Security awareness training for audits and standards
ISO 27001, SOC 2, PCI DSS, HIPAA and UK GDPR all expect staff to get security awareness training on the right topics, at the right times, with records to show it. Our story courses and LMS records support that requirement. They do not pass an audit on their own: organisations are audited, not videos.
Available now
The UK and US edition is a new library made for UK and US teams: 40 story courses and 12 standards courses (onboarding, how to report, acceptable use, HIPAA, PCI DSS and others), 52 in all, all finished. Each edition has a local cast, offices, names and spelling, in UK or US English. UK GDPR content is in the UK edition only; US privacy and HIPAA are in the US edition only.
The five standards at a glance
ISO 27001
| Who it applies to | Any organisation audited against ISO 27001 (UK, US, worldwide) |
|---|---|
| The training clause | 7.2, 7.3 and Annex A 6.3 |
| When (as the text says) | Not quoted here (the text is sold) |
| How we describe our part | Supports the awareness training requirement of ISO 27001 (A.6.3) |
SOC 2
| Who it applies to | US service companies whose customers ask for a SOC 2 report |
|---|---|
| The training clause | CC1.4, CC2.2 |
| When (as the text says) | No interval we can quote; auditors usually test at hire and yearly |
| How we describe our part | Maps to the SOC 2 criteria CC1.4 and CC2.2 (all-staff awareness) |
PCI DSS
| Who it applies to | Any organisation that stores, processes or transmits payment card data |
|---|---|
| The training clause | 12.6 (12.6.1 to 12.6.3.2) |
| When (as the text says) | When people join, then at least every 12 months |
| How we describe our part | Maps to PCI DSS 12.6 |
HIPAA
| Who it applies to | US covered entities and their business associates |
|---|---|
| The training clause | 45 CFR 164.308(a)(5) |
| When (as the text says) | No fixed interval: “Periodic security updates.” |
| How we describe our part | Supports the security awareness and training standard of the HIPAA Security Rule (45 CFR 164.308(a)(5)) |
UK GDPR
| Who it applies to | Every organisation that processes personal data in the UK |
|---|---|
| The training clause | Article 39(1)(b); ICO guidance |
| When (as the text says) | ICO: induction within one month; refreshers at appropriate intervals |
| How we describe our part | Supports the staff training that UK GDPR (Article 39(1)(b)) and ICO guidance describe |
What our courses and LMS give you today
- Assignments: give courses to teams or people and see who finished.
- A scenario quiz after every course: 10 questions from a bank of 13 to 15, pass mark 80, a score for each learner.
- A certificate for every learner who passes.
- One space per client, and your own report method and security contact on the last screen of each course.
- The full transcript of every course on its course page, as a copy of the training material.
What stays your job
- Role-based and specialist training (security team, incident responders, developers, the data protection officer).
- Your own policies, and a record that each person has read and accepted them (policy acknowledgement): not an LMS feature today.
- Practical exercises such as phishing simulations: not in our offer.
- Short security reminders between courses: not in our offer today.
- Reviewing your programme every year, and keeping your own copy of the records for as long as your rules ask.
The new UK and US library
Available now
The UK edition: a new security awareness library for UK teams
A library of 50 finished animated story courses made for UK teams: British cast and settings, UK English and spelling, UK law in its own track.
Available now
The US edition: a new security awareness library for US teams
A library of 51 finished animated story courses made for US teams: American cast and settings, US English and spelling, US law in its own track.
Questions people ask
Will these courses get us through an audit?
Not on their own. Auditors look at your whole programme: policies, timing, records and role-based training. Our courses and LMS records are the all-staff awareness part of that evidence.
Are the UK and US courses available?
Yes. All 52 courses are finished, in UK and US English, each with a scenario quiz and captions. Ask us for a demo or a price.
Do you run phishing simulations?
No. Our quizzes test what people understood from each story, but practical exercises such as phishing simulations are not in our offer.
Why are there quotes for HIPAA and UK GDPR but not for the others?
HIPAA and UK GDPR are public law and guidance, and we checked every quote word for word against the official text. ISO 27001, SOC 2 and PCI DSS are sold or licensed, so we give clause numbers only.
Last updated: 2026-10-16. These pages explain how our training relates to each standard; they are not legal advice.