Role-Based Security Training Matrix

Defines required training by role, including privileged users, developers, finance and management.

Available soon

Format: Excel
Size: 88 KB
Length: 11 sheets
Version: 1.0
Updated: 1 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.01 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	On the Matrix sheet, check each role group against your organisation: who is in it, when its module falls due and why it needs more. Mark 'Required' under each module the group must take. Everyone is in RG-01 and takes the baseline course; the other groups take their module on top (AW-06). Enter how many people are in each group and where the count comes from: your role profiles (P13), your privileged accounts (P14), your management body (P12).
2	On the Modules sheet, check each module: what it covers, its length, the rules of other packs it teaches, how often it is repeated, its current version and its owner. A role module teaches the owning pack's rules as written there, never a summary that differs (LM-08 reads the privileged access rules from P14).
3	Add a group or a module on the yellow rows. A new module also needs its own column on the Matrix: insert it among the module columns with the module ID as its heading.
4	On the Due Dates sheet, add a row when someone enters a role group: the person, the group, the module, the due rule and its date. The due date, the days left and the status calculate. A person who joins or moves into a role at higher risk works under supervision until the module is done (AW-06).
5	When a module is completed, enter the date. The next due date is the completion plus the module's repeat period. Record the completion itself, with its version and how it was delivered, in the Training Completion & Evidence Register.
6	The management body's training is set by the NIS2 pack (P12 NR-05) and recorded in its training plan. This matrix shows it as one column (MT-01 to MT-06) so the role groups are complete (AW-07).
7	Read the Coverage Check: every line should show 0 against a gap, and the status Ready. Set its As-at date before you read the statuses, and enter your public holidays there.
8	Delete the EXAMPLE rows before the matrix is approved. Rows marked Default are the pack's modules: keep, change or drop them. Do not type over the white calculated columns.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

Rule AW-06: "A person in a role at higher risk must complete that role's module before using the role's access or authority unsupervised, and again every [[12]] months. A privileged user completes it before any privileged right is made eligible (P14 PA-07); a joiner works under supervision until it is done, within the induction window; a mover completes it by the move date (P13 JML-08)."

Rule AW-07: "Members of the management body are trained as P12 NR-05 sets, with attendance and content recorded. This pack sets no other timing for them." The NIS2 pack sets it at least every 12 months, and within 3 months for a new member.

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Group sizes come from the packs that hold them: the role profiles (P13), the privileged accounts (P14) and the board (P12); the developers, executives and service desk counts are EXAMPLE inputs. The three Tier 0 administrators took LM-08 before Tier 0 moved to security keys and time-limited elevation on 21 Sep 2026; four more privileged users are due before 19 Oct 2026.

Tailoring — small organisation: merge groups that are the same few people (finance and executives, for example), but keep a module for each risk: privileged access, payments, development and the service desk's identity checks.

Tailoring — regulated entity (NIS2, DORA): the matrix shows the training needs of roles that require security skills, set by criteria, applied to movers, and assessed for effectiveness (Implementing Regulation (EU) 2024/2690, Annex point 8.2). A financial entity under DORA sets each role's training at a depth that fits its remit, including senior management (Article 13(6)), and the management body's own (Article 5(4)).

Tailoring — IT run by a service provider: the provider's administrators are privileged users of your systems. Require LM-08, or equivalent training the contract evidences, before any privileged right is made eligible, and ask for the record.

Matrix

Which role group takes which module (AW-06). Mark 'Required' under each module; everyone takes the baseline course (RG-01), and the other groups their module on top. Minutes are on top of the baseline.

