Security & Compliance Training Program
1. Purpose
This document defines the security and compliance training that supports the security tier model from HW-CAT-005. Tier 1 baseline courses are required of every employee. Tier 2 courses are required of employees in roles that handle sensitive data. Tier 3 courses are required of employees in privileged-access or high-assurance roles. Tier 4 courses are required of employees working on isolated or air-gapped systems.
2. Security Tier to Training Mapping
| Tier | Population | Required Courses |
|---|---|---|
| Tier 1 — Baseline | All employees | SEC-101 Information Security Awareness |
| Tier 2 — Sensitive Data | Roles handling customer billing, network configuration, HR records, payment data | SEC-101; SEC-201 Customer Data Privacy; SEC-220 Third-Party Risk Awareness (procurement, sales); SEC-310 Secure Development Lifecycle (engineering) |
| Tier 3 — Restricted Handling | IT administrators, security operations analysts, legal/compliance officers, internal audit | SEC-101; SEC-201; SEC-301 Privileged Access Workstation Use; SEC-410 Incident Reporting; SEC-420 Security Operations Center Fundamentals (Security Operations Analysts) |
| Tier 4 — Specialty / Air-Gapped | Lab and isolated-network operators | SEC-101; SEC-301; SEC-510 Air-Gapped System Operations |
3. Course Details
SEC-101: Information Security Awareness
- Category: Mandatory
- Intended Audience: All employees (Tier 1)
- Delivery Mode: Instructor-led virtual
- Duration: 90 minutes
- Completion Deadline: Within 10 business days of start date
- Prerequisites: None
- Assessment Method: Scored exam (passing threshold 85%)
- Compliance Flag: Annual regulatory training
- Recertification Cadence: Annual
- Owner: Information Security Office
- Status: Active
- Notes: Covers phishing recognition, credential hygiene, data classification, removable-media rules, and incident-reporting basics.
SEC-201: Customer Data Privacy
- Category: Role-Required
- Intended Audience: All roles with access to customer-account data or customer-billing data
- Delivery Mode: Self-paced online
- Duration: 90 minutes
- Completion Deadline: Day 30; before customer-account system access is granted
- Prerequisites: SEC-101; NEW-104
- Assessment Method: Scored exam (passing threshold 85%)
- Compliance Flag: Customer-data privacy
- Recertification Cadence: Annual
- Owner: Information Security Office
- Status: Active
SEC-205: Calendar & Mailbox Delegation Security
- Category: Role-Required
- Intended Audience: Executive Assistants and others with delegated access
- Delivery Mode: Self-paced online
- Duration: 30 minutes
- Completion Deadline: Within 30 days of starting delegated-access duties
- Prerequisites: SEC-101
- Assessment Method: Knowledge check
- Compliance Flag: None
- Recertification Cadence: Annual
- Owner: Information Security Office
- Status: Active
SEC-220: Third-Party Risk Awareness
- Category: Role-Required
- Intended Audience: Procurement specialists, sales representatives, account managers, vendor-relationship roles
- Delivery Mode: Self-paced online
- Duration: 60 minutes
- Completion Deadline: Day 30
- Prerequisites: SEC-101
- Assessment Method: Scored exam (passing threshold 80%)
- Compliance Flag: Annual regulatory training
- Recertification Cadence: Annual
- Owner: Information Security Office and Procurement
- Status: Active
SEC-301: Privileged Access Workstation Use
- Category: Role-Required (Tier 3)
- Intended Audience: IT Administrators, Security Operations Analysts, Legal/Compliance Officers (where assigned a SecureStation 16)
- Delivery Mode: Instructor-led virtual with lab
- Duration: 4 hours
- Completion Deadline: Within 14 days of receiving a Tier 3 device
- Prerequisites: SEC-101; SEC-201
- Assessment Method: Practical demonstration on a SecureStation 16
- Compliance Flag: Privileged-access compliance
- Recertification Cadence: Annual
- Owner: Information Security Office
- Status: Active
- Notes: Required before a SecureStation 16 (HW-CAT-003) is released from staging.
