Blog · Training evidence · Problem 9 of 93
The customer wants proof every employee did security training this year.
· 2 min read · By Case Jones
An enterprise buyer, or their auditor, asked for evidence of annual security awareness training: who completed it, when, and on what. You ran a session in the spring. Some people were on holiday, two have joined since, and nobody kept a list.
What it costs to leave it
“We did training” without a record reads as “we didn’t”. The request usually comes with a deadline, and chasing signatures afterwards is slow, awkward and easy to get wrong.
How to produce training evidence people trust
Evidence of training is a list with names, dates and the material each person completed. The hard part is keeping it current as people join and policies change.
- 1
Decide what the training covers
Name the policies and topics: acceptable use, passwords and MFA, phishing, data handling, incident reporting. Keep the material dated and versioned so the record can say exactly what was completed.
- 2
Record completion per person
For each employee: the material, the version, the date completed and, ideally, an acknowledgement that they read and understood it. A spreadsheet works if someone keeps it up to date.
- 3
Cover new hires and changes
Give new hires a deadline, often 30 days, and retrain when a policy changes. Most gaps in training records come from people who joined after the annual session.
- 4
Show understanding, not just attendance
A short quiz or a few questions per policy turns “clicked through” into “understood”. Reviewers value a score more than a signature.
- 5
Send a clean report
Share a dated report: everyone in scope, what they completed, when, and any exceptions with a reason. Don’t send raw logs; send the answer to the question asked.
Example
One line of a good training record
Pat Lee · Acceptable Use Policy v3 · listened in full and acknowledged 14 March · quiz 9 of 10 · Information Security Policy v5 · acknowledged 15 March.
Or let 93 Compliance keep the record
Each policy becomes a short audiobook (spoken and/or sung) and study games, written only from your document. Employees listen in the 93 app or on the web, on a commute or a walk.
The record per employee shows how much they heard, which version they acknowledged and when, and their game scores, with requirements, onboarding and change deadlines and automatic reminders. Export it as CSV or PDF for the customer.
Training records are $10 per employee per year, the same for 5 or 1,000 people. The policy builder and everything else are free.
- Audiobooks and study games from your own policies
- Version, acknowledgement and score per employee
- Deadlines for new hires and policy changes
- CSV or PDF report for the customer
Start free
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
Is a video course enough evidence?
Only with a completion record per person, tied to a date and the material’s version. A course nobody can prove was finished doesn’t help.
How often should training happen?
Most customers and frameworks expect it at hire and at least once a year, plus whenever an important policy changes.
Do contractors need training too?
If they can reach your systems or customer data, usually yes. Customers often ask about contractors specifically.