PR.AT-01 General awareness and training: evidence and audit

What PR.AT-01 asks for and why assessors care about it

If you are a compliance lead or CISO, you need to show that everyone with access to your systems and data has received general cybersecurity awareness and training. PR.AT-01 is the NIST CSF 2.0 Subcategory that sets that outcome: personnel receive awareness and training so they can perform general tasks with cybersecurity risk in mind. It sits in the Awareness and Training (PR.AT) Category of the PROTECT Function. The risk behind it is well understood: social engineering, such as phishing, pretexting and fraudulent payment requests, works because people act on a message before anyone checks it, and attacks often go unreported when staff do not recognize them or do not know whom to tell. NIST describes the outcome without prescribing a product, course format or frequency, so the organization decides how to meet it and must be able to explain that choice. The Subcategory also carries forward CSF 1.1 PR.AT-1 under the same identifier, so organizations that assessed against the earlier version can trace their existing training evidence directly into it.

The difficulty is practical rather than conceptual. Coverage has to reach every employee, contractor, partner and supplier user, including people who join, change roles or leave during the year, and an assessor will ask whether the population in your training records matches the population in your identity provider and HR system. Attendance is the easiest thing to prove and the least persuasive. An assessor will look for evidence that people changed behavior: that they recognize a lure, that they know the reporting channel, and that the reporting channel receives and acts on what staff send. Confirm with your assessor whether they expect knowledge checks, simulated phishing results or incident reports to show that behavior, and agree on the population and review period before the evidence is collected.

Start by writing down the decisions NIST leaves to you: which audiences need which content, how understanding will be tested, how often training is refreshed, and how staff report suspicious activity. Then check that each decision leaves a record you can export, such as completion timestamps, quiz scores, reporting tickets and the policy acknowledgments that show people were told the consequences of violations. Ask your current training vendor or platform team to confirm which of these records they can produce and in what format. Gaps found now are cheaper to close than gaps found during an assessment. NIST's CSF 2.0 Core describes the outcome in full, and the Reference Tool lists the informative references you may need to map to other frameworks.

Who must be covered by general awareness training

PR.AT-01 implementation examples name employees, contractors, partners and suppliers, but the population you must cover depends on who actually touches your systems and data. The cards below cover the groups to include, the scoping decisions that change the population, and the evidence an assessor will expect to see for each.

Employees across every role

Full-time and part-time staff form the core population, and the implementation examples expect basic awareness training for them. Scope by role rather than by department, because an assistant in a finance team or a warehouse worker with a shared terminal can be the target of the same social engineering as an administrator. Check your HR system against your identity directory so that leavers and new hires are added to, and removed from, the training population on the same schedule. Evidence is a current roster, completion records and the dates they were issued.

Contractors and temporary workers

Contractors who hold accounts on your systems fall under the same awareness expectation as employees, even when a different company pays them. Confirm which contractors have logins, badges or remote access, and include them in the same completion tracking. Ask your contracting teams to record start and end dates so the population matches who is active. A common gap is a contractor with a valid account who was never enrolled because they sit outside the HR system.

Seasonal and short-term staff

Seasonal staff are often onboarded quickly and may never see the awareness module before they receive access. Decide whether training must be completed before an account is activated, and document that rule in your onboarding procedure. Short contracts raise a practical question: a course that takes time to finish may not fit a three-week engagement, so plan a shorter module for this group. Evidence should show that the training was completed before or at activation, with the date.

Partners and suppliers with system access

Partners and suppliers that connect to your environment, such as integration vendors or outsourced operators, are named in the implementation examples. Your obligation covers people who use your systems or data, which may mean their staff are required to complete your training or to show equivalent training under contract. Write this into supplier terms and ask for a current completion list from each partner. Verify the list against the accounts actually active in your environment.

Third-party helpdesks and shared accounts

Third-party helpdesk agents often reset passwords and approve access requests, which makes them a prime social engineering target. Treat them as users who need awareness training and confirm that the vendor tracks completion for each agent. Shared accounts raise a different problem: when several people use one login, no individual completion record exists. Either retire shared accounts, assign individual credentials, or document which people use each one and train them by name. Ask what evidence the vendor can produce for every agent.

Users outside the identity directory

Some people use your data without appearing in the identity directory, such as visitors on guest Wi-Fi, people using a self-hosted platform through a public portal, or staff of a customer with a federated login. Inventory every access path, not just directory accounts, and decide which groups are covered by awareness training and which are covered by other controls. Record that decision in writing. An assessor will test whether your population list matches the systems you operate, so a gap between the directory and the access logs is a finding to fix before the assessment.

