ISO & GRC Training for IT and SaaS companies.

Why IT and SaaS teams train with Sterling Academy

For an IT services firm or a SaaS company, security is part of the product. Before an enterprise customer signs, its procurement and security teams send a questionnaire with dozens or hundreds of questions, ask for your ISO/IEC 27001 certificate or your SOC 2 report, and want to know how you protect their data, who can see it and how you train your people. A slow or weak answer delays the deal; a confident one, backed by evidence, wins it.

Training is on every one of those questionnaires. Do all employees receive security awareness training when they join and every year? Are developers trained in secure practices? Is there a privacy programme, and are people trained on it? Who is responsible for AI governance, and what do they know about it? Saying yes is easy. Showing a record for each person, with dates and results, is what separates a mature supplier from the rest.

The frameworks behind those questions agree. ISO/IEC 27001 asks you to define the competence each role needs, make sure people have it and keep evidence, and to run an awareness programme for everyone. SOC 2 auditors test whether people know and follow the policies your controls rely on. GDPR expects people who process personal data to be trained to handle it. ISO/IEC 27701 extends the information security management system to privacy, and ISO/IEC 42001 sets out how to manage AI responsibly, including the competence of the people who build and run AI systems. The EU AI Act adds legal duties for many organisations that build or use AI, including AI literacy for staff who work with AI systems.

IT and SaaS teams also move fast. People join every month, many work remotely across countries, and engineers do not want long classroom days. Online training they can take on any device, in short sessions, fits the way these companies work.

Sterling Academy brings Sterling's classroom training online, with the same content, available 24/7. Each course ends with a final exam, and each person who completes it receives a verifiable certificate with a QR code that a customer, an auditor or a certification body can check. Sterling's classroom training certificates have been accepted by certification bodies at client audits, and the Academy carries the same content.

What each role needs to know

Every employee. Everyone with access to systems or customer data needs the same foundation: how to recognise phishing and social engineering, how to handle customer data, how to use cloud services and collaboration tools safely, what to do with a lost laptop or a suspicious login, and how to report an incident at once. They also need to know what not to put into public AI tools. The pack gives them ISO/IEC 27001:2022 Awareness, SOC 2 Awareness, GDPR Awareness, Cloud Security and Privacy (ISO/IEC 27017 & ISO/IEC 27018) and AI Literacy & Responsible Use of Generative AI.

The security and compliance team. These are the people who build and run the controls: the information security manager, compliance lead, platform and DevOps leads, and anyone preparing for an ISO/IEC 27001 certification or a SOC 2 examination. They need to know the frameworks in depth, how to assess risk and choose controls, how to write a Statement of Applicability and how to extend the system to privacy. The pack gives them ISO/IEC 27001:2022 Implementation Training, SOC 2 Trust Services Criteria & Controls Implementation Training, ISMS Risk Assessment & Statement of Applicability, ISO/IEC 27002:2022 Information Security Controls and ISO/IEC 27701:2025 Implementation Training.

AI product teams. If you build AI into your product or use it to run your service, the people responsible need to understand how to govern it. The pack gives them ISO/IEC 42001 Awareness, ISO/IEC 42001:2023 Implementation Training, AI Risk & Impact Assessment, EU AI Act Awareness and NIST AI Risk Management Framework (AI RMF) Training, so they can design controls that satisfy customers in both the European Union and the United States.

Internal auditors. Both ISO/IEC 27001 and ISO/IEC 42001 require internal audits, and a SOC 2 programme benefits from the same discipline. The pack gives your auditors the internal auditor courses for ISO/IEC 27001 and ISO/IEC 42001, with ISO 19011, the international guidance on auditing management systems.

How the courses work

• Online and on demand. Learners study on a computer, tablet or phone, 24/7, at their own pace. Each course page shows the total learning time, including module quizzes, exercises and the final exam.
• Built from real classroom training. The content is the same as Sterling's classroom training, built by industry experts, domain specialist trainers and globally renowned auditors with 30+ years in ISO and GRC. Each course page has a sample video.
• Practical examples. The examples come from working organisations, including software companies and IT service providers, so engineers and sales staff recognise the situations they meet.
• A real final exam. Each course ends with an assessed final exam. Awareness courses need 70% for the certificate; practitioner courses, which lead to a Certificate of Competence, need 60%. The retake rule is explained on each course page.
• A certificate anyone can verify. Each person who completes a course receives a certificate with a QR code. Learners can share a badge on LinkedIn.
• 12 months' access. Each course, and each pass, gives 12 months' access.

