program covering several frameworks can support more than one obligation at once, because the same course and the same records answer each of them.
Compare all framework requirementsPCI DSS v4.0, Requirement 12.6
Requires security awareness training upon hire and at least every 12 months, with the content reviewed at least annually.
PCI DSS training requirementsHIPAA Security Rule, 45 CFR 164.308(a)(5)
Requires a security awareness and training program for all workforce members, including management, covering protection from malicious software, log-in monitoring and password management.
HIPAA training requirementsSOC 2 Trust Services Criteria, CC1 and CC2
Expect personnel to understand their security responsibilities, with documented evidence that the training happened and who completed it.
SOC 2 training requirementsNYDFS Part 500
Requires a cybersecurity training program for all personnel, refreshed on a regular schedule, as part of the covered entity's overall security program.
NYDFS Part 500 training requirementsCMMC, through NIST SP 800-171
Requires awareness and training so personnel can carry out their assigned security responsibilities, which is assessed as part of CMMC maturity.
CMMC training requirementsISO/IEC 27001, Annex A 6.3
Requires awareness, education and training appropriate to the person's role, with records kept as evidence the program is running.
ISO 27001 training requirements
Practical sequence
First-week onboarding checklist
Six steps, done in this order, keep onboarding training from turning into an open item nobody closes.
- 1
Assign the course before or on day one
Add the new employee to Cybersecurity Awareness before they receive access to email, systems or client files. The course link reaches them the moment the seat is assigned.
- 2
Tell them what is due and by when
One sentence is enough: which course, roughly an hour, finished by a specific date. A stated deadline is the difference between training that happens in week one and training that is still open in month three.
- 3
Confirm completion in the dashboard
The manager view shows who has finished, who is in progress and who is overdue, with completion percentages and course status for every learner.
- 4
Download the certificate and file it
Each certificate carries the learner's name, the course, the completion date and a unique ID. Save it to the employee's HR or compliance record while the record is still easy to find.
- 5
Set the annual renewal reminder
Because completion starts the learner's own 12-month clock, the next due date is already known. Reminders go out automatically before the certificate expires.
- 6
Add them to refresher communications
New hires should receive the same security updates and refresher notes as everyone else, so the first course is the start of a habit rather than a single event.
Documentation
Records that satisfy an audit or insurance questionnaire
An auditor or underwriter is rarely asking whether training felt useful. They are asking who was trained, on what, when, and whether the evidence can be checked independently. Those four questions are answered by the records below.
Open certificate verificationA named certificate for each learner
Showing the learner's name, the course, the completion date and a unique certificate ID, downloadable as a PDF.
A public verification page
Anyone holding the certificate can confirm it is genuine at /verify without contacting you first.
Completion reports exportable to CSV
Completion status, scores and dates for the whole team, ready to attach to a questionnaire response or an audit request.
Automatic reminders before certificates expire
Learners and administrators hear from the platform ahead of the renewal date, so training does not quietly lapse between audits.
Beyond the baseline
Roles that need more than the baseline
The baseline course covers everyone. These roles usually need a second course in their first month, because the risks they meet daily are more specific.
Executives and finance teams
Executive & Wire Fraud Prevention
Payment fraud, impersonation and approval pressure aimed at the people who can move money.
View courseMedical, dental and billing teams
HIPAA Privacy & Security
Protected health information handling for staff who see patient records, claims or billing details.
View courseNew York financial services and insurance
NYDFS Part 500
Training shaped around the Part 500 cybersecurity program requirements for covered entities.
View courseOrganizations using AI tools
AI Security & Responsible AI Use
What belongs in a prompt, what never does, and how to use AI tools without exposing client data.
View courseRemote and hybrid staff
Remote Work Security
Home networks, shared spaces and device handling for people working outside the office.
View course
FAQ
New hire training questions
Short answers to what HR teams and hiring managers ask most often when they set up onboarding training.
- How soon after hire should a new employee complete security awareness training?
- Within the first 30 days is the usual practice, and sooner is better. Where a framework sets the bar, it is explicit: PCI DSS v4.0 Requirement 12.6 expects training upon hire and at least every 12 months. Assigning the course before or on day one means the training is finished before a busy first month pushes it aside.
- Can a new hire start work before the training is finished?
- That is your policy to set. Completing the course before access to sensitive systems is the safer pattern, because it closes the window where someone with fresh credentials has not yet been taught what a phishing attempt or a data-handling mistake looks like. If the role cannot wait, assign the course on day one, give a written deadline, and check completion in the dashboard rather than relying on memory.
- Does onboarding training count toward the annual requirement?
- Yes. Onboarding training is not a throwaway orientation step, it is the annual course. Completing it starts that employee's own 12-month renewal clock, so their next due date is calculated from their completion date rather than from a company-wide anniversary.
- How long does the course take and what proof is issued?
- The Cybersecurity Awareness course is self-paced and takes about an hour, with progress saved so it can be completed across more than one sitting. It ends with a knowledge check, then issues a named certificate of completion showing the learner's name, the course, the completion date and a unique certificate ID that anyone can verify.
Put new hires through training before their first login
Plans start at $45 per seat per year and can be purchased online without a sales call. Review pricing to compare per-course seats with all-access, then get started to buy seats and assign them. If you would rather see the workflow first, the self-guided demo walks through adding a learner, assigning a course, tracking completion and pulling the certificate. This page is written for organizations onboarding staff. If you are training yourself instead, see who it is for, and browse the full course list in the training catalog.