Security awareness training requirements: 6 US rules compared

The short answer: No single US law makes every employer run this training. The security awareness training requirements come from sector rules. PCI DSS 12.6 and NYDFS 500.14 require training at least every 12 months and name social engineering (PCI names phishing too). The FTC Safeguards Rule, HIPAA and CMMC Level 2 require a program but leave the schedule to you. Federal agencies must reach every system user at least annually.

To deliver and evidence that training, our top pick is LMS Advisor: it assigns your courses with due dates and mandatory flags, flags overdue people, scores quizzes, issues certificates that expire and keeps audit logs. It doesn't sell a phishing course library, so you bring your own or a content provider's SCORM courses.

The six overlap more than they differ. A New York-licensed bank that takes card payments, or a health system with a defense research contract, can usually cover everything with one annual program plus a few role-based add-ons. Below: each rule in its own words (sources checked September 2026), a comparison table and the evidence auditors ask for. It's a practitioner's map, not legal advice, so confirm the current text and ask counsel about edge cases.

Which US rules require security awareness training?

These six come up again and again when compliance, security and L&D teams scope a program:

1. PCI DSS v4.0.1, requirement 12.6. Any organization that stores, processes or transmits payment card data.
2. NYDFS 23 NYCRR 500.14(a)(3). Banks, insurers and other companies licensed by the New York Department of Financial Services.
3. FTC Safeguards Rule, 16 CFR 314.4(e). The Gramm-Leach-Bliley Act rule for financial institutions under FTC jurisdiction.
4. HIPAA Security Rule, 45 CFR 164.308(a)(5). Covered entities and business associates that handle electronic protected health information.
5. CMMC Level 2, AT practices 3.2.1 to 3.2.3. Defense contractors that handle Controlled Unclassified Information (CUI) and whose contracts call for Level 2.
6. 5 CFR 930.301. Federal executive agencies and their employees.

PCI DSS and NYDFS spell out a frequency and specific topics. The FTC, HIPAA and CMMC rules describe outcomes and leave the schedule to you, which means more judgment calls and more paperwork to back them up. The federal rule sets an annual floor.

How do the six security awareness training requirements compare?

Rule	Who must be trained	How often	Required content	Evidence that holds up
PCI DSS 12.6	All personnel	Upon hire and at least once every 12 months	Security policy and each person's role, phishing and related attacks, social engineering, acceptable use of end-user technologies	Completion dates per person, annual policy acknowledgment, program review every 12 months, proof of multiple communication methods
NYDFS 500.14(a)(3)	All personnel	Periodic, at a minimum annual	Social engineering, updated to reflect risks in your risk assessment	Completion records, content tied to the risk assessment, support for the April 15 annual filing
FTC Safeguards Rule 314.4(e)	Personnel, plus extra training for security staff	Not fixed. Updated as risks change	Awareness updated to reflect risks identified by the risk assessment	Training records, link between content and risk assessment, security staff training
HIPAA 164.308(a)(5)	All workforce members, including management	Not fixed	Addressable specs: security reminders, malicious software, log-in monitoring, password management	Written program, training records, decisions on each addressable spec, kept 6 years
CMMC Level 2 (AT)	Managers, system administrators and users, with role-based training for security duties	Not fixed. Organization defines it	Security risks and policies, role-based duties, recognizing and reporting insider threat indicators	Training records by role, content mapped to each practice, evidence an assessor can sample
5 CFR 930.301	All federal information system users, with role-specific tracks	Before system access, then at least annually	Awareness per NIST guidance, role-specific training for executives, managers and IT security staff	Agency training plan, completion before access, annual completion records

PCI DSS is the most prescriptive row, and a program built to pass it covers most of the other five. The usual gaps: insider threat content (CMMC), a written link between training and the risk assessment (NYDFS and the FTC rule), and role tracks for admins and security staff (CMMC, FTC and federal).

1. What does PCI DSS requirement 12.6 require?

Version 4.0.1 is the current standard in the PCI Security Standards Council's document library. The Council published v4.0.1 in June 2024 and retired v4.0 on December 31, 2024. The 51 future-dated requirements took effect March 31, 2025, so every part of 12.6 is live.