Courses or a pass: the cheapest way to buy

Each role card shows the courses that role needs, the price one by one, and a pass when it is close to or cheaper than the courses. We mark the cheaper option as best value and never show a saving that is not real.

The Awareness Pass costs US$99 and opens all 65 awareness courses for 12 months, including NIS2, DORA and the EU AI Act, which matter if you sell into Europe. For the other roles, the card shows at today's prices whether the listed courses or a pass is cheaper, and marks that option as best value.

If your security lead also runs AI governance and internal audits, the All-Access Pass opens all 16 courses on this page, and every other course, for US$499 per person for 12 months.

A pass also removes a decision people tend to put off. Once a learner holds a pass, adding a course for a new customer, a new regulation or a new job costs nothing more for the rest of the 12 months, and that is often when the second and third courses get taken.

When you train 11 people or more, every price drops by 20% per person, and by 30% from 51. You can mix plans in one order.

Answering the security questionnaire with evidence

Training helps you win deals only if you can prove it. Sterling Academy gives you three kinds of evidence for a customer's security review, a certification audit or a SOC 2 examination.

The first is the certificate for each person: named, dated, tied to a specific course and final exam, and verifiable by QR code.

The second is the company console. Your administrator invites people, assigns each person only the courses their role needs, and sees who has started, who is in progress, who has stalled and who has finished. New hires are easy to add on their first day.

The third is the report. You can download your training records and attach them to a questionnaire answer, or keep them with your audit evidence.

A training plan for a growing software company

Day one for every new hire. Add awareness training to onboarding. Every new employee and contractor receives the every-employee courses in their first week, so your questionnaire answer "all staff are trained at hire" is true.

Before the certification or attestation project. The security and compliance team takes the implementation courses as the project starts, so they build the controls with the right method from the beginning, rather than reworking them after a gap assessment.

When AI enters the product. As soon as a team starts building AI features, train the product owner and lead engineers on ISO/IEC 42001, AI risk and the EU AI Act, so governance is designed in, not added after a customer asks.

Before the first internal audit. Internal auditors finish their courses and then audit with the methods they have learned.

Every year. Use the console to see whose training is due and renew it. Each course and pass gives 12 months' access, which matches the yearly cycle most customers expect.

Training gaps customers and auditors often find

Engineers missing from awareness training. Some companies train sales and support staff but assume engineers already know security. Customers' auditors expect every person with system access to be trained, and engineers often hold the most access.

No evidence for contractors. Freelancers and contractors with production access need the same training and the same records as employees.

Policy without training. A well-written acceptable-use or data-handling policy does not help if staff have never been trained on it. Assessors ask people questions directly.

AI governance with no named owner. Customers increasingly ask who governs your AI and how. A trained owner with a certificate is a strong answer.

Internal audits done by the people who built the controls. Auditors must be objective. Training a second person as an internal auditor solves the most common independence finding in small companies.

ISO/IEC 27001, SOC 2 and privacy: how the training fits each

Many software companies run more than one framework at once, and the training on this page is designed to serve them together rather than one at a time.

ISO/IEC 27001 is a certifiable management system standard. A certification body audits your information security management system and, if it conforms, you receive a certificate that customers anywhere in the world recognise. The standard asks for awareness for everyone and competence for the people with security roles, and the auditor samples training records against both.

SOC 2 is an attestation, not a certification. An independent CPA firm examines your controls against the Trust Services Criteria and issues a report, either at a point in time (Type 1) or over a period (Type 2). The examiner tests whether your people are trained on the policies the controls depend on, so the same awareness records serve both frameworks.

Privacy sits on top of both. GDPR and similar laws set the legal duties; ISO/IEC 27701 gives you a management system to meet them, built as an extension of ISO/IEC 27001. If you hold ISO/IEC 27001 already, ISO/IEC 27701 is the natural next step when customers start asking about privacy.

AI is the newest layer. ISO/IEC 42001 follows the same management system structure as ISO/IEC 27001, so a team that has implemented one can implement the other with far less effort, and the same internal auditors can audit both after training.

Because the frameworks share a structure, the courses do too. People who have taken the ISO/IEC 27001 implementation course will find the ISO/IEC 27701 and ISO/IEC 42001 courses familiar, which is one reason the All-Access Pass suits a security lead who will carry several frameworks.

Services beyond training

Sterling's expert and experienced consultants help IT and SaaS companies achieve ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 certification and SOC 2 and GDPR compliance, simply and faster: gap assessments, documentation, internal audits and support through the certification audit. Sterling has completed 8,100+ client engagements in 60+ countries over 20+ years.

If a customer is waiting for your certificate or report, ask for a team proposal below. A Sterling consultant replies within one working day.

Talk to a Sterling consultant