OBL-03Obligations and Compliance
Training and awareness
People receive role-relevant training on joining and at a defined cadence, and completion is evidenced.
Why it exists
Awareness that leaves no record cannot be shown to have happened.
What usually proves it
Assignment records, completion evidence, content version.
Smaller organizations
Annual awareness plus a short induction module.
Mapped to
- Fully addressedSOC 2 Trust Services Criteria · CC1.4
- Fully addressedISO/IEC 27001 Annex A · A.6.3
- Fully addressedNIST Cybersecurity Framework · PR.AT-01
- Fully addressedPCI DSS · 12.6.3
- Fully addressedHIPAA Security Rule · 164.308(a)(5)
- Partially addressedGDPR · Art. 39(1)(b) — Awareness raising is a DPO task where a DPO exists.
- Fully addressedEU AI Act · Art. 4
- Fully addressedNIST AI Risk Management Framework · GOVERN 2.2