It opens with a principle, "Security awareness education is an ongoing activity," then gets specific:

• 12.6.1: "A formal security awareness program is implemented to make all personnel aware of the entity's information security policy and procedures, and their role in protecting the cardholder data."
• 12.6.2: The program is reviewed at least once every 12 months and updated as needed for new threats and vulnerabilities that could affect the cardholder data environment (CDE) or what personnel are told about their role.
• 12.6.3: "Personnel receive security awareness training as follows: Upon hire and at least once every 12 months. Multiple methods of communication are used. Personnel acknowledge at least once every 12 months that they have read and understood the information security policy and procedures."
• 12.6.3.1: Training covers threats and vulnerabilities that could affect the CDE, "including but not limited to" phishing and related attacks and social engineering.
• 12.6.3.2: Training covers "the acceptable use of end-user technologies in accordance with Requirement 12.2.1."

"All personnel" is broad. In a retailer, it means the part-time cashier as much as the network engineer, and contractors with CDE access count too.

Where PCI training programs fail an assessment

When a 12.6 program gets into trouble, the cause is usually the records, not the course:

• The 12-month clock drifts. Someone finishes on October 20 one year and November 15 the next. That's almost 13 months, which misses "at least once every 12 months." Set due dates a month early.
• No acknowledgment. A course completion doesn't prove someone read and understood the security policy. Keep a separate, dated acknowledgment with the training record.
• One channel only. The standard asks for multiple methods of communication. Add email reminders, team briefings or posters to the annual course, and keep dated copies.
• New hires trained late. "Upon hire" comes with no day count, so don't hand your assessor an argument. Assign the course in week one, not with the next quarterly batch.
• Stale content. 12.6.2 expects an annual program review. Keep a dated note of what changed and why.

2. What does NYDFS Part 500.14 require for training?

New York's cybersecurity regulation, 23 NYCRR Part 500, was substantially amended in November 2023. Section 500.14(a)(3) now requires covered entities to:

"provide periodic, but at a minimum annual, cybersecurity awareness training that includes social engineering for all personnel that is updated to reflect risks identified by the covered entity in its risk assessment"

Annual is the floor. If your risk assessment flags business email compromise or vishing against call center staff, quarterly refreshers for those groups are easier to defend.

Social engineering is named. That means phone pretexting, fake vendor bank-change requests and help desk password-reset scams, not only suspicious email links.

Content has to follow your risk assessment. Generic off-the-shelf courses miss this. An examiner can fairly ask how this year's training reflects the risks you found, so keep a short mapping: risk, training topic, date updated.

Who counts as a covered entity, and are small firms exempt?

A covered entity is anyone operating, or required to operate, under a license, registration, charter or similar authorization under New York's Banking Law, Insurance Law or Financial Services Law. That pulls in plenty of insurance agencies and brokers, not only big banks.

Section 500.19(a) gives a limited exemption to firms that meet any one of three tests: fewer than 20 employees and independent contractors, under $7.5 million in gross annual revenue in each of the last three fiscal years, or under $15 million in year-end total assets (affiliates count as the rule defines). The exemption lists 500.14(a)(1), (a)(2) and (b), but not (a)(3). Small covered entities still owe the annual training.

Training records also feed the annual filing. Under 500.17(b), covered entities certify material compliance, or acknowledge noncompliance, by April 15 for the prior calendar year. Patchy completions on December 31 become a problem for whoever signs in April.

HIPAA, CMMC, GLBA and federal rules in brief

These four are less prescriptive, and each fits inside a PCI or NYDFS-grade program with small additions.

3. FTC Safeguards Rule (GLBA): 16 CFR 314.4(e)

The Safeguards Rule requires financial institutions under FTC jurisdiction to provide "your personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment." Security staff must also get updates and training sufficient for the risks they manage. No frequency is set. Annual training tied to the written risk assessment fits the wording, and the Qualified Individual's annual board report (314.4(i)) is a natural place to show training status.

4. HIPAA Security Rule: 45 CFR 164.308(a)(5)

The HIPAA administrative safeguards require covered entities and business associates to "implement a security awareness and training program for all members of its workforce (including management)." Four implementation specifications follow, each marked addressable: security reminders (periodic security updates), protection from malicious software, log-in monitoring and password management.