How an assessor tests PR.AT-01

This table sets out what an assessor typically examines for PR.AT-01, the evidence they ask for and the gaps they most often record. Read it as a planning list: the depth of each test depends on the organization's own risk decisions, and no NIST-issued test procedure is quoted here.

Assessment area	Test approach	Evidence requested	Common findings
Training content	Review whether the content covers social engineering, suspicious activity reporting, acceptable use and basic cyber hygiene, and whether it fits the organization's own threats.	Current course materials, version history, and a mapping from each topic to the risks the organization has identified.	Generic content that predates current threats, or topics missing from the material with no documented reason.
Audience coverage	Compare the training population with the people and third parties the organization says must be trained, including contractors, partners and suppliers where relevant.	Scope statement for awareness training and the personnel roster or identity directory used to define it.	Contractors or temporary staff with system access who are outside the training population.
Completion records	Sample personnel from the roster and check each sampled person's completion record for the training.	Learning management system completion reports, dated and tied to named users, with the sample selection documented.	Completion records that cannot be matched to current staff, or completion marked by a click that does not show the content was understood.
Testing of understanding	Check whether the program measures comprehension, for example through quizzes, scenario questions or simulated phishing, and how results are acted on.	Assessment results, question banks, simulation reports and records of follow-up training for those who did not pass.	Attendance is recorded but no comprehension test exists, or failed results never trigger remediation.
Annual refresher cadence	Confirm that training repeats at the interval the organization has set and that the interval is enforced for all covered users.	Training calendar, policy text stating the cadence, and completion dates showing the last cycle.	Refreshers overdue for some groups, or the cadence in policy does not match what the system actually enforces.
Consequences of violations	Verify that the training explains what happens when policies are broken and that staff acknowledge it.	Acknowledgment forms or policy sign-off records, and the disciplinary or access-restriction policy referenced in the training.	Training omits consequences, or acknowledgments are missing for new joiners.
Reporting channel	Test whether staff know how to report suspicious activity and whether reports are logged and reviewed.	Reporting procedure, mailbox or ticket queue configuration, and a sample of reports with their handling records.	Reporting path described in training does not exist or reports are not tracked to closure.
Governance and ownership	Check who approves the program content, reviews its effectiveness and reports on it, and whether the approach reflects the organization's own risk decisions.	Named owner, approval records, and periodic review minutes or metrics.	No accountable owner, or the program has not been reviewed since it was first written.

How to implement PR.AT-01 in a working program

This sequence turns PR.AT-01 from a policy statement into a running awareness program that reaches every person with system access, tests whether they learned something, and keeps dated records that show the program operates.

