Yes, our training satisfies compliance requirements for both onboarding and recurring security awareness training, even though it is free. It is designed to meet the standards for frameworks like SOC 2, ISO 27001, HIPAA, and others.

This assigns Secureframe's built-in training to new users during onboarding.

The security awareness program should be reviewed at least once every 12 months.

The employee will receive an email notification when their training expires, and the task will become incomplete again in their onboarding flow.

All active employees and any contractors with access to customer data or production must complete the employee onboarding process, including accepting company policies, completing security training, and undergoing background checks.

Employees receive notifications (emails) when their training expires, prompting them to complete it again in their onboarding flow.

Yes, but it is no longer the recommended option. You can still choose ESET as the vendor in the onboarding settings, but we strongly encourage using Secureframe's built-in training for a smoother experience.

Security awareness training should include awareness about the acceptable use of end-user technologies in accordance with Requirement 12.2.1.

ESET Security Training was previously the default free vendor provided by Secureframe to satisfy compliance requirements for Security Awareness Training. It required users to create an account and verify their email. However, many users experienced issues accessing or completing the training.

Multiple methods of communication should be used.

Security awareness training should include awareness of threats and vulnerabilities that could impact the security of cardholder data and/or sensitive authentication data, including phishing and related attacks and social engineering.

The security awareness program should be updated as needed to address any new threats and vulnerabilities that may impact the security of the entity’s cardholder data and/or sensitive authentication data, or the information provided to personnel about their role in protecting cardholder data.

For additional guidance, refer to [Information Supplement: Best Practices for Implementing a Security Awareness Program](https://pcisecuritystandards.org/).

Relevant links:
- https://pcisecuritystandards.org/).
- https://pcisecuritystandards.org/

Our training modules are not scored. Instead, they are designed to ensure you arrive at the correct answers before completion. After you watch the training video, you’ll be prompted with questions:

Incorrect answers will be crossed out, and the dot next to the question will turn red.

Once you select the correct answer, the dot will turn green.

This approach makes sure every learner finishes the module with all correct answers.

Secureframe training videos are hosted on Vimeo, not YouTube. This error is usually a browser, extension, VPN, or network block of Vimeo, not a Secureframe account setting.

Check status.secureframe.com for a platform incident.

If status is clear, have the affected user try these steps:

Ask whether one user or many users are affected. Many users with clear status often points to a shared network, firewall, or ISP blocking Vimeo.

If the video still fails after a hotspot test, contact Support with the user email and the exact error text.

ttackers will typically disguise themselves and attempt to appear as a genuine or trusted source, directing personnel to send an email response, click on a web link, or enter data into a compromised website.

When developing anti-phishing controls, entities are encouraged to consider a combination of approaches.

See Requirement 5.4.1 for guidance on the difference between technical and automated controls to detect and protect users from phishing attacks.

See the following for more information about phishing: National Cyber Security Centre - Phishing Attacks: Defending your Organization (No valid URL provided) and US Cybersecurity & Infrastructure Security Agency - Report Phishing Sites (No valid URL provided).

It is recommended (but not required) that anti- phishing controls are applied across an entity’s entire organization.

Technical controls can limit the number of occasions personnel have to evaluate the veracity of a communication and can also limit the effects of individual responses to phishing.

Admins need to go into Personnel settings and switch the training provider to Other (Third Party). This will require employees to upload proof of training.

Reset clears the employee's Secureframe training completion so the task shows as not completed again. See Reset Security Awareness Training completion status for personnel.

When training is set to Other (Third Party), Secureframe does not host the training. The employee completes it on the external site, then proof must be recorded in Secureframe.

Reset does not automatically mark the task overdue. It becomes overdue only if a due date exists and that date passes before completion is recorded again.

Prefer the Data Room: upload the certificate or proof, assign it to the employee, and use the appropriate evidence type (for example Security Training).

You can also upload on the training Test → Evidence with Pass with Upload when you need the upload to satisfy that test's pass/fail status.

Data Room is for audit documentation and personnel linkage. Test upload is for evaluating the specific test. You may use both when your auditor expects documentation in the Data Room and the test still needs a passing evidence record.

Yes. Assigning manual training evidence in the Data Room marks the user's matching annual training as completed.

The completion date is the date the evidence is assigned or uploaded. Annual training becomes required again one year later.

Exception: new-hire security training stays complete based on any historical completion. It does not reopen on the same annual cycle.

Yes. Uploading new-hire training evidence also completes that user's standard annual security-awareness training.

Both show complete at first. After one year, annual training becomes due again. New-hire training stays complete.