Addressable doesn't mean optional. You assess whether each is reasonable and appropriate, then implement it or document your alternative. HIPAA sets no interval, so most organizations train at hire and annually. Documentation must be kept for 6 years from creation or the date last in effect, whichever is later. One caveat: HHS has proposed a Security Rule overhaul that would make nearly all implementation specifications required. It wasn't final as of September 2026, so check its status before you rewrite policy.

5. CMMC Level 2: AT.L2-3.2.1 to 3.2.3

The CMMC Level 2 Assessment Guide (version 2.13, September 2024) includes three awareness and training practices taken from NIST SP 800-171 Rev. 2:

• AT.L2-3.2.1, role-based risk awareness: managers, system administrators and users "are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems."
• AT.L2-3.2.2, role-based training: personnel are trained "to carry out their assigned information security-related duties and responsibilities."
• AT.L2-3.2.3, insider threat awareness: "Provide security awareness training on recognizing and reporting potential indicators of insider threat."

There's no fixed frequency. DIB SCC CyberAssist guidance says organizations set content and frequency based on their needs and the systems people can access. Most contractors pick annual and write it into policy. Check your course for insider threat content, which general awareness courses often skip.

6. Federal employees: 5 CFR 930.301

Under 5 CFR 930.301, each executive agency needs a security awareness and training plan. All users of federal information systems must see awareness materials at least annually, new employees get them before system access, and executives, managers and IT security staff get role-specific training. OPM's federally mandated training list shows IT security awareness as annual, plus insider threat awareness within 30 days for employees with classified access.

States add their own layer for the public sector. Texas, for example, requires state and local government employees, officials and state contractors with system access to finish a certified cybersecurity training program every year. If you work in or for government, check your state's current rule.

How can one program satisfy several rules at once?

Build to the strictest version of each element, then add role tracks. If two or more of these rules apply to you, here's the design we'd use:

1. Timing: assign the core course during the first week and before system access (this covers PCI "upon hire" and the federal "before access" rule), then every 12 months with the due date set at 11 months.
2. Core content: your security policy and each person's role, phishing and related attacks, social engineering beyond email, acceptable use of devices and apps, malicious software, password and passkey practices, and how to report an incident.
3. Insider threat module: short, with recognizing and reporting indicators as the explicit objective. It satisfies CMMC 3.2.3 and fits every other rule.
4. Role tracks: extra modules for system administrators, security staff, managers and anyone with cardholder data or CUI access (CMMC 3.2.2, the Safeguards Rule's security staff clause and the federal role tiers).
5. Risk-assessment mapping: a one-page table linking each risk in your latest assessment to a training topic. NYDFS and the FTC rule both key content to the risk assessment, and the table proves your content isn't generic.
6. Annual policy acknowledgment: a separate, dated step for PCI 12.6.3.
7. Reminders between courses: short monthly or quarterly security reminders by email, chat or team huddle. These count toward HIPAA's security reminders and PCI's multiple communication methods.
8. Annual program review: a written note each year saying what you reviewed, what changed and who approved it.

The trade-off: some people get training their rule doesn't strictly require. We're fine with that. One program with one due date is easier to run and defend than four overlapping cycles.

Still choosing where the program will live? Our roundup of the best LMS for compliance training compares platforms on the record keeping auditors actually test.

What evidence should you keep for each rule?

Auditors sample. They pick names and ask you to prove each person was trained on time, on the right content.

Evidence item	PCI DSS	NYDFS	FTC Safeguards	HIPAA	CMMC L2	Federal
Per-person completion date	Yes	Yes	Yes	Yes	Yes	Yes
Hire or access date next to first training	Yes	Helpful	Helpful	Helpful	Yes (role-based)	Yes (before access)
Course version and content outline	Yes	Yes	Yes	Yes	Yes	Yes
Annual policy acknowledgment	Yes	Helpful	Helpful	Helpful	Helpful	Agency policy
Risk assessment to content mapping	Helpful	Yes	Yes	Helpful	Helpful	Helpful
Role roster and role track records	Helpful	Helpful	Yes (security staff)	Helpful	Yes	Yes
Reminders and other communications sent	Yes	Helpful	Helpful	Yes (if implemented)	Helpful	Helpful

"Yes" means the rule's wording points straight at it. "Helpful" means it's the easiest answer to a follow-up question (our reading, not an auditor's checklist). HIPAA's 6-year documentation clock is the longest explicit one here, so many multi-rule programs keep everything for 6 years. Our guide to training records retention requirements covers the clocks rule by rule.