Define the audience and roster source
Decide who counts as personnel and other users for this program, including employees, contractors, partners and suppliers with access to your systems or data, as the NIST Implementation Examples for PR.AT-01 describe. Name the system of record that produces the roster, such as the HR directory, identity provider or contractor register, and agree who owns it. The output is a written audience definition and a roster mapping that shows which source feeds which group, so that a new joiner or contractor cannot be missed. Confirm with HR and procurement how third parties are added, since their onboarding often happens outside HR.
Approve the awareness content
Write or adopt content that covers recognizing social engineering, including phishing, pretexting and voice-based requests, along with how to report suspicious activity, the acceptable use rules that apply to the organization, and basic cyber hygiene such as credential handling and software installation. Have the policy owner and the security lead review the material and record its approval, version and date. The output is approved content with a version identifier, plus a note on the consequences of policy violations, which NIST lists as part of this Subcategory's examples. Keep the approval record, because an assessor will ask which version each person received.
Set up reporting channels
Establish the channels people will use to report suspicious messages, calls and activity, such as a mailbox, a report button in the mail client, or a phone line, and confirm that each one reaches staff who can act on it. Publish the channel in the content and in the acceptable use material so that it is easy to find. Test each channel once with a staff member to confirm that a report arrives and is logged. The output is a documented reporting procedure and a tested intake route. Ask your platform team whether the reporting path can be automated, and confirm any product capability with the vendor before you rely on it.
Build knowledge checks
Create short assessments that test whether learners understood the social engineering, reporting and acceptable use content, rather than only confirming that they opened it. Write questions that describe realistic situations for your organization and link each question to a learning objective. Set the pass rule and the retake rule before launch. The output is a question bank with answer keys and a documented pass standard. This is the evidence that supports the NIST expectation to test understanding, so keep the question versions tied to the content version approved in the earlier step.
Schedule onboarding and annual refreshers
Assign the training to every roster entry at onboarding, and set a recurring refresher cycle that NIST's examples describe as annual. Configure the learning platform so that new joiners and new third-party users receive the course before or at the time they gain access, and track the refresher due date for each person. The output is a published schedule with defined trigger points and a due-date rule, along with an exception process for leave or access granted before training is complete. Confirm with your access management team that accounts can be restricted until the required training is recorded where your policy allows it.
Run supervised phishing and reporting exercises
Where your policy and employment rules allow it, run simulated phishing or reporting exercises to measure whether people recognize and report suspicious messages. Agree the scope, the target groups and the rules for handling results with HR and legal before the first exercise, and do not use results as the sole basis for discipline. Brief the security team on how reports from the exercise will be processed so that the reporting channel is tested along with recognition. The output is an exercise plan, a result summary by group and a list of follow-up actions such as targeted refreshers. Describe these exercises to your assessor as one input, not as proof on their own.
Capture completion and test records
Record, for each person, the content version delivered, the date of completion, the knowledge check result and any retakes. Learning platforms such as Moodle track activity completion, but the criteria for marking an activity complete depend on how the activity is configured, so confirm that the completion rule matches your pass standard before you treat it as evidence. Store the records in a location that the security team and assessors can retrieve. The output is a completion report that lists every roster entry with status and dates, plus test results and any open exceptions. Review the report on the schedule your governance process sets and file the review minutes.
Review the program and update the schedule
Compare the completion report with the roster, check whether reported incidents and exercise results show gaps in the content, and decide what changes the next cycle needs. Update the content, questions or schedule where the review shows a problem, and record the new version and the reason for the change. Confirm with your governance owner that the review feeds the cybersecurity risk process, because PR.AT-01 is linked to the broader improvement work in ID.IM. The output is an updated refresher schedule and a review record that show the program changes in response to what it measures.

Which evidence passes a PR.AT-01 review

An assessor testing PR.AT-01 looks for proof that awareness training runs for everyone who needs it, on a schedule, and that failures lead to action. The cards below cover the artifacts that show this, and each one must stay current between audits so the record reflects ongoing operation rather than a single launch.

Training policy and content

The written training policy sets who must complete awareness training, how often, what topics it covers and who owns it. Keep the policy version-controlled with approval dates, and keep the actual course material for each release so an assessor can see what staff were taught at a given time. Check that the content covers social engineering recognition, reporting steps, acceptable use and basic hygiene, and that it matches the policy wording. Review both at least once a year and after any significant incident or change in threats.

Audience roster reconciled to identity records

Assessors compare the list of people who were required to train against the identity directory. Employees, contractors, partners and suppliers with system access should all appear, and leavers should drop off only after their access ends. Reconcile the training platform against HR and identity sources each cycle and record the exceptions, such as staff on leave, with a named approver and a due date. A roster that omits contractors is one of the most common gaps an assessor finds.

Completion logs with dates and versions

Completion records should show who finished which course, on what date, and against which content version. Export logs from the learning platform with timestamps and keep them in a location that cannot be altered by the people being recorded. Activity completion tracking in an open-source learning platform such as Moodle can mark a learner complete when they view an activity, receive a grade, or tick it manually, so confirm which condition your course uses. A completion mark that only reflects a page view is weaker evidence than a graded knowledge check.

Knowledge check results

Testing understanding is part of the Implementation Examples for PR.AT-01, so assessors look for scored assessments, not only attendance. Keep question banks, pass thresholds and individual results. Phishing simulations, when used, belong here too, with the scenario, the outcome and the follow-up. Confirm that results are tied to the same identities as the roster so that each person's score can be traced.

Reporting channel use and handling

Training teaches staff to report suspicious activity, so the reporting channel must have a record. Keep a log of reports received, the category of each, who triaged it, the outcome and the time to close. Include reports that turned out to be benign, since those show that staff use the channel. A channel with no entries over a long period may signal that people do not trust it or do not know it exists, and the assessor will ask what you did about it.

Refresher cycles and actions after failed tests

Evidence should show annual refreshers actually happening, with a schedule, reminders and completion rates per cycle. Equally important are the records of what happened after someone failed a knowledge check or a simulation: a retake, a manager conversation or additional coaching, with dates and closure. Store these as a dated action register. Assessors look for a closed loop from failure to remediation, and a register with no closed items usually reads as a program that has not yet run.

