Training Compliance Checklist

All employees receive annual security awareness training that covers phishing, social engineering, and safe browsing.

Training completion is tracked for every employee with dates and course details recorded.

Simulated phishing tests are conducted at least quarterly to reinforce awareness.

Employees who fail phishing simulations receive additional targeted training.

Remote workers receive specific training on home office security, VPN use, and physical safeguards.

Password and MFA best practices are included in the annual training curriculum.

All workforce members with access to PHI receive HIPAA privacy and security training.

HIPAA training is provided within a reasonable period after hiring and when material changes occur.

Workforce members sign acknowledgment of HIPAA training and policies.

A sanctions policy exists and is enforced for workforce members who violate HIPAA.

Breach notification procedures are included in training so staff know how to report suspected breaches.

All personnel with access to the cardholder data environment receive security awareness training.

Personnel are trained on cardholder data handling, terminal security, and social engineering defenses.

Training is reviewed and updated at least annually to reflect current threats and procedures.

Security policies are acknowledged by employees upon hire and annually thereafter.

Employees are trained on information security risks relevant to their role and responsibilities.

Training is updated to reflect changes to the information security program.

Personnel handling customer financial information understand data minimization and access controls.

Incident response procedures are communicated to staff, including how to report suspected incidents.

A formal training policy exists and is approved by management.

Completion records include employee name, course title, completion date, and certificate details.

Training records are retained for the required retention period (typically 6 years for HIPAA, 3+ for PCI DSS).

Certificates of completion can be produced quickly when auditors, insurers, or regulators request them.

Certificates include a unique ID and a publicly verifiable link for third-party validation.

New employees complete security and compliance training within 30 days of hire.

New hires do not access sensitive systems until required training is completed.

Onboarding training is role-specific, IT staff get different training than general staff.

Contractors and temporary workers receive the same training as employees with equivalent access.

Annual refresher training is scheduled automatically and tracked to completion.

Employees who fail to complete training by the deadline receive escalating reminders.

Training content is reviewed and updated at least annually to stay current with threats and regulations.

Completion dates are tracked individually so renewal cycles are based on each learner's completion date.

Executive leadership acknowledges their role in information security governance.

Managers are trained on how to monitor team training completion and enforce deadlines.

Board or senior management reviews training metrics and compliance status at least annually.