Row	Group ID	Role group	Who is in it	When it falls due	Why it needs more	LM-01	LM-02	LM-03	LM-04	LM-05	LM-06	LM-07	LM-08	LM-09	LM-10	LM-11	LM-12	LM-13	MT-01 to MT-06	Modules (calc)	Minutes (calc)	People	Count from	Check (calc)
EXAMPLE	RG-01	Everyone with an account	Every employee, and every non-employee given an account (P13), including suppliers' staff unless the contract shows equivalent training	The baseline course every [[12]] months (AW-04); the induction within the joiner window (AW-05)	Phishing, fraud and misdirected data reach everyone.	Required	Required	Required	Required	Required	Required	Required								7	35	900	P13: all staff	OK
EXAMPLE	RG-02	Privileged users	Everyone who holds a named administrator account or an application administrator role (P14)	Before any privileged right is made eligible (P14 PA-07), then every [[12]] months	One captured administrator credential can compromise every system of its tier (P14).								Required							1	30	7	P14: named administrator accounts and application administrator roles in use	OK
EXAMPLE	RG-03	Finance and payment authority	Anyone who can change supplier bank details, release a payment run or approve a payment	Before first use of the authority, then every [[12]] months, and again within [[10]] working days of any payment fraud attempt that the call-back check did not stop	Payment fraud through a compromised supplier mailbox is outside appetite (P05 R-02).									Required						1	20	11	P13: accounts payable clerk and payments officer profiles	OK
EXAMPLE	RG-04	Developers	Everyone who writes, changes or releases code or configuration for the organisation's systems	Before their first change reaches production, then every [[12]] months	A weakness written into a system serves every attacker until it is fixed.										Required					1	30	6	EXAMPLE: the ordering platform team, after two engineers left (P03)	OK
EXAMPLE	RG-05	Management body	Every member of the management body (P12)	As P12 NR-05 sets (AW-07)	NIS2 Article 20(2) requires it of every member.														Required	1	120	7	P12: the board	OK
EXAMPLE	RG-06	Executives and their assistants	Executive management and the people who manage their mail and diaries	Within the induction window, then every [[12]] months	Their names carry authority that fraudsters borrow.											Required				1	20	7	EXAMPLE: five executives and two assistants	OK
EXAMPLE	RG-07	Service desk	Everyone who resets passwords or second factors, or unlocks accounts	Before their first reset, then every [[12]] months	A caller who talks the service desk into a reset gets the account without phishing anyone.												Required			1	20	4	EXAMPLE: the internal service desk	OK
EXAMPLE	RG-08	Customer data handlers	Everyone whose job is to send customer personal data by email	Within the induction window, working under supervision until done, then every [[12]] months	A misdirected customer file is a personal data breach (P09).													Required		1	15	60	P13: customer service agent profile	OK

Modules

The modules: LM-01 to LM-07 make up the baseline course (AW-04), 35 minutes, each tied to a behaviour (a first-month behaviour, or BB-1); LM-08 to LM-13 are the role modules (AW-06); MT-01 to MT-06 is the management body's programme from the NIS2 pack. Rows marked Default are the pack's.