SEC-310: Secure Development Lifecycle
- Category: Role-Required
- Intended Audience: Software engineers, AI engineers, data engineers, network engineers
- Delivery Mode: Blended (self-paced online plus instructor-led code review)
- Duration: 3 hours
- Completion Deadline: Day 60
- Prerequisites: SEC-101; ENG-101
- Assessment Method: Scored exam (passing threshold 80%) and code-review exercise
- Compliance Flag: Annual regulatory training
- Recertification Cadence: Annual
- Owner: Information Security Office and Engineering Learning
- Status: Active
SEC-330: Records & Legal Hold Handling
- Category: Role-Required
- Intended Audience: Legal and compliance officers, internal audit, executive assistants supporting executives
- Delivery Mode: Instructor-led virtual
- Duration: 2 hours
- Completion Deadline: Day 30
- Prerequisites: SEC-101
- Assessment Method: Knowledge check
- Compliance Flag: Annual regulatory training
- Recertification Cadence: Annual
- Owner: Legal & Compliance
- Status: Active
SEC-340: Audit Evidence Handling
- Category: Role-Required
- Intended Audience: Internal audit
- Delivery Mode: Self-paced online
- Duration: 60 minutes
- Completion Deadline: Day 30
- Prerequisites: SEC-101; SEC-330
- Assessment Method: Knowledge check
- Compliance Flag: Annual regulatory training
- Recertification Cadence: Annual
- Owner: Internal Audit and Information Security Office
- Status: Active
SEC-410: Incident Reporting
- Category: Role-Required
- Intended Audience: IT administrators, security operations analysts, service desk agents
- Delivery Mode: Self-paced online
- Duration: 45 minutes
- Completion Deadline: Day 30
- Prerequisites: SEC-101
- Assessment Method: Knowledge check
- Compliance Flag: Privileged-access compliance
- Recertification Cadence: Annual
- Owner: Information Security Office
- Status: Active
SEC-420: Security Operations Center Fundamentals
- Category: Role-Required
- Intended Audience: Security operations analysts
- Delivery Mode: Instructor-led virtual with lab
- Duration: 6 hours over two sessions
- Completion Deadline: Day 60
- Prerequisites: SEC-101; SEC-301; SEC-410
- Assessment Method: Practical demonstration in a sandboxed environment
- Compliance Flag: Privileged-access compliance
- Recertification Cadence: Annual
- Owner: Information Security Office
- Status: Active
SEC-510: Air-Gapped System Operations
- Category: Exception-Only
- Intended Audience: Tier 4 device operators
- Delivery Mode: Instructor-led in-person
- Duration: 8 hours over two days
- Completion Deadline: Before first use of a Tier 4 device
- Prerequisites: SEC-101; SEC-301
- Assessment Method: Practical demonstration in the controlled lab
- Compliance Flag: Privileged-access compliance
- Recertification Cadence: Annual
- Owner: Information Security Office
- Status: Active
4. Role-Based Training Requirements
| Role | Required Security Courses | Recertification |
|---|---|---|
| General Corporate Staff | SEC-101; SEC-201 if customer-data access | Annual |
| Software Engineer | SEC-101; SEC-310 | Annual |
| AI Engineer | SEC-101; SEC-310; ENG-320 Responsible AI Development | Annual |
| Network Engineer | SEC-101; SEC-310; SEC-201 for customer-config access | Annual |
| IT Administrator | SEC-101; SEC-201; SEC-301; SEC-410 | Annual |
| Service Desk Agent | SEC-101; SEC-201; SEC-410 | Annual |
| Security Operations Analyst | SEC-101; SEC-201; SEC-301; SEC-410; SEC-420 | Annual |
| Retail Associate | SEC-101; RTL-210 Payment-Handling Compliance (TRN-CAT-007) | Annual |
| Field Technician | SEC-101; SEC-201 (where accessing customer network configuration) | Annual |
| Call Center Agent | SEC-101; SEC-201; CCO-301 Customer Data Privacy in Support Contexts (TRN-CAT-008) | Annual |
| Sales / Account Manager | SEC-101; SEC-201; SEC-220 | Annual |
| Legal / Compliance Officer | SEC-101; SEC-201; SEC-301; SEC-330 | Annual |
| Internal Audit | SEC-101; SEC-301; SEC-330; SEC-340 | Annual |
5. Phishing Simulation Program
In addition to SEC-101, all employees are enrolled in the continuous phishing simulation program. Simulations are sent on a non-predictable cadence. Employees who report or correctly handle simulations meet program expectations. Employees who fail a simulation are auto-enrolled in SEC-105 Phishing Response Refresher, a 20-minute self-paced module. Repeated failures within a rolling twelve-month window are reviewed by the Information Security Office.
6. Compliance and Audit
- Completion data is reported continuously from the L&D administration tool to the corporate compliance dashboard.
- Out-of-compliance employees are blocked from accessing tier-restricted applications until remediated.
- Annual recertification windows open thirty days before the employee’s anniversary. Failure to complete by anniversary triggers an escalation per TRN-CAT-010.
- SEC-301 and SEC-420 require annual practical re-evaluation, not just course completion.