<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: building-compliance-training-programs
description: >-
  Design, deploy, and measure regulatory compliance training programs covering security, privacy, and industry-specific requirements. Covers LMS integration, competency-based assessments, role-based curricula, audit evidence generation, and training effectiveness metrics aligned to SOX, PCI DSS, HIPAA, and GDPR mandates.
domain: cybersecurity
subdomain: governance-risk-compliance
tags:
  - compliance-training
  - LMS
  - competency-assessment
  - regulatory-training
  - audit-evidence
  - role-based-curriculum
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  nist-csf:
  - "PR.AT-1"
  - "PR.AT-2"
  - "PR.AT-3"
  - "PR.AT-5"
  - "GV.AT-1"
  frameworks:
  - "NIST SP 800-50"
  - "SOX"
  - "PCI DSS 4.0"
  - "HIPAA"
  - "GDPR"
  mitre-attack: []
---

# Building Compliance Training Programs

## Overview

Compliance training programs translate regulatory mandates into measurable
learning outcomes. Beyond checkbox compliance, effective programs use competency-based
assessments, role-specific curricula, spaced repetition, and behavioral metrics
to demonstrate genuine risk reduction to auditors and regulators.

## Workflow

1. **Regulatory Mapping** — Identify all applicable training requirements from regulations and frameworks
2. **Audience Segmentation** — Define role-based training tracks with prerequisite chains
3. **Curriculum Development** — Design competency-based modules with measurable learning objectives
4. **LMS Configuration** — Deploy training content with automated enrollment, reminders, and escalation
5. **Assessment Design** — Create pre/post assessments with passing thresholds and retry policies
6. **Delivery Scheduling** — Establish training cadence aligned to regulatory requirements (annual, quarterly, on-hire)
7. **Evidence Collection** — Generate audit-ready completion records with timestamps and assessment scores
8. **Effectiveness Measurement** — Track behavioral changes, incident correlation, and knowledge retention

## Key Concepts

### Regulatory Training Requirements

| Regulation | Requirement | Frequency | Evidence |
|-----------|-------------|-----------|---------|
| PCI DSS 4.0 (12.6) | Security awareness for all personnel | Annual + on-hire | Completion records |
| HIPAA (§164.308) | Security and privacy training | Annual + on-hire | Training logs |
| SOX (§404) | Internal control awareness | Annual | Attestation records |
| GDPR (Art. 39.1.b) | Data protection training | Regular | DPO training plan |
| GLBA (§501) | Safeguards awareness | Ongoing | Program documentation |
| CMMC (Level 2) | CUI handling training | Annual | Assessment records |

### Competency Assessment Framework

| Level | Description | Assessment Method |
|-------|-------------|------------------|
| Knowledge | Recall facts and concepts | Multiple choice quiz |
| Comprehension | Explain concepts in context | Scenario-based questions |
| Application | Apply knowledge to new situations | Simulations and labs |
| Analysis | Break down complex scenarios | Case study analysis |
| Evaluation | Judge and justify decisions | Tabletop exercises |

### Training Effectiveness Metrics

| Metric | Measurement | Target |
|--------|-------------|--------|
| Completion Rate | Completed / Assigned × 100 | > 95% |
| Assessment Pass Rate | Passed / Attempted × 100 | > 85% |
| Knowledge Retention | 90-day re-assessment score | > 80% |
| Behavioral Change | Incident rate pre/post training | > 20% reduction |
| Time-to-Completion | Median days from assignment | < 14 days |
| Satisfaction Score | Post-training survey (1-5) | > 4.0 |

## Detection Opportunities

### Training Program Compliance Gaps

- **Overdue enrollments**: employees past regulatory training deadline create audit findings
- **Low assessment scores**: systemic low scores indicate content or delivery problems
- **Missing role coverage**: specialized roles without role-specific training tracks
- **Evidence gaps**: training completions without verifiable timestamps or assessment records
- **MITRE mapping**: T1204 (User Execution), T1566 (Phishing), T1078 (Valid Accounts)