Row	Module ID	Kind	Title	Behaviour	What it covers	Minutes	Rules it teaches	Repeat every (months)	Current version	Content owner	Groups requiring it (calc)	Check (calc)
Default	LM-01	Baseline	Report it	FB-1	What to report, the reporting route, what happens next, and why a report after a click is welcome.	5		12	[[e.g. 2026.1]]	[[e.g. Awareness lead]]	1	OK
Default	LM-02	Baseline	Fake sign-in pages	FB-3	How a fake sign-in page looks, why a link in an email is never the way to sign in, and what to do after typing a password into one.	5		12	[[e.g. 2026.1]]	[[e.g. Awareness lead]]	1	OK
Default	LM-03	Baseline	Sign-in codes and prompts	FB-2	Never share a code; reject a sign-in prompt you did not start, and report it; how the organisation's second factor works.	5		12	[[e.g. 2026.1]]	[[e.g. Awareness lead]]	1	OK
Default	LM-04	Baseline	Unexpected attachments and links	FB-3	The cues in an unexpected email, why attachments that ask to enable content are dangerous, and how to check with the sender.	5		12	[[e.g. 2026.1]]	[[e.g. Awareness lead]]	1	OK
Default	LM-05	Baseline	Money, bank details and urgent requests	FB-4	Invoice and bank detail fraud, impersonated managers and suppliers, and the call-back to a known number.	5		12	[[e.g. 2026.1]]	[[e.g. Awareness lead]]	1	OK
Default	LM-06	Baseline	Customer and personal data	FB-5	Checking recipients, the external-recipient warning, what to do after a misdirected email, and why it must be reported at once.	5		12	[[e.g. 2026.1]]	[[e.g. Awareness lead]]	1	OK
Default	LM-07	Baseline	Devices, updates and lost equipment	BB-1	Locking the screen, letting updates run, not installing software, and reporting a lost or stolen device the same day.	5		12	[[e.g. 2026.1]]	[[e.g. Awareness lead]]	1	OK
Default	LM-08	Role	Privileged access in practice		The rules a privileged user follows, from the privileged access pack: PA-02, PA-03, PA-04, PA-05, PA-13, PA-17, read from P14. What a tier breach is and what happens after one.	30	PA-02, PA-03, PA-04, PA-05, PA-13, PA-17	12	[[e.g. 2026.1]]	[[the owner of the rules it teaches]]	1	OK
Default	LM-09	Role	Payments and supplier bank details		Business email compromise, the call-back on every change to supplier bank details (P05 TA-02), never holding both sides of a payment conflict (P02 SOD-FI-01), and the Business Email Compromise Response Playbook.	20	TA-02, SOD-FI-01	12	[[e.g. 2026.1]]	[[the owner of the rules it teaches]]	1	OK
Default	LM-10	Role	Secure development and secrets		Keeping secrets out of code and tickets, checking third-party components, review before release, and fixing weaknesses within the deadlines of the vulnerability management pack (P01).	30		12	[[e.g. 2026.1]]	[[the owner of the rules it teaches]]	1	OK
Default	LM-11	Role	Executive impersonation		Why executives and their assistants are targeted, fake urgent requests in an executive's name by email, message or cloned voice, and the agreed way to confirm one.	20		12	[[e.g. 2026.1]]	[[the owner of the rules it teaches]]	1	OK
Default	LM-12	Role	Identity checks at the service desk		Callers who impersonate staff, the identity checks before any reset (P13 JML-13: call back, line manager confirms, in person), and the stricter checks for a privileged account (P14 PA-17).	20	JML-13, PA-17	12	[[e.g. 2026.1]]	[[the owner of the rules it teaches]]	1	OK
Default	LM-13	Role	Handling customer data by email		Sending customer data only to checked recipients, using the shared file route for bulk data, and reporting a misdirected email within the hour so the breach clock can be judged (P09).	15		12	[[e.g. 2026.1]]	[[the owner of the rules it teaches]]	1	OK
Default	MT-01 to MT-06	Management body (P12)	The management body's programme, from the NIS2 pack		MT-01 Our NIS2 status and what it asks of the management body; MT-02 The ten measures and where we stand; MT-03 Our top cyber risks and our appetite; MT-04 When an incident happens; MT-05 Supervision, enforcement and personal accountability; MT-06 Reading the cyber report and challenging it	120	NR-05	12	[[e.g. 2026.1]]	[[the NIS2 lead]]	1	OK

Due Dates

One row per person per module that falls due. The due rule sets the date (see the Coverage Check); the status is as at the As-at date there. Record completions themselves in the Training Completion & Evidence Register.