Why completion records alone rarely prove awareness

Attendance shows that training was delivered, not that personnel can apply it. A completion record tells an assessor that a learner reached an activity. It says little about whether that person would spot a pretext phone call, know where to report a suspicious email, or follow the acceptable use rules when a deadline is pressing. PR.AT-01 is written around people being able to do general tasks with cybersecurity risk in mind, so the stronger evidence is what learners can show they understand and do. Completion data is a useful starting point, but it should be paired with evidence of understanding and of reporting behavior.

Learning platforms record completion according to the conditions the administrator sets, and those conditions decide what a green checkmark means. In Moodle, for example, activity completion can mark an activity complete when a learner views it, when they receive a grade from it, or when they tick it manually. A view-based condition proves a page was opened, not that its content was read. A manual tick proves only that the learner said they finished. A grade-based condition is closer to testing understanding, but only if the quiz is designed to test the social engineering and reporting topics the organization claims to cover. Before reporting completion as evidence, confirm in your own environment which condition each course uses, and whether those settings match the claim you intend to make to an assessor.

Match the completion condition to the claim. If the claim is that staff received basic awareness, a view or completion record may be enough, provided the records are retained with dates and course versions. If the claim is that staff can recognize social engineering and report it, the record should come from a graded assessment with scenario-based questions, and ideally be paired with reporting data from the mailbox or helpdesk. Ask your platform owner to export the completion settings for each course, record any manual overrides, and keep a short written rationale explaining why each condition fits the outcome it supports.

What meeting PR.AT-01 costs in money and effort

This table lists the cost components of running general awareness and training against PR.AT-01, whether each is one-time or recurring, and what drives it up. Use it to shape a written scope and to see where a self-hosted open-source learning platform removes license spend while hosting and administration remain. No prices are stated because none are supplied for this topic; ask for each line in a quote.

Cost component	One-time or recurring	Who is paid or who carries it	What drives it and how to reduce it
Content development	One-time, then recurring when content changes	Internal security or HR staff, or an implementation partner under a written scope	Drives: number of roles, languages and scenarios such as phishing and reporting. Reduce: reuse one core module and update only the parts that change.
Learning platform licenses or hosting	Recurring	Software vendor for licenses, or the organization for self-hosted infrastructure	Drives: user count and whether the platform is hosted by a vendor or inside your own cloud or data center. Self-hosted open-source platforms such as Moodle (GPL-3.0-or-later) remove license spend, but hosting and patching remain.
Administration and roster reconciliation	Recurring	Internal IT or HR operations, or a partner for platform administration	Drives: turnover, contractor and partner population, and how many systems feed the user list. Reduce: tie enrollment to the identity source so joiners and leavers update automatically.
Delivery and testing	Recurring	Internal trainers, or external testers for simulated social engineering	Drives: testing frequency and how often phishing or pretext exercises run. Reduce: schedule a fixed exercise calendar and reuse results to target follow-up training.
Staff time to complete training	Recurring, largely hidden	Paid through employee hours, not a vendor invoice	Drives: module length, number of annual refreshers and the number of staff in scope. Reduce: keep modules short and track completion so time is spent once per topic.
Evidence upkeep	Recurring	Compliance or security staff, sometimes supported by a partner	Drives: how many completion records, exercise results and acknowledgments an assessor may sample. Reduce: keep completion and test records in one system with dates and version numbers.
External review of content or exercises	Recurring when used, optional	Independent reviewer or specialist provider under contract	Drives: how often content changes and whether legal or regulatory wording needs review. Ask any provider for a written scope and deliverables before work starts.

Questions buyers ask about PR.AT-01 cost, effort and scope

How much internal effort does PR.AT-01 take?

The effort depends on how many people you employ, how many contractors and partners have system access, and how much of the training content already exists. Most of the work is one-time: deciding what every person must learn, writing or licensing the modules, and building a way to track completion. The recurring work is running the annual refresher, updating content when threats or policies change, and chasing overdue completions. Ask any provider to break its quote into design, content, rollout and ongoing tasks so you can see which parts your own team would carry. Your security and HR leads will need time for review and sign-off either way.

Can we meet PR.AT-01 without outside help?

