Everyone completed the security training. But would they know what to do when a suspicious email, unexpected MFA prompt, or unusual request arrives?
Security awareness training can become confusing when businesses mix three questions: what their framework requires, what their own policy promises, and whether the program improves behavior.
New employee training, annual refreshers, monthly or weekly microtraining, posters, emails, and phishing simulations can work together. BCS believes frequent, short lessons help build a cybersecurity awareness culture. The right program also reflects applicable requirements, responsibilities, and risk.
What do SOC 2 and CMMC require?
| Framework | Training expectation | Frequency |
|---|---|---|
| SOC 2 | Relevant criteria address competence, security responsibilities, and awareness. | No universal annual or quarterly timetable in the Trust Services Criteria. Management designs appropriate controls. |
| CMMC Level 1 | The baseline safeguards contain no standalone Awareness and Training requirement. | No separate awareness-training schedule in that baseline; other obligations may apply. |
| CMMC Level 2 | Awareness of risks and policies, training for assigned security duties, and insider-threat recognition and reporting. | The organization determines content and frequency appropriate to its responsibilities and risks. |
References: AICPA Trust Services Criteria, FAR 52.204-21, and 32 CFR 170.14.
Assessment or affirmation deadlines are not automatically training deadlines. Contract terms, customer commitments, other applicable rules, and your own documented controls also matter.
SOC 2: define a useful control and operate it
The Trust Services Criteria address competence under CC1.4 and communication under CC2.2. Related points of focus discuss technical training, security awareness, and explaining how to report incidents.
SOC 2 Type 1 addresses control design at a specified date. Type 2 also addresses operating effectiveness over a period. A written training commitment therefore needs supporting implementation and, for Type 2, evidence of operation during the period.
If your control says new employees complete training within a defined deadline and existing personnel receive annual refreshers, track both. Discuss the proposed control and evidence needs with your CPA firm without treating that discussion as a guarantee of the examination outcome.
Explore our SOC 2 readiness and gap assessment services.
CMMC: keep Level 1 and Level 2 distinct
Level 1 personnel still need practical instructions for tasks such as escorting visitors, limiting access, and disposing of media. The absence of a separate awareness-training requirement does not remove the need to implement the safeguards.
Level 2 uses NIST SP 800-171 Revision 2 under the CMMC model. Its training requirements are 3.2.1, 3.2.2, and 3.2.3. A phishing-only course may omit role-specific duties and insider-threat reporting.
NIST leaves training content and frequency to the organization. Its discussion includes formal instruction and reinforcement techniques such as email notices and posters. See Revision 2, section 3.2. Although NIST has superseded that publication, the CMMC rule identifies Revision 2 as its Level 2 baseline.
Read about BCS CMMC consulting and implementation support.
BCS recommends onboarding, annual training, and monthly or weekly microtraining
BCS recommends training for new employees, annual refresher training, and—most importantly—short monthly or weekly training sessions, often called microtraining. We believe regular, practical reinforcement is a key part of building a cybersecurity awareness culture in the workplace.
Onboarding establishes expectations, and annual training revisits the fundamentals. Microtraining keeps those lessons present in everyday work. A brief video, a quick scenario, or a short team discussion can focus on one action: recognizing a suspicious email, verifying a payment request, reporting an unexpected MFA prompt, or handling sensitive information correctly.
Our goal is to make cybersecurity an ongoing workplace habit. Keep lessons relevant, encourage questions, reinforce prompt reporting, and use mistakes as opportunities for coaching. Consistent participation from managers helps show that security is everyone’s responsibility.
The following is BCS’s recommended starting schedule. Adapt it to your organization’s risks, responsibilities, and applicable obligations before adopting it as policy.
| Timing | Suggested activity | Purpose |
|---|---|---|
| Onboarding | Teach reporting, acceptable use, authentication, data handling, and initial job responsibilities before relevant access. | Give people the instructions needed to begin safely. |
| Annually | Documented core refresher with current company procedures. | Revisit essential expectations and address changes. |
| Monthly or weekly | Short microtraining: a focused lesson, brief video, scenario, or team discussion. | Keep cybersecurity awareness present in daily work and reinforce practical habits through regular repetition. |
| Throughout the year | Brief emails, posters, team reminders, and timely warnings. | Keep useful actions visible during everyday work. |
| After relevant changes | Targeted instruction following new duties, system changes, incidents, or demonstrated gaps. | Connect learning to current responsibilities. |
New-hire-only instruction is a weak long-term model because systems, threats, and responsibilities change. A long annual video also should not become the only occasion employees hear about security.
Posters, emails, simulations, and continuing education
Choose a method that fits the objective:
- Posters: reinforce a simple action, such as how to report a suspicious request.
