Information Security and Data Privacy Training: Standards, Laws and Frameworks

The international standard for an information security management system, with Annex A controls explained in ISO/IEC 27002 and risk management in ISO/IEC 27005.

ISO/IEC 27001 requires the organisation to decide the competence each role needs, make people aware of the policy and their part in it, and keep evidence of both; Annex A control 6.3 covers awareness, education and training. Certification auditors interview staff and sample training records. Start with ISO/IEC 27001 Awareness for everyone, then the implementation, controls and risk assessment courses for the ISMS team and the internal auditor course for the people who check it.

Guidance on security controls for cloud services and on protecting personal data in public clouds.

ISO/IEC 27017 adds cloud-specific guidance to the ISO/IEC 27002 controls for both cloud providers and cloud customers, and ISO/IEC 27018 sets out how a public cloud provider protects personal data it processes for its customers. Clients increasingly ask SaaS and hosting providers for both. Start with the cloud security and privacy course for engineering, operations and the people who answer customers' security questionnaires.

The privacy information management system standard for controllers and processors of personal data.

ISO/IEC 27701 sets out a privacy information management system for controllers and processors of personal data. The 2025 edition can be used on its own or alongside ISO/IEC 27001. It maps well to GDPR and other privacy laws, which makes it a practical way to show clients a privacy programme. Start with ISO/IEC 27701 Awareness for staff, and the implementation course for the privacy lead and the team building the system.

The EU General Data Protection Regulation, with data protection impact assessments and records of processing; the BPO courses also cover the Philippines Data Privacy Act and India's DPDP Act.

The GDPR expects the data protection officer to raise awareness and train the staff involved in processing, and requires appropriate security, records of processing and data protection impact assessments for high-risk processing. Fines reach 20 million euros or 4% of worldwide turnover. Start with GDPR Awareness for everyone who handles personal data, DPIA and Records of Processing for the privacy team, and the BPO courses for outsourced service teams.

The National Cybersecurity Authority's minimum cybersecurity controls for the entities they apply to in Saudi Arabia, in four domains, with the NCA's own compliance assessment.

The ECC cover governance, everyday defences, resilience, and third-party and cloud security, and the NCA assesses compliance against them. People need to know what the controls mean for their own work, and the team that owns them needs to know how to put each one in place and keep the evidence. Start with the ECC awareness course for all staff, and give the implementation course to the people who build and run the controls.

The Kingdom's personal data protection law, its Implementing Regulation and the regulation on transferring personal data outside the Kingdom, overseen by SDAIA.

The PDPL sets rules for consent and the other legal bases, privacy notices, individual rights, security, records, data protection officers and transfers outside the Kingdom, and requires breach notification within 72 hours. Everyone who handles personal data needs to know their part. Start with Saudi PDPL Awareness for all staff who handle personal data.

The UAE federal data protection law, with where the DIFC and ADGM regimes apply instead.

The UAE PDPL sets the processing rules, consent and the other grounds for processing, individual rights, the duties of controllers and processors, security, breach reporting, data protection officers, impact assessments and cross-border transfers. Start with UAE PDPL Awareness for everyone who handles personal data, and add GDPR Awareness where you also serve people in the European Union.

The Department of Health's information and cyber security standard for Abu Dhabi healthcare entities, Version 2.

ADHICS Version 2 sets a governance structure, control categories (Basic, Transitional, Advanced and Service Provider) and eleven domains, from people, assets and access control to data privacy, incident reporting and continuity. Every healthcare worker plays a part in it. Start with ADHICS Awareness for all staff, and add HIPAA Awareness where you also handle US patient data.

India's data protection law and its Rules: data fiduciaries, data processors, consent, the rights of data principals and the Data Protection Board, phased in to May 2027.

The DPDP Act and Rules set out notice and consent, certain legitimate uses, children's data, security safeguards, breach intimation, retention and erasure, rights and grievances, and the duties of Significant Data Fiduciaries. Start with DPDP Act Awareness for everyone who handles personal data, and give the implementation course to the DPO and the compliance team who build the programme.

The Philippine data privacy law, its 2016 Implementing Rules and Regulations and the National Privacy Commission's circulars and advisories.