Yes, many organizations do. NIST's Cybersecurity Framework is voluntary and does not require a particular delivery model, so an internal team can design and run the program. Outside help usually makes sense when your team lacks instructional design skills, when you need phishing simulations or a learning platform set up quickly, or when you want an independent check that the outcome is covered. Whichever route you choose, you own the program and the evidence. Confirm the internal capacity honestly before you decide, because an awareness program that lapses after launch will not show the outcome PR.AT-01 describes.

What does a DeployOpen engagement deliver for awareness training?

DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure, and can set up a learning platform, course structure, completion tracking and the records that show who finished what. Testing services, including simulated social engineering exercises where they fall within the agreed scope, are separate security testing work. DeployOpen does not write your policies, decide what your workforce must learn, or issue any assessment result. Engagements are fixed-scope, so the modules, platform configuration, integrations, handover material and any retainer for refreshers should be listed in writing before work starts, along with who supplies the course content.

Does NIST certify our awareness training against CSF 2.0?

No. NIST states that it does not offer certifications or endorsements of CSF-related products, implementations or services, and it has no plans for a conformity assessment program. Any vendor or consultant who claims to certify CSF 2.0 compliance is making a claim NIST does not support. What you can show is your own documented evidence, such as course records, policy acknowledgments and test results, which you can share with customers, auditors or regulators. Independent assessors can review that evidence, but they issue their own reports, not a NIST certificate.

Are contractors and suppliers in scope for PR.AT-01?

The NIST Implementation Examples for PR.AT-01 include basic awareness training for employees, contractors, partners and suppliers, so the outcome is not limited to staff on payroll. In practice, the question is which third parties have access to your systems or data, and whether you can require or verify their training. Contracts and onboarding steps are the usual way to set this up. Define the population in writing, decide who delivers the training to each group, and keep records of who completed it. Role-based training for specialized roles, including some third parties, is covered separately under PR.AT-02.

How often must awareness training repeat?

The CSF 2.0 Subcategory does not set a fixed interval, but the Implementation Examples for PR.AT-01 include annual refreshers, which is the common baseline buyers and assessors look for. Refreshers are usually needed sooner after a significant incident, a policy change, a new system, or a new hire joining a role with higher access. Set the frequency in your own policy, then document it, because an assessor will test whether the schedule was followed. Ask any provider how refresher content is updated and who approves it.

What does a partner need from us to start?

A partner needs a clear picture of your environment and your decisions before it can scope the work. Expect to provide the list of systems and platforms in use, the identity and single sign-on setup, the people groups who need training, existing policies and acceptable use rules, and the names of the owners who will approve content and sign off evidence. Access to your infrastructure, under agreed controls, is usually needed for installation. Name a single internal owner, agree the timeline and responsibilities in the written scope, and confirm how completion records will be retained.

Who owns PR.AT-01 and what can be outsourced

Your organization owns PR.AT-01. Someone accountable must decide who must complete awareness training, what it covers, how often it recurs and what happens when a person does not complete it. NIST does not certify CSF implementations, so no outside body can make this decision for you. The CSF Core asks for personnel to receive awareness and training that helps them handle general tasks with cybersecurity risk in mind, and your leaders must be able to show that this is true for your own workforce.

Audience and policy: Define who is in scope, including employees, contractors, partners and suppliers with system access, and approve the policy that sets the requirement.
Content approval: Review and sign off on training material covering social engineering, reporting channels, acceptable use and basic hygiene.
Completion records and follow-up: Own the records that show who finished training, when, and with what result, and decide how gaps are handled.
Actions taken: Document responses to failed knowledge checks, policy violations and repeated phishing failures.

Before engaging anyone, confirm that these decisions have named owners and that the policy is approved.

Where PR.AT-01 programs usually fall short

Most awareness programs fail at the edges: who is covered, whether training changes behavior, and whether the records hold up when an assessor asks. The cards below cover the gaps we see most often and a practical fix for each, so the program can show what it does on an ordinary day rather than only at audit time.

Contractors and suppliers left out

Training is often built for employees, while contractors, partners and supplier staff with system access receive nothing. PR.AT-01 covers personnel and other users, and NIST's Implementation Examples name contractors, partners and suppliers explicitly. Fix it by making awareness a condition of account creation for every user type, and by writing the requirement into contracts so suppliers can show completion records on request.

Rosters that drift from identity records

Training completion lists are frequently kept in a spreadsheet or LMS that no longer matches the identity provider. Leavers stay on the roster, new joiners are missed, and assessors find users with active accounts who never completed training. Check that the learning platform is fed from the same directory as access control, and reconcile the two each cycle, noting exceptions and who approved them.

