ISO & GRC Training for fintech and payments companies.

Why fintech teams train with Sterling Academy

A fintech company is only as strong as the partners that let it operate. A sponsor bank, a card scheme, an acquirer, a payment processor or an enterprise customer has to be satisfied that you protect card and account data, that your service will keep running and that your people know what they are doing. Each of them will check before they work with you, and most will keep checking every year.

Those checks always include people. A partner's due-diligence questionnaire asks whether all staff receive security awareness training at hire and every year, whether people who handle card data are trained on PCI DSS, who owns operational resilience and what they know about it. A qualified security assessor reviewing your PCI DSS compliance will look at your awareness programme and its records. An ISO/IEC 27001 certification auditor will sample training records against the competence you defined for each role. A SOC 2 examiner will test whether people know and follow the policies your controls depend on.

The rules make this explicit. PCI DSS asks for a formal security awareness programme, with training when people join and at least once every twelve months. ISO/IEC 27001 asks for competence and evidence of it. If you serve customers in the European Union, the Digital Operational Resilience Act (DORA), which has applied since January 2025 to banks, payment and e-money institutions, crypto-asset service providers and many other financial entities, requires ICT security awareness programmes and digital operational resilience training for all staff, including senior management. GDPR expects people who process personal data to be trained to handle it.

Fintech teams also grow and change quickly. New people join every month, many work remotely, and the engineering team does not want long classroom days. Training they can take online, on any device, in short sessions, fits a fintech's pace.

Sterling Academy brings Sterling's classroom training online, with the same content, available 24/7. Each course ends with a final exam, and each person who completes it receives a verifiable certificate with a QR code that a partner, an assessor or a certification body can check. Sterling's classroom training certificates have been accepted by certification bodies at client audits, and the Academy carries the same content.

What each role in a fintech needs to know

Every employee. Everyone who touches customer or card data, from customer support to finance to engineering, needs the same foundation: what card and account data is and how it must be handled, how to recognise phishing and social engineering aimed at financial companies, how to protect credentials, what operational resilience means for their job, and how to report an incident at once. The pack gives them PCI DSS Awareness, ISO/IEC 27001:2022 Awareness, SOC 2 Awareness, GDPR Awareness, DORA Awareness and AI Literacy & Responsible Use of Generative AI. Because all six are awareness courses, the Awareness Pass opens them and every other awareness course.

The security and compliance team. These are the people who build and run the controls: the head of security, the compliance lead, platform engineers who own production access, and anyone preparing for PCI DSS validation, an ISO/IEC 27001 certification or a SOC 2 examination. They need each framework in depth. The pack gives them PCI DSS Requirements & Controls Implementation Training, SOC 2 Trust Services Criteria & Controls Implementation Training, ISO/IEC 27001:2022 Implementation Training and NIST Cybersecurity Framework (CSF) 2.0 Training, which many US partners use as a common language for security programmes.

Risk and resilience. Risk, continuity and operations leads make sure the service keeps running through an outage, a cyber incident or a supplier failure, which is what DORA and every banking partner care about most. The pack gives them Risk Management, Information Security Risk Management (ISO/IEC 27005), ISO 22301:2019 Implementation Training and Business Impact Analysis & Continuity Exercises.

Internal auditors. ISO/IEC 27001 requires internal audits, and partners expect an independent check of your controls before their own. The pack gives your auditors the ISO/IEC 27001 internal auditor course and ISO 19011, the international guidance on auditing management systems.

How the courses work

• Online and on demand. Learners study on a computer, tablet or phone, 24/7, at their own pace. Each course page shows the total learning time, including module quizzes, exercises and the final exam.
• Built from real classroom training. The content is the same as Sterling's classroom training, built by industry experts, domain specialist trainers and globally renowned auditors with 30+ years in ISO and GRC. Each course page has a sample video.
• Practical examples. The examples come from working organisations, including payment and financial services companies, so people recognise the situations they meet.
• A real final exam. Each course ends with an assessed final exam. Awareness courses need 70% for the certificate; practitioner courses, which lead to a Certificate of Competence, need 60%. The retake rule is explained on each course page.
• A certificate anyone can verify. Each person who completes a course receives a certificate with a QR code. Learners can share a badge on LinkedIn.
• 12 months' access. Each course, and each pass, gives 12 months' access, which matches the yearly cycle PCI DSS and most partners expect.

Courses or a pass: the cheapest way to buy

Each role card shows the courses that role needs, the price one by one, and a pass when it is close to or cheaper than the courses. We mark the cheaper option as best value and never show a saving that is not real.

For every employee, the Awareness Pass costs US$99 and opens all 65 awareness courses for 12 months. For the other roles, the card shows at today's prices whether the listed courses or a pass is cheaper, and marks that option as best value.

