An auditor, a customer security questionnaire, or an internal control owner has asked you for a security awareness training policy. You want the structure before you want the argument.
This security awareness training policy template gives you the sections your policy needs, sample language for each, the frameworks that require one, and what to do about the part most policies fail on: enforcement and evidence.
What a security awareness training policy is, and how it differs from your program
A security awareness training policy sets out who needs training, what that training needs to cover, how often it happens, and what happens if someone doesn't complete it. It is a governance document, which is why an auditor asks for it before asking anything about your training content.
The policy and the security awareness training program aren’t the same thing. The policy says what your organization requires. The program is how you actually deliver it. An auditor will ask for the policy, then look for evidence that you’ve done what it says.
You also need to be clear about who the policy covers. That usually means employees, contractors, temporary staff, and third parties with access to your information systems. If you scope it to “all employees,” you could miss the contractor with a login to your finance platform. If someone has access to your systems, they should be in scope.
Which frameworks include security awareness training requirements
A security awareness and training policy isn’t just useful for keeping your program consistent. Several common security and compliance frameworks require security awareness training, a documented policy, or evidence showing how you manage it.
Here’s what each one requires.
ISO/IEC 27001:2022 Annex A 6.3
ISO 27001 Annex A 6.3 requires information security awareness, education, and training appropriate to people’s roles, along with updates to relevant information security policies and procedures.
For your policy, that means defining who receives security awareness training and when role-based training is required.
NIST SP 800-53 (AT-1, AT-2, AT-3)
NIST SP 800-53 Rev. 5 separates policy, general training, and role-based training into different controls: AT-1 covers the awareness and training policy and procedures, AT-2 covers general security and privacy literacy training, and AT-3 covers role-based training. AT-4 covers training records.
In practice, you need both the policy and records showing that the training it requires actually happened. NIST SP 800-50 Rev. 1 provides the companion guidance for building and managing the wider security awareness program.
PCI DSS 12.6
PCI DSS 12.6 requires a formal security awareness program for personnel. It includes requirements to review the program at least every 12 months and keep it current as threats change. Security awareness training also has to cover threats including phishing and social engineering.
Your policy should cover who receives training, when they receive it, how the program is reviewed, and how training content is updated as cyber threats change.
HIPAA 164.308(a)(5)
HIPAA 45 CFR 164.308(a)(5) requires covered entities and business associates to run a security awareness and training program for all workforce members, including management.
It also covers periodic security updates, malicious software, log-in monitoring, and password management. Your policy needs to show how security awareness training reaches the workforce and how those ongoing requirements are handled.
SOC 2
SOC 2 doesn’t give you a specific security awareness training policy template to follow. Instead, auditors look at whether your controls require relevant training and whether you can show that people completed it.
Your policy gives the auditor the requirement. Your training records provide the evidence that you followed it.
What to include in your security awareness training policy
Your security awareness training policy should cover who it applies to, what training is required, who owns it, how you track it, and what happens when requirements aren't met. The eight sections below include sample language you can copy and edit.
1. Purpose and scope
Define why the policy exists and who it covers, based on access rather than employment status.
Include:
- Employees, contractors, temporary staff, interns, and relevant third parties
- Information systems and resources covered
- Any exclusions or exceptions
Sample policy language:
This policy establishes the security awareness and training requirements for [Organization]. It applies to all employees, contractors, temporary staff, interns, and third parties granted access to [Organization] information systems and information resources, regardless of employment status or location.
2. Roles and responsibilities
State who owns the policy and who runs each part of the security awareness training program.
Include:
- The policy owner, such as the CISO
- Who manages training content and delivery
- Who tracks completion and enforcement
- Who approves exceptions
Sample policy language:
The Chief Information Security Officer owns this policy and approves its content and cadence. [Security Function] owns training content, topic selection, and simulation scheduling. [Human Resources / Learning and Development] owns enrollment, scheduling, completion tracking, and escalation of overdue training. Exceptions require written approval from the CISO.
3. Training requirements and topics
Set the minimum security awareness training everyone in scope must receive.
Include:
- Information security policies and acceptable use
- Phishing and social engineering
- Password and credential security
- Data protection and physical security
- Recognizing and reporting security incidents
Sample policy language:
All personnel in scope shall complete security awareness training covering information security policies, acceptable use, phishing and social engineering, credential and password management, data protection and classification, physical security, incident recognition, and the procedure for reporting suspected security incidents.
4. Frequency and timing
Specify when training happens, including triggers outside your regular schedule.
Include:
- Training for new hires
- Regular refresher training
- Role-change training
- Training after relevant security incidents
- Training in response to emerging threats or policy changes
Sample policy language:
Personnel shall complete initial security awareness training within [time period] of their start date and before being granted access to [defined systems, where applicable]. All personnel shall complete refresher training at least once every 12 months. Additional training shall be assigned following a relevant change of role, significant security incident, material change to information security policies, or newly identified threat affecting [Organization].
5. Role-based training
Identify who needs additional training based on their role, access, or responsibilities.
