Compliance
Security awareness training requirements by framework
SEBI CSCRF, RBI, HIPAA, DPDP, SOC 2 and ISO 27001 each treat awareness training differently. Some name clauses and cadences, and some leave the method to you.
Phishing simulation helps with all of them. It lets you show that people were trained and that they were tested with realistic attacks, it is faster than chasing a long course, the lesson is short and arrives right after the click, and the reports serve as evidence. The texts rarely name simulation as mandatory (SEBI CSCRF cites phishing test success rate as an example of assessing awareness), and each page says exactly what its text asks for.
Each page below sets out what the framework asks for, with clause numbers and sources, why phishing simulation helps, and the evidence SecurityRing gives you.
Last reviewed 10 October 2026 against the official texts. Not legal advice.
Frameworks
Pick your framework for the details
| Framework | Who it applies to | What it asks on awareness training | What the text says about phishing simulation |
|---|---|---|---|
| SEBI CSCRFSEBI Cybersecurity and Cyber Resilience Framework (CSCRF) | SEBI regulated entities, graded in five tiers | Mandatory periodic awareness programmes (PR.AT); assess employee awareness (GV.RM) | Cited as an example: “phishing test success rate” assesses awareness (GV.RM); not mandated by name |
| RBIRBI cybersecurity, technology risk, resilience and assurance Directions, 2026 | Banks, NBFCs, urban co-operative banks, AIFIs and credit information companies, each under its own 2026 Directions | Evaluate employee awareness periodically; training programmes; NBFCs also measure effectiveness and keep records | Not named; no method prescribed. NBFCs must test or assess training effectiveness (¶36) |
| HIPAAHIPAA Security Rule, 45 CFR §164.308(a)(5) | US covered entities and their business associates | Security awareness and training programme for the whole workforce (§164.308(a)(5)) | Not mentioned; simulation can support the addressable specifications |
| DPDPDigital Personal Data Protection Act, 2023 and DPDP Rules, 2025 | Data Fiduciaries processing personal data in India or for people in India | Reasonable security safeguards and organisational measures; training is not named | Not mentioned; training is not named either |
| SOC 2SOC 2 Trust Services Criteria (AICPA) | Service organisations with a SOC 2 examination | CC2.2 point of focus: a security awareness training programme | Not named; points of focus are guidance |
| ISO 27001ISO/IEC 27001:2022 | Organisations with an ISMS, usually seeking certification | Awareness (7.3), competence evidence (7.2), Annex A 6.3 awareness, education and training | Not named; method is yours to justify (clause 7.2 asks you to evaluate effectiveness) |
PCI DSS, NIST CSF and GDPR are summarised in the compliance table on the security awareness training page; they do not have their own page yet.
Evidence from SecurityRing
The same outputs support every framework
SecurityRing gives you evidence for, and helps you demonstrate, the awareness-training part of each framework. These are the real outputs. They are not mapped to clause numbers, so your GRC team cites which output supports which clause.
- Campaign report. For each campaign: sent, opened, clicked, video completed and training completed, time to action, results by department, location, seniority and manager cohort, repeat exposure and recommended follow-up.
- Completion records. A per-person roster for each campaign, with drill-downs, showing who was phished, who finished the lesson and when. The lesson goes to people who act on a simulation, so this is not a record of training for your whole workforce.
- Executive trend report. Across campaigns over a six-month lookback: phishing exposure score, trends by department and senior management, response speed and a 30-day action plan.
- Audit trail. A dated interaction audit trail for each campaign: what each recipient did and when.
- PPT, PDF and CSV export. Download the campaign and executive trend reports as PPT, PDF or CSV for your auditor, or present them on screen.
This page is a plain-language summary for GRC teams, not legal advice. SecurityRing gives you evidence for the awareness-training part of a framework and helps you demonstrate it. Using SecurityRing does not make you compliant, it is not a certification, and no regulator or standards body endorses it. Your auditor or regulator decides whether the evidence is enough.
SecurityRing’s own security posture. SecurityRing is ISO 27001:2022 certified, SOC 2 ready and GDPR compliant. SOC 2 ready means we are preparing for a SOC 2 audit; we do not yet hold a SOC 2 report. See the Trust Center.
Which security awareness training requirements does SecurityRing give evidence for?
SEBI CSCRF, RBI’s cybersecurity directions, the HIPAA Security Rule, the DPDP Act, SOC 2 and ISO/IEC 27001. Each page quotes or paraphrases what the clause says, explains why phishing simulation helps and what the text says about it, and lists the SecurityRing outputs that line up with it. PCI DSS, NIST CSF and GDPR are in the table on the security awareness training page.
Why does phishing simulation help with these frameworks, and does any of them require it?
Simulation lets you show that people were trained and that they were tested, it is faster than chasing a long course, the lesson is short and arrives right after the click, and the reports serve as evidence alongside your other records. None of the six texts names it as a requirement. SEBI’s CSCRF comes closest: it gives “phishing test success rate” as an example of how to assess employee awareness. RBI asks NBFCs to measure training through “periodic assessments or testing”. HIPAA, DPDP, SOC 2 and ISO 27001 ask for awareness or training without prescribing simulation, so the method is your choice and your auditor’s call.
Does using SecurityRing make us compliant?
No. SecurityRing gives you evidence for, and helps you demonstrate, the awareness-training part of these frameworks. It is not a certification, no regulator or standards body endorses it, and your auditor or regulator decides whether the evidence is enough. These pages are not legal advice.
How we check these pages
Last reviewed 10 October 2026. For each framework we read the official text (for ISO/IEC 27001, which is licensed, a copy of the standard), quoted the wording that matters with its clause or paragraph number, and listed the sources at the bottom of its page. Where the text does not name training or phishing simulation, the page says so. Regulators amend these texts, so check the live source before you rely on a clause.
- SEBI CSCRF: SEBI Cybersecurity and Cyber Resilience Framework (CSCRF)
- RBI: RBI cybersecurity, technology risk, resilience and assurance Directions, 2026
- HIPAA: HIPAA Security Rule, 45 CFR §164.308(a)(5)
- DPDP: Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
- SOC 2: SOC 2 Trust Services Criteria (AICPA)
- ISO 27001: ISO/IEC 27001:2022
Bring your framework. See the evidence.
Tell us which regulator or auditor you answer to and we will show the campaign report, completion records and executive trend report your reviewer would read.