OBL-03 · Obligations and Compliance
Training and awareness
People receive role-relevant training on joining and at a defined cadence, and completion is evidenced.
7frameworks fully address it
1partially
0leave it out
SOC 2 ISO 27001 NIST CSF PCI DSS HIPAA GDPR EU AI Act NIST AI RMF
1Where each framework asks for it
- SOC 2FullCC1.4
- ISO 27001FullA.6.3
- NIST CSFFullPR.AT-01
- PCI DSSFull12.6.3
- HIPAAFull164.308(a)(5)
- GDPRPartialArt. 39(1)(b) Awareness raising is a DPO task where a DPO exists.
- EU AI ActFullArt. 4
- NIST AI RMFFullGOVERN 2.2
Build the control once against this objective and cite the clause each auditor asks about. A partial mapping says what the framework leaves out; an absence is a finding about the framework, not a gap in your program.
2What usually proves it
Assignment records, completion evidence, content version.
?Why it exists
Awareness that leaves no record cannot be shown to have happened.
For a smaller organizationAnnual awareness plus a short induction module.