Direct answer
To prove security awareness training, keep dated records showing who was trained, when, what topics were covered, and how completion was confirmed, retained for the period your regulation requires. HIPAA requires security documentation to be kept for six years. PCI DSS requires training at hire and at least annually. A verbal mention at a staff meeting with no record generally will not satisfy an auditor or a cyber insurance carrier.
Written by Joseph Boyd, MBA, Founder and Principal Advisor at Infosec Check
Published · Last reviewed
Scope: Documentation of cybersecurity awareness training under selected United States regulations · Jurisdiction: United States
General educational and informational content. Not legal, insurance, or coverage advice. Requirements depend on your facts, contracts, policy language, and applicable law.
Why proof matters more than the training itself
Regulators, auditors, and carriers evaluate what can be demonstrated, not what was intended. A program that exists only in memory is difficult to show to anyone else.
Cyber insurance applications often ask whether staff receive security awareness training, and the answer may be checked against records after a loss. See cyber insurance claim denials for how application answers can matter. For the training obligations themselves, by regulation, see cybersecurity awareness training requirements.
What a defensible training record includes
- Employee name and role
- Date of training and date of completion
- Topics covered (phishing, business email compromise, wire transfer verification, passwords, MFA, incident reporting)
- Delivery method (live class, recorded course, simulated phishing)
- Completion evidence (sign-in sheet, LMS report, signed acknowledgment, quiz score)
- Who conducted or approved the training
- Retention location and the person responsible for producing records on request
Documentation expectations by industry
| Industry | Regulation or Standard | Training Expectation | Documentation Point |
|---|---|---|---|
| Medical, dental, mental health | HIPAA Security Rule, 45 CFR 164.308(a)(5) (opens in a new tab) | Security awareness and training program for all workforce members | Security Rule documentation retained 6 years, 45 CFR 164.316(b)(2) (opens in a new tab) |
| Financial services, auto dealers, mortgage, tax preparers | FTC Safeguards Rule, 16 CFR 314.4(e) (opens in a new tab) | Security awareness training for personnel, updated to reflect risk assessment | Program elements documented in the written information security program; Qualified Individual reports to the board or senior officer |
| Accounting and tax preparation | IRS Publication 4557 (opens in a new tab) and Publication 5708 (WISP) (opens in a new tab) | Employee training expected as part of the Written Information Security Plan | Training described and tracked within the WISP |
| Legal services | ABA Model Rules 1.1 (Comment 8) and 1.6(c), as adopted by state bars (opens in a new tab) | Duty of technology competence and reasonable efforts to protect client information | No single federal format; dated training records support a reasonable efforts showing |
| Government contractors | NIST SP 800-171, Awareness and Training family (opens in a new tab) | Security awareness and role-based training for users | Assessors look for training records and evidence supporting each requirement |
| Retail and e-commerce | PCI DSS v4.0, Requirement 12.6 (opens in a new tab) | Formal awareness program, training at hire and at least annually, including phishing awareness | Personnel acknowledge the program at least annually; documentation reviewed by assessor |
| Insurance licensees | NAIC Insurance Data Security Model Law as adopted (example: Va. Code 38.2-623) (opens in a new tab) | Cybersecurity awareness training within the information security program | Documented as part of the written program |
This table identifies training provisions that exist in the text of each regulation. It does not determine whether a specific regulation applies to your organization, which depends on your industry, the states you operate in, and the type of data you handle. Confirm applicability with counsel or another appropriate adviser before relying on this page for a compliance decision.
Three checks to run this week
- Pull a list of every employee and confirm a dated training record exists for each one this year.
- Confirm the topics covered match the risks your regulation and your insurance application name.
- Confirm who stores the records and how quickly they can be produced on request.
Common mistakes
- Treating a staff meeting mention as training
- Training once at hire and never again
- Keeping records only inside a vendor platform you could lose access to
- Leaving out owners, partners, and contractors
- Answering yes on a cyber insurance application without evidence behind it
When to seek professional help
Outside help is most useful when the stakes or the uncertainty are high:
- Before a cyber insurance renewal
- Before an audit or assessment
- After a regulator or carrier requests records
- When you are unsure which regulation applies
A cybersecurity regulatory applicability assessment can help identify which requirements are relevant to your situation.
Frequently asked questions
How do I prove employees completed security awareness training?
Keep dated, per-employee records showing completion, topics, and delivery method, such as LMS reports, sign-in sheets, or signed acknowledgments, stored where they can be produced on request.
How long should security awareness training records be kept?
It depends on the regulation. HIPAA requires Security Rule documentation to be retained for six years from creation or last effective date. Other rules tie retention to your written program, contracts, or audit cycle. Confirm with counsel.
How often is security awareness training required?
PCI DSS requires training at hire and at least annually. Other rules, such as HIPAA and the FTC Safeguards Rule, require ongoing training that reflects your risks without naming a fixed interval. Annual training with periodic refreshers is a common practice.
Does a cyber insurance carrier check training records?
Applications often ask about training. If a claim occurs, the carrier may review whether application answers were accurate, which can include training evidence.
Does security awareness training satisfy compliance on its own?
No. Training is one element of a broader security program under most regulations.
Do owners and partners need to be trained too?
Generally yes. HIPAA explicitly includes management in the workforce, and attackers frequently target executives.
What topics should security awareness training cover?
Phishing, business email compromise, wire transfer verification, password and MFA practices, safe handling of sensitive data, and how to report a suspected incident.
Is online training acceptable, or does it need to be live?
Most regulations do not mandate a delivery format. What matters is that training is relevant, current, and documented.