Include roles such as:
- System administrators and developers
- Finance and Human Resources teams
- Executives and executive assistants
- IT service desk staff
- Anyone with elevated privileges or security and privacy responsibilities
Sample policy language:
Personnel holding elevated privileges or security responsibilities shall complete role-based training appropriate to their function in addition to general security awareness training. Role-based training shall be assigned to [list applicable roles].
6. Completion tracking and records
Explain which records you’ll keep to track completion and show that training requirements have been met.
Record:
- Who was assigned training and when
- When training was completed
- Required acknowledgements
- The version of the training content delivered
- Role, where relevant
- How long records are retained
Sample policy language:
[Organization] shall maintain records of training assignment, completion, and acknowledgement for each individual in scope, including the date of assignment, date of completion, and version of the training content delivered. Records shall be retained for [retention period] and made available for audit on request.
7. Non-compliance and enforcement
Outline what happens when someone doesn’t complete required training.
Include:
- Reminder and escalation timings
- Who receives escalations
- Any access restrictions
- When Human Resources becomes involved
- When disciplinary action may apply
Sample policy language:
Personnel who fail to complete required training within the defined period shall receive reminders at [interval]. Continued non-completion shall be escalated to the individual’s manager and then to [Function]. Failure to comply with this policy may result in disciplinary action in accordance with [Organization] Human Resources policies.
8. Policy review and version control
Specify when the policy will be reviewed and how changes are recorded.
Include:
- A named policy owner
- An annual review cadence
- Reviews after significant incidents or relevant regulatory changes
- Reviews when the security training program changes
- Version number, date, changes, and approver
Sample policy language:
This policy shall be reviewed at least annually by the policy owner and following any material change to regulatory obligations, the threat landscape, or the systems used to deliver training. All revisions shall be recorded with a version number, revision date, summary of changes, and approver.
Where these policies fail an audit
Most policies fail on evidence. The document itself is usually fine, and the finding lands because the organization cannot produce records matching what the document promised.
The mismatches assessors find most often:
- The policy commits to role-based training. The records show one general module assigned to everyone.
- The policy requires training within 30 days of hire. No timestamped record of assignment exists, only completion dates.
- The policy covers contractors. Someone pulled the training list from the HR system, which does not contain them.
- The policy requires annual review. Nobody has opened the document in three years and it carries no version history.
The practical rule follows from all four. Do not write a commitment you cannot evidence. A policy that promises less and proves all of it survives an audit better than one that promises more and proves some of it.
Participation data alone is a weak evidence base even when it is complete. That’s because completion rates measure the wrong thing if you’re trying to understand whether the program actually worked.
How to review and update your security awareness training policy
Review your policy at least once a year, but don’t wait for the annual review if something changes.
Build these steps into your review process:
- Check whether anything has changed. Review the policy after a new framework or regulation comes into scope, a significant security incident, a change to your training tools, or a change to how your security awareness training program operates.
- Compare the policy with what you actually do. Check that the people in scope, training topics, role-based training, frequency, enforcement process, and roles and responsibilities still match how the program runs.
- Update the policy when the program changes. Your policy should give you enough flexibility to respond to new and emerging threats without rewriting it every time. For example, adding a topic mid-program shouldn’t require a new policy.
- Record every change. Give each version a version number, review date, summary of changes, and named approver. Keep previous versions so you can show what changed and when.
- Get the updated policy approved. Follow your documented approval process and keep the approval record with the policy.
The goal is to stop the policy and the program drifting apart. When an assessor asks what your policy required at a particular point in time, you should be able to show them both the policy and the records that prove it.
How to turn your security awareness training policy into evidence
Writing the policy is the easy part. You also need records that show you’re doing what the policy says.
Frame Security helps you build that evidence as your security awareness training program runs:
- Map training to compliance requirements. Training maps to controls across SOC 2, ISO 27001, HIPAA, GDPR, PCI DSS, and NIST, so you can show which training supports which requirements.
- Keep training records in one place. Assignment and completion records are tracked by employee and role, with timestamps showing when training was assigned and completed.
- Generate evidence when you need it. Audit-ready reports bring your training and framework mappings together without having to reconstruct the record before an assessment.
- Show more than completion. Phishing and deepfake simulations across email, voice, and video feed into each employee’s Human Risk Score. That gives you behavioral evidence alongside the record of who completed training. Together, those simulation outcomes, training interactions, and posture signals give you a broader view of human risk reduction.
- Keep training content current. Security awareness training generated from your own policies can be updated as those policies and the regulations behind them change, helping your program keep pace with the review requirements you’ve documented.
The goal is to be able to prove what happened without rebuilding the evidence after the fact. To see how Frame maps your training against your own framework requirements, book a demo.
Security awareness training policy FAQs
Who should own a security awareness training policy?
The CISO or another senior security leader usually owns the policy, while security, Human Resources, and L&D may share responsibility for running the program, tracking completion, and enforcement.
How specific should a security awareness training policy be?
Be specific about requirements, responsibilities, timing, and enforcement, but avoid naming individual courses or training materials. Those can change more often than the policy. Set the requirement in the policy and manage the detail through your security awareness training program.
How long should security awareness training records be kept?
Set a retention period based on your compliance requirements and information security policies. Keep enough detail to show who was assigned training, what they received, and when they completed it.