One more tip: export a dated completion report at the end of each cycle and store it outside the LMS, so you can show the numbers as they stood on the day you certified.

Why we run this program in LMS Advisor

LMS Advisor is our platform, so weigh that, but here is why we'd put a multi-rule awareness program in it. The eight design steps above map almost one to one onto screens it already has:

Program step	How it runs in LMS Advisor
Timing and the 11-month due date	Organization course assignments with a due date and a mandatory flag, plus an overdue report that shows who is late before the auditor does
Core and insider threat content	Your own or licensed courses uploaded as SCORM, xAPI or cmi5 packages, with a scored quiz at the end so completion means more than a click-through
Role tracks	Admins, security staff and card-handling teams set up as their own organizations, departments or groups, each with its extra modules assigned
Annual policy acknowledgment	A short separate course with the policy text and a block marked required, so the acknowledgment gets its own dated completion
Annual cycle	Course certificates with a validity period in months. An 11-month certificate turns "expiring soon" 30 days out, can trigger a certificate-expiring email and renews when the person retakes the course (see certificate validity and renewal)
Roster and evidence	SAML SSO and SCIM provisioning keep the roster in step with your identity provider, and audit logs plus CSV, Excel or PDF exports give you the dated completion report to file each cycle

The limits, plainly. We don't sell a content library or run phishing simulations. For simulated phishing with click tracking, a dedicated security awareness platform is the better tool, and plenty of teams run one alongside LMS Advisor. Your risk assessment and the reminders between courses stay with you too.

The compliance training software page shows the full setup. Mapping one program across PCI, NYDFS and the rest? Book a demo and bring your current course package, and we'll show you how the assignments and certificates would look.

Frequently asked questions

What is the best LMS for security awareness training in 2026?

For a program that owns its content and has to prove it to auditors, we recommend LMS Advisor. It runs your SCORM, xAPI or cmi5 courses with due dates, mandatory flags, overdue reports, scored quizzes, expiring certificates and audit logs, in our cloud or on your own server. It has no ready-made security course library or phishing simulator, so pair it with a content provider and, if you want simulations, a phishing tool.

Is security awareness training required by law in the US?

Yes, for many organizations, but through sector rules rather than one general law. NYDFS Part 500, the FTC Safeguards Rule, HIPAA and 5 CFR 930.301 are regulations. PCI DSS is a contractual industry standard, and CMMC is a DoD program (32 CFR part 170) applied through defense contracts.

How often is security awareness training required for PCI DSS?

Upon hire and at least once every 12 months, under PCI DSS 12.6.3. Personnel must also acknowledge the security policy every 12 months. Set due dates a little early, because a completion at 12 months and two weeks misses the requirement.

Does NYDFS require annual cybersecurity training?

Yes. Section 500.14(a)(3) requires "periodic, but at a minimum annual" awareness training for all personnel, including social engineering and updated to reflect your own risk assessment. The small business exemption in 500.19(a) does not cover it.

Is phishing training required by law?

Not by one general law, though phishing content is required in places. PCI DSS 12.6.3.1 names phishing, and NYDFS 500.14(a)(3) requires social engineering training, which covers it. None of the six rules here requires simulated phishing tests by name, so simulations are a program choice.

What security training does CMMC Level 2 require?

Three awareness and training practices: risk awareness for managers, administrators and users (AT.L2-3.2.1), role-based training for security duties (AT.L2-3.2.2) and insider threat awareness (AT.L2-3.2.3). No frequency is fixed, so most contractors set an annual cycle in policy.

Does HIPAA require annual security training?

No, the current HIPAA Security Rule sets no interval. It requires a program for the whole workforce, including management, with addressable specs such as periodic security reminders. Annual training plus reminders is the common approach, but a pending HHS proposal could change the rule.