Security Awareness and Training Policy Template: Mandatory Training, Roles and Records

Auditors rarely ask to see your awareness content; they ask for the policy that says who must be trained, on what, by when, and what happens when they are not. This template gives you that governing policy: mandatory literacy training, role-based training for people with elevated access, records, completion deadlines, consequences and review. It is the rule set that sits above a delivery plan, so it deliberately leaves campaign calendars, topics and phishing simulation mechanics to the Security Awareness Plan Template. It follows the structure of NIST SP 800-53 Rev. 5 AT-1 (policy and procedures) through AT-4 (training records), and the learning life cycle in NIST SP 800-50 Rev. 1. It is written for CISOs, GRC leads and HR partners who need a policy they can approve this quarter.

How to use this template

• Replace text in square brackets, such as [Organisation], [Security Awareness Lead] and [30 days], with your own terms and values. Bracketed values are illustrative starting points, not requirements of any standard.
• "Must" is mandatory; "should" is recommended practice where a documented exception may apply.
• Keep this policy short and stable. Put course lists, calendars and simulation rules in the awareness plan or a supporting procedure, which NIST SP 800-53 AT-1 expects alongside the policy.
• Agree sections 7 and 8 with HR and, where applicable, works councils or trade unions before approval: they touch disciplinary process and monitoring of staff.
• Section 4 includes people who operate non-human identities (service accounts, API keys, CI/CD tokens and AI agents). Remove it only if you genuinely have none.

1. Purpose

This policy sets the requirements for security and privacy awareness, training and education at [Organisation], so that every person who uses [Organisation] information systems understands the risks of their work, knows how to report a suspected incident, and holds the skills their role requires. It establishes who must complete which training, the deadlines, how completion is recorded and evidenced, and the consequences of non-completion.

2. Scope

This policy applies to:

• Workforce: all employees, including permanent, fixed-term, part-time and seasonal staff, interns and apprentices.
• Third parties: contractors, consultants, agency workers and supplier staff who hold [Organisation] accounts or access [Organisation] data, unless their contract requires equivalent training that [Organisation] has accepted in writing.
• Leadership: members of the board, executive committee and [management body].
• Systems: all [Organisation] information systems, cloud services, SaaS applications and data, in every location and on any device used for [Organisation] work.

3. Roles and responsibilities

4. Training requirements

4.1 Literacy training for all users

• 4.1.1 Every user must complete [Organisation] security and privacy literacy training before or within [5 working days] of receiving account access, and at least every [12 months] after that.
• 4.1.2 Literacy training must cover at minimum: recognising phishing and other social engineering; reporting a suspected incident and the [reporting channel]; password, passphrase and multi-factor authentication rules; handling and classifying data; acceptable use; secure remote and mobile working; and insider threat indicators (NIST SP 800-53 AT-2(2) and AT-2(3)).
• 4.1.3 Users must acknowledge the [Acceptable Use Policy] as part of literacy training (NIST SP 800-53 PL-4 Rules of Behavior).
• 4.1.4 Training must also be assigned when a significant change occurs, such as a new system rollout, a change in law affecting the user's work, or a relevant incident at [Organisation].

4.2 Role-based training

• 4.2.1 [Security Awareness Lead] must maintain a role map that links job roles and access groups to the role-based training each requires (NIST SP 800-53 AT-3).
• 4.2.2 Role-based training must be completed before the user is granted the elevated access, and at least every [12 months] after that. Access provisioning for the roles in 4.2.3 must check completion.
• 4.2.3 Role-based training is required at minimum for:
  • Privileged administrators: secure administration, privileged access workstation use, just-in-time access and break-glass procedures.
  • Developers and DevOps engineers: secure coding for the languages in use, dependency risk, and secrets handling. See the Developer Security Training Programme Guide.
  • Owners of non-human identities: staff who create or own service accounts, API keys, OAuth clients, CI/CD credentials or AI agents must complete training on ownership, least privilege, rotation and secure storage of those credentials.
  • Finance, payroll and executive assistants: payment fraud, business email compromise and call-back verification.
  • Service desk: identity verification before password or MFA resets.
  • Incident responders and SOC staff: incident procedures and exercises, as set out in [Incident Response Plan].
  • Staff using AI tools: approved tools, data that must not be entered into them, and checking outputs.

4.3 Practical exercises

• 4.3.1 [Organisation] may run practical exercises, including simulated phishing, under the rules in [Security Awareness Plan]. Exercises must be approved by [CISO], must not use content designed to cause distress, and must reward reporting.
• 4.3.2 Results of exercises must be used to target support and content. A single exercise failure must not by itself trigger disciplinary action.

4.4 Leadership training

• 4.4.1 Members of the [management body] must complete training at least every [12 months] sufficient to identify and assess cyber security risks and their impact on [Organisation], so that they can oversee the measures this policy supports.