If one person needs most of the pack, for example a head of compliance who covers security, resilience and audit, the All-Access Pass opens all 15 courses on this page, and every other course in the catalogue, for US$499 per person for 12 months.

A pass also removes a decision people tend to put off. Once a learner holds a pass, adding a course for a new customer, a new regulation or a new job costs nothing more for the rest of the 12 months, and that is often when the second and third courses get taken.

When you train 11 people or more, every price drops by 20% per person, and by 30% from 51. You can mix plans in one order.

Evidence for partners, assessors and auditors

Sterling Academy gives you three kinds of evidence for a partner's due diligence, a PCI DSS assessment, an ISO/IEC 27001 audit or a SOC 2 examination.

The first is the certificate for each person: named, dated, tied to a specific course and final exam, and verifiable by QR code.

The second is the company console. Your administrator invites people, assigns each person only the courses their role needs, and sees who has started, who is in progress, who has stalled and who has finished. New hires are easy to add on their first day.

The third is the report. You can download training records and attach them to a questionnaire answer or an assessment's evidence pack.

A training plan for a fintech

Make awareness part of onboarding. Every new employee and contractor completes the every-employee courses in their first week. That makes "all staff are trained at hire" true from day one, and it is the single most common training question partners ask.

Train the control owners before the assessment. The security and compliance team takes the implementation courses as the PCI DSS, ISO/IEC 27001 or SOC 2 project starts, so the controls are built correctly the first time.

Build resilience into the plan. Risk and continuity leads take their courses early, then run a business impact analysis and a continuity exercise with what they have learned. Partners and DORA both expect the exercise to happen, not only the plan to exist.

Prepare your internal auditors. Auditors finish their courses before the first internal audit, then audit with the methods they have learned.

Repeat every year. Use the console to see whose training is due. PCI DSS and most partners expect awareness training at least once every twelve months.

Training gaps assessors often find in fintech

Annual refresher missed. Awareness training at hire is common; the yearly refresher is often forgotten when the company is busy growing. Assessors check dates.

Engineers and contractors without records. People with the most access are sometimes left out of awareness training. Every person with access to card data or production systems needs a record.

Role-specific training missing. PCI DSS and ISO/IEC 27001 both expect people with security roles to be trained for those roles, not only to receive general awareness. A role-to-course matrix, like the cards on this page, shows that you thought about it.

Senior management untrained. DORA requires training for senior management as well as staff. Many companies train the floor and forget the board and executives.

Continuity plans never tested. A plan without an exercise rarely convinces a banking partner. Training in business impact analysis and exercises gives your team the method to test it.

PCI DSS, ISO/IEC 27001, SOC 2 and DORA: how they fit together

PCI DSS protects payment card data. Depending on your role and volume, you validate compliance through a qualified security assessor or a self-assessment, and card brands, acquirers and partners rely on the result.

ISO/IEC 27001 is a certifiable management system for information security across the whole company, recognised by partners worldwide.

SOC 2 is an attestation report issued by an independent CPA firm on your controls, widely asked for by US customers.

DORA is EU law. It sets duties for ICT risk management, incident reporting, resilience testing, third-party risk and training for financial entities in the European Union, and affects their ICT suppliers through contracts.

The frameworks overlap heavily, especially in training, access control, incident management and supplier management. One trained team and one set of training records serve all of them, which is why the courses on this page are built to work together.

Starting small: a first-year plan for an early-stage fintech

An early-stage fintech rarely has a full security team, but its first bank partner will still ask the same questions. A sensible first year looks like this.

First month. Every employee completes the every-employee courses. With the Awareness Pass, a small team pays US$99 per person and has every awareness course for the year, so new topics such as NIS2 or the EU AI Act are covered when they come up.

First quarter. The person who owns security, often the CTO or a first security hire, takes the PCI DSS and ISO/IEC 27001 implementation courses and starts the gap assessment with the right method. If US customers ask for SOC 2, the SOC 2 implementation course follows.

Second quarter. The operations lead takes the business continuity courses and runs the first business impact analysis and exercise, which banking partners almost always ask about.

Second half. A second person, who did not build the controls, takes the internal auditor courses and runs the first internal audit before the certification audit or the partner's review.

At the end of the year, every person has a certificate and the company has a training record it can attach to any questionnaire. In the second year, the same records are renewed, and the company can widen training as it adds products and markets.

Services beyond training

Sterling's expert and experienced consultants help fintech and payments companies achieve ISO/IEC 27001 and ISO 22301 certification, PCI DSS, SOC 2 and GDPR compliance and DORA readiness, simply and faster: gap assessments, documentation, internal audits and support through the audit. Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years.

If a partner or an assessor is waiting, ask for a team proposal below. A Sterling consultant replies within one working day.

Talk to a Sterling consultant