The Data Privacy Act requires a data protection officer, security measures, privacy impact assessments, registration with the NPC where it applies and breach management, with penalties and administrative fines. Give the DPO course to the data protection officer or compliance officer for privacy, and the BPO courses to outsourced service teams.

The US rules for protecting health information: the Privacy, Security and Breach Notification Rules, for covered entities and business associates.

The HIPAA Security Rule lists security awareness and training among the administrative safeguards every covered entity and business associate must put in place, and the Privacy Rule requires training of the workforce on the entity's policies. US healthcare clients ask their vendors for evidence. Start with HIPAA Awareness for everyone who can see protected health information, and HIPAA Implementation for the privacy and security officers.

The payment card industry standard for anyone who stores, processes or transmits cardholder data, including service providers.

PCI DSS requirement 12.6 requires a formal security awareness programme, with training on joining and at least once a year, and awareness of phishing and social engineering. Assessors ask for the programme, the content and the records. Start with PCI DSS Awareness for every agent and employee in or near the cardholder data environment, and PCI DSS Requirements and Controls for the team that owns compliance.

Reporting on controls relevant to security, availability, processing integrity, confidentiality and privacy, against the Trust Services Criteria.

SOC 2 reports test controls against the AICPA Trust Services Criteria. The common criteria include the organisation's commitment to attract, develop and keep competent people and to communicate their responsibilities, which auditors test through training records and acknowledgements. Start with SOC 2 Awareness for all staff, and the Trust Services Criteria course for the control owners preparing for a Type 1 or Type 2 report.

The EU directive on cybersecurity risk management and incident reporting for essential and important entities.

NIS2, Directive (EU) 2022/2555, requires the management bodies of essential and important entities to follow cybersecurity training and to encourage regular training for employees, and lists basic cyber hygiene and training among the required risk-management measures. Management can be held personally responsible. Start with NIS2 Awareness for management and staff of in-scope entities and their key suppliers.

The EU Digital Operational Resilience Act for financial entities and their critical ICT third-party providers.

DORA, Regulation (EU) 2022/2554, has applied to EU financial entities since 17 January 2025. It requires ICT security awareness programmes and digital operational resilience training for all staff, including the management body, and extends expectations to critical ICT third-party providers. Start with DORA Awareness for staff of banks, insurers, investment firms, payment institutions and their ICT providers.

The US defence programme for protecting federal contract information and controlled unclassified information in the supply chain.

CMMC Level 2 for US defence contractors handling Controlled Unclassified Information aligns with the 110 requirements of NIST SP 800-171, which include an awareness and training family: security awareness for all users, role-based training, and awareness of insider threat. Assessors check the evidence for each. Start with Training on CMMC 2.0 and NIST SP 800-171 for the people preparing the system security plan and the assessment.

NIST's framework of outcomes across Govern, Identify, Protect, Detect, Respond and Recover, with profiles and tiers.

NIST CSF 2.0, published in February 2024, added a Govern function to Identify, Protect, Detect, Respond and Recover, and keeps awareness and training as a Protect category. Many organisations outside the US use it to structure and report their security programme. Start with NIST CSF 2.0 Training for security, IT and risk staff building a profile or reporting to the board.

The rules and frameworks for using and building AI responsibly: the EU AI Act and its AI literacy duty, NIST's AI risk framework and the AI management system standard.

Article 4 of the EU AI Act, applying since 2 February 2025, requires providers and deployers of AI systems to ensure a sufficient level of AI literacy among their staff. NIST AI RMF and ISO/IEC 42001 give the risk framework and the management system to govern AI. Start with AI Literacy for every employee who uses AI tools, EU AI Act Awareness for management, and the ISO/IEC 42001 and AI risk courses for the governance team.

The business continuity management standard, with business impact analysis and exercises that keep critical services running.

ISO 22301 requires competence and awareness for the people with business continuity roles, and regular exercising of continuity plans. Clients in financial services, outsourcing and critical supply chains increasingly ask for it, and regulations such as DORA expect tested continuity. Start with ISO 22301 Awareness for staff, and the implementation and business impact analysis courses for the continuity team.

The international standard for an IT service management system.

ISO/IEC 20000-1 is the service management system standard for IT service providers, internal IT functions and managed service providers. Its competence and awareness requirements apply to everyone who designs, delivers and improves services. Start with ISO/IEC 20000-1 Awareness for service desk, operations and service owners.