Training, Competence & Attestation Records
Proves the right people were trained and understood.
Overview
Separate from phishing simulation: this is the evidence layer. ISO 27001 splits competence (clause 7.2 — determine required skills by role, verify them) from awareness (clause 7.3), and SOC 2, HIPAA, PCI DSS and CMMC all test that named people completed named training by a date. The failure is almost never that training did not happen; it is that the completion record, the role-to-requirement mapping and the evidence for leavers and contractors live in three systems that disagree. Consolidating training records, policy acknowledgements and phishing results into one audit trail is what turns three exports into one.
Every framework tests it, and it is the cheapest evidence gap to close.
Advantages
- One export covers the human side of an ISMS instead of three that disagree
- Role-based requirements catch the developer who needed secure-coding training and never got it
- Competence records satisfy ISO 27001 clause 7.2, which pure awareness tools do not address
- Automatic assignment on joining and role change removes the manual tracking that always slips
- Completion evidence with dates and named individuals is exactly what assessors sample
Trade-offs
- Completion is not competence; a click-through record proves attendance, nothing more
- General-purpose LMS platforms handle security content poorly and vice versa
- Contractors and third parties are routinely outside the HR system and therefore outside the record
- Annual refresh cycles create a compliance rhythm rather than a learning one
- Buying a second platform for records when the LMS already holds them duplicates the truth
Open-source option
Moodle is a mature, genuinely capable open-source LMS with completion tracking, certification and reporting, and it is widely used for exactly this. What it does not do is map a course to a control in your framework or produce evidence in the shape an assessor expects, so you bridge that gap with exports and manual mapping.
Vendors & tools in this area
Awareness training, phishing simulation, and policy/privacy compliance management in one platform.
Visit site →Training and competence records joined to controls and roles.
Visit site →