Training that never tests understanding

Slide decks that end with a click-through do not show that staff can recognize a phishing message or a pretexting call. PR.AT-01 expects training that tests understanding, so each module should end with scenario questions and a pass mark. Track failed attempts and route those users to retraining. Moodle's activity completion can record a grade as the completion condition, which keeps passing a test distinct from merely opening the material.

No defined channel for reporting

Staff often know that something looks wrong but do not know where to send it, or they fear blame for reporting a click. Without a named channel, suspicious activity goes unreported until the incident is visible elsewhere. Publish one reporting route, such as a mailbox or button in the mail client, name the team that triages it, and measure response times. Test the route with a simulated report so the team knows it works before staff depend on it.

Refreshers that lapse

Annual training is often completed once and then forgotten when the renewal date passes. Refreshers also lapse for people who change roles, return from leave or move to a new team. Set a calendar-driven due date tied to each person's record, send reminders before it expires, and block high-risk access when training is overdue where policy allows. Confirm with your own policy owner how long a completed course counts before a refresher is due.

Evidence assembled only at audit time

Teams that gather training records just before an assessment often find gaps they cannot close, and screenshots rarely show what the policy says. Keep a standing evidence set: the curriculum and version history, the roster with completion dates, test results, reporting-channel logs and the sanctions applied for policy violations. Review it each quarter so the record is current when an independent assessor samples it.

How PR.AT-01 differs from role-based training

PR.AT-01 is the baseline that every person with access to the organization's environment must complete, while PR.AT-02 adds targeted training for specialized roles. The baseline covers general awareness for employees, contractors, partners and suppliers: recognizing social engineering, reporting suspicious activity, following acceptable use rules and practicing basic cyber hygiene. PR.AT-02 sits on top of that for security staff, finance teams, senior leadership and anyone with access to business-critical data, including third parties who hold those roles. The distinction is one of audience and depth, not of whether a person needs training at all. Everyone is in the PR.AT-01 population, and some people are also in the PR.AT-02 population.

Keep the two evidence sets separate. For PR.AT-01, an assessor will expect a training record for each person in scope, the content delivered, the date of completion, any test of understanding and the annual refresher cycle. For PR.AT-02, the assessor will look for a defined list of specialized roles, the role-specific courses those roles take, and proof that the people in those roles completed them. A learning management system such as Moodle can separate these by course and by completion condition. Its activity completion feature can mark an activity complete when a learner views it, receives a grade or ticks it manually, depending on how the activity is configured, so confirm which condition your PR.AT-01 courses use before you rely on it as evidence. Mixing both into one undifferentiated course list makes it hard to show which layer covers whom.

Before you scope the work, confirm three things with your compliance lead: the role list that defines the specialized population, whether contractors and third parties are assigned to the baseline, the specialized layer or both, and which owner signs off the annual refresher for each layer. Those decisions determine how many records each layer generates and where gaps are most likely to appear. If an implementation partner builds the courses or reporting, the organization still owns the role definitions and the attestation that people completed them.

How DeployOpen works on this

DeployOpen works on PR.AT-01 as implementation and evidence preparation inside your own environment. Your organization owns its awareness program and decides what its personnel must learn, while DeployOpen helps set up the learning platform, content workflow, completion records and documentation that show the program runs.

How we scope

Engagements are fixed-scope, with the audiences, training modules and platform covered agreed in writing before work starts.
The written scope lists which personnel groups, contractors and other users fall under the awareness program and how often refreshers run.
We confirm with you which evidence the assessor expects, such as completion records, test results and acceptable use acknowledgments.

How we build

We deploy a self-hosted learning platform in your own cloud account, data center or air-gapped network, configured to your access rules.
Modules cover recognizing social engineering, reporting suspicious activity, acceptable use and basic cyber hygiene, with knowledge checks where your policy requires them.
Completion tracking is configured so records show who finished which module and when, and we test that those records export cleanly.

How we hand over

You receive documentation of the training workflow, module ownership, refresher schedule and how completion evidence is generated and stored.
Handover includes a walkthrough of how to pull completion and testing records for an internal review or an independent assessor.
Your team owns the content, the platform administrators and the decisions about what counts as passing, and we document those roles.

How we support

Ongoing support, upgrades and maintenance of the learning platform are available as a retainer after handover.
Retainer work can cover refreshing modules when threats or policies change, and keeping completion records current for each review cycle.
Only an independent auditor, assessor or certification body issues reports or certificates. DeployOpen prepares the systems and evidence for that review.