4.5 Third parties

• 4.5.1 Third parties in scope must complete [Organisation] literacy training, or provide evidence of equivalent training accepted by [Security Awareness Lead], before access is granted.
• 4.5.2 Contracts must state the training obligation and the right to request evidence.

5. Content and delivery standards

• 5.1 Content must be reviewed at least every [12 months] and after any significant incident, threat change or policy change.
• 5.2 Content must be accessible, available in [languages], and offer alternatives for users with disabilities or without regular computer access.
• 5.3 Training should check understanding with an assessment. The pass mark for mandatory modules is [80%]; users who do not pass must retake the module within [14 days].
• 5.4 Time spent on mandatory training is working time and must be scheduled by line managers.

6. Records and evidence

• 6.1 [Organisation] must record, for each user and module: assignment date, due date, completion date, assessment result and version of content (NIST SP 800-53 AT-4).
• 6.2 Records must be retained for [the duration of employment plus 2 years] or the period required by [applicable regulation or contract], whichever is longer.
• 6.3 Exercise and simulation data must be processed under a documented lawful basis, limited to what the programme needs, and access to individual results restricted to [Security Awareness Lead], the user's line manager and [HR] where section 8 applies.
• 6.4 Evidence of completion must be available to auditors and to customers where contracts require it, in aggregated form unless individual records are lawfully required.

7. Compliance and monitoring

[Security Awareness Lead] must report the following to [CISO] every [quarter] and to [management body] every [year]. NIST SP 800-50 Rev. 1 suggests combining quantitative and qualitative measures, which this table reflects.

8. Non-completion and consequences

• 8.1 Reminders must be sent at [14 days before], on, and [7 days after] the due date, with the line manager copied from the due date.
• 8.2 Users more than [30 days] overdue on mandatory or role-based training must have their access restricted as follows: [elevated access suspended; standard access retained]. Restoration follows completion.
• 8.3 Persistent non-completion is handled under [Disciplinary Policy]. Consequences relate to failing to complete required training, not to honest mistakes in exercises.
• 8.4 Third parties more than [30 days] overdue must have access suspended until evidence is provided.

9. Exceptions

• 9.1 Exceptions, such as extended leave or users without system access, must be requested through [exception process], approved by [CISO] and recorded with an expiry no longer than [6 months].
• 9.2 No exception may waive role-based training for privileged administrators or owners of non-human identities.

10. Review and approval

[CISO] must review this policy at least every [12 months] and after significant organisational, legal or threat change. Approved by [management body] on [date]. Version [1.0]. Next review [date].

Implementation guidance

Rolling out the policy

1. Baseline: export current completion data from the learning system and HR records; identify users with no record, including contractors.
2. Build the role map: start from privileged access groups, developer groups and owners recorded in your NHI inventory, then add finance and service desk. Map each to a module.
3. Connect to provisioning: make role-based completion a condition in the access request workflow for the groups in 4.2.3, initially in report-only mode for one cycle.
4. Pilot: run one department through assignment, reminders and escalation; check that records in section 6 are complete and that HR can produce them.
5. Enforce: switch 8.2 restrictions on after one full cycle. If enforcement blocks critical work, roll back to report-only for the affected group and fix the cause, rather than granting blanket exceptions.

Framework mapping

In ISO/IEC 27001:2022, the matching Annex A control is A.6.3 Information security awareness, education and training. CIS Controls v8.1 Control 14 covers the same ground; see the CIS Control 14 Security Awareness and Skills Training Guide.

Small and large organisations

• Small: one annual literacy module, a short role map covering admins and finance, and records in the HR system are enough to meet the policy. Drop the section 7 culture survey until you have more than [50] staff.
• Large: integrate the learning system with the identity governance platform so role-based completion is checked automatically, and report by business unit.

Common failure patterns

• Completion as the only metric: 98% completion with no change in reporting rate means the content is not working.
• No role-based tier: administrators and developers get the same module as everyone else, so the people who hold the most dangerous credentials learn nothing about them.
• Contractors missed: third-party staff hold accounts but sit outside the HR system that drives assignments.
• Punishing clicks: disciplinary action for exercise failures teaches staff to hide mistakes, which delays real incident reports.
• Help desk not trained to verify callers: the MGM Resorts breach began with a help desk call; see the Vishing and Help Desk Social Engineering Awareness Guide.

Standards and references

• NIST: SP 800-50 Rev. 1, Building a Cybersecurity and Privacy Learning Program
• NIST: SP 800-53 Rev. 5 (AT family)
• NIST: Cybersecurity Framework 2.0
• NIST: SP 800-171 Rev. 3
• CIS: Control 14 Security Awareness and Skills Training
• SANS: Education Management Policy template

This template is provided for guidance and must be adapted to your organisation. It is not legal advice. Related NHI Mgmt Group resources: Security Awareness Plan Template · Security Awareness and Human Risk Management Guide · Acceptable Use Policy Template · Developer Security Training Programme Guide