- Email reminders: explain a current scam or an updated procedure.
- Short lessons: teach a focused topic and check understanding.
- Phishing simulations: exercise recognition and reporting through an authorized, controlled scenario.
- Role-based exercises: rehearse decisions specific to accounting, HR, IT, management, or other responsibilities.
- Continuing education: maintain relevant skills as systems and duties change.
These three frameworks do not universally require a commercial phishing simulator. Use simulations where they serve your program, and define how results lead to coaching. Avoid collecting real passwords or using exercises mainly to embarrass employees.
Professional certification CPE requirements are separate from the employee awareness program. Most employees need relevant workplace instruction; personnel with specialized responsibilities may need deeper technical training.
What is adequate, sufficient, and effective?
These are practical questions rather than three universal certification grades.
| Question | What to assess | Example |
|---|---|---|
| Adequate? | Does the content fit your risks, systems, policies, and responsibilities? | Accounting learns how to independently verify changes to vendor banking details. |
| Sufficient? | Does coverage and evidence address applicable requirements and relevant personnel? | Records identify the audience, topics, completion, overdue assignments, and follow-up. |
| Effective? | Can people recognize a problem and take the appropriate action? | An employee reports an unexpected MFA request and follows the established response process. |
One hundred percent completion is useful evidence of attendance. It is not proof that everyone will act correctly.
Track knowledge retention, reporting speed, use of the correct reporting channel, scenario performance, and improvement after coaching. Interpret phishing click rates in context: a harder scenario can change the result without proving the workforce became less capable.
NIST SP 800-50 Revision 1 provides learning-program guidance emphasizing behavior change, evaluation, and improvement. It is useful guidance for program design, rather than an automatic extra contractual requirement for every business.
Which training is approved?
SOC 2 and these CMMC baselines do not establish a universal commercial course list that automatically satisfies an organization’s obligations. Evaluate the actual content, audience, evidence, and connection to your procedures.
A commercial platform, an instructor-led session, or internally developed material can contribute. A vendor’s “compliance-ready” description or a government course certificate does not establish complete coverage for your particular organization.
Employees still need to learn your reporting contact, your data-sharing restrictions, and your approval process. If another contract or authority prescribes a course, include that requirement in the program.
Who creates and owns the policy?
A practical division of responsibilities is:
- Security or IT drafts: identify risks, applicable requirements, topics, roles, and delivery methods. A qualified consultant can assist.
- HR and department leaders contribute: connect onboarding, personnel changes, deadlines, and job-specific instruction.
- Management approves: assign accountability and provide time and resources.
- A program owner operates: schedule activities, follow up, retain records, and review results.
- Auditors or assessors evaluate: examine the program against applicable criteria or requirements.
Management retains ownership when an MSP delivers the training. Avoid adopting a template that promises activities your team cannot operate. Changes to commitments should be approved and documented; revising a policy does not erase an earlier missed obligation.
What records should we keep?
Build evidence collection into the workflow:
- Approved policy, scope, owner, and scheduled activities.
- Relevant personnel and role lists, including applicable contractors.
- Training materials or course versions and the subjects covered.
- Assignments, due dates, completion dates, attendance, and acknowledgments.
- Assessments, exercise results, coaching, and overdue follow-up.
- Management reviews, exceptions, and improvements.
Set retention and access rules appropriate to your obligations. A photograph of a poster or a sent email can support the record of an activity, but does not by itself show that the intended audience understood it.
Teach the situations your employees actually face
Discuss an unexpected MFA prompt, a fake invoice, an unfamiliar device plugged into the LAN, or a request to send sensitive files to a personal account. Explain what employees should do, whom to contact, and how to report promptly after a mistake.
Connect training to technical and operational controls. People need a reporting process that works, and the response team must be prepared to act. Read our related guides to BYOD and network access and security monitoring and response.
Security awareness support in Austin and Houston
Business Communication Solutions helps businesses connect awareness activities to everyday IT procedures, security responsibilities, and compliance readiness. We can work alongside management, HR, and internal IT to discuss gaps, appropriate training coverage, and supporting evidence.
Explore our employee security awareness services, SOC 2 readiness support, and CMMC consulting.
Austin: 512-257-1433 Houston: 281-815-8784
Discuss your security awareness program with BCS.
What do you think?
Why does your company provide security awareness training? Is it primarily to meet compliance requirements, or are you also preparing employees to help reduce the risk of a major breach?
Both goals matter. BCS believes new employee training, annual refreshers, and frequent monthly or weekly microtraining help make cybersecurity awareness part of everyday workplace culture.
If a suspicious request arrived today, would your employees know what to do—and feel comfortable reporting a mistake quickly?