Row	Person	Role group	Module	Due rule	Rule date	Completed on	Due (calc)	Days to due (calc)	Status (calc)	Next due (calc)	Check (calc)	Notes
EXAMPLE	adm-mellis	RG-02	LM-08	Before first use	21 Sep 2026	18 Sep 2026	21 Sep 2026		Done on time	18 Sep 2027	OK	Tier 0 moved to security keys and time-limited elevation on this date (P14).
EXAMPLE	adm-jnovak	RG-02	LM-08	Before first use	21 Sep 2026	18 Sep 2026	21 Sep 2026		Done on time	18 Sep 2027	OK	Tier 0 moved to security keys and time-limited elevation on this date (P14).
EXAMPLE	adm-pshah	RG-02	LM-08	Before first use	21 Sep 2026	18 Sep 2026	21 Sep 2026		Done on time	18 Sep 2027	OK	Tier 0 moved to security keys and time-limited elevation on this date (P14).
EXAMPLE	J-04	RG-08	LM-13	Joiner: induction window	7 Sep 2026	9 Sep 2026	21 Sep 2026		Done on time	9 Sep 2027	OK	Customer service agent; worked under supervision until the module was done.
EXAMPLE	adm-dmorgan	RG-02	LM-08	Before first use	19 Oct 2026		19 Oct 2026	19	Not yet due		OK	Due before Tier 1 moves to time-limited elevation (P14).
EXAMPLE	adm-lchen	RG-02	LM-08	Before first use	19 Oct 2026		19 Oct 2026	19	Not yet due		OK	Due before Tier 1 moves to time-limited elevation (P14).
EXAMPLE	elena.lopez	RG-02	LM-08	Before first use	19 Oct 2026		19 Oct 2026	19	Not yet due		OK	Due before Tier 1 moves to time-limited elevation (P14).
EXAMPLE	helen.carter	RG-02	LM-08	Before first use	19 Oct 2026		19 Oct 2026	19	Not yet due		OK	Due before Tier 1 moves to time-limited elevation (P14).
EXAMPLE	M-07	RG-05	MT-01 to MT-06	Management body: new member	15 Jul 2026		15 Oct 2026	15	Not yet due		OK	Booked for 2026-10-08 in the NIS2 pack's training plan.

Coverage Check

Coverage check

The matrix against the rules, and the due dates as at the As-at date. Yellow cells are yours; everything else is calculated.

As-at date	30 Sep 2026	EXAMPLE date (the example quarter end). Type the date you read the statuses.
Induction window (working days)	10	AW-05: the joiner window of the policy pack (P04 PF-09).
Renew every (months)	12	AW-04, AW-06. A module's own repeat period on the Modules sheet is used where set.
Management body: new member within (months)	3	P12 NR-05, imported (AW-07). Change it only if the NIS2 pack does.

Checks

Check	Result	What it means
Role groups	8	Everyone, and each role at higher risk (AW-06).
Modules	14	The baseline modules, the role modules and the management body's programme.
Groups with no module	0	Every group needs at least one module marked Required.
Modules no group requires	0	Drop the module, or mark the groups that need it.
Baseline course (minutes)	35	Short enough to take in pieces across the year (AW-04).
Behaviours with no baseline module	0	Each of the 6 behaviours (the five first-month behaviours and BB-1) is taught by at least one baseline module.
People in roles at higher risk	102	The groups other than everyone. A person in two groups counts twice.
Due-date rows	9	On the Due Dates sheet.
Done on time	4	Completed by the due date.
Done late	0	Completed after the due date.
Not yet due	5	Not completed; the due date is on or after the As-at date.
Overdue	0	Not completed and past due: train now, and supervise until done (AW-06).
Rows to resolve	0	Rows on any sheet whose Check does not say OK.
Matrix status	Ready	Ready when no line above shows a gap.

How a due date is set

Due rule	Rule	How the date is set
Joiner: induction window	AW-05, AW-06	10 working days after the start date (the joiner window, P04 PF-09). Work under supervision until it is done.
Before first use	AW-06	The date the access or authority is first used unsupervised: a privileged right made eligible (P14 PA-07), a first payment, a first change to production, a first reset.
Mover: by the move date	AW-06	The move date (P13 JML-08). A move within the same role group carries the module over.
Renewal	AW-04, AW-06	12 months after the last completion.
Management body: new member	AW-07	3 months after appointment, as the NIS2 pack sets (P12 NR-05). Its record is kept in that pack's training plan.

Non-working days (public holidays)

Date	Holiday

[[e.g. a public holiday]]

Lists

Required	DueRule	Kind	BehaviourID	BehaviourText	DueStatus
Required	Joiner: induction window	Baseline	FB-1	Report anything odd at once, through the one reporting route, even after clicking.	Done on time
	Before first use	Role	FB-2	Never give anyone a password or a sign-in code, and approve only sign-ins you started yourself.	Done late
	Mover: by the move date	Management body (P12)	FB-3	Check before you click a link or open an attachment you did not expect, and never sign in from a link in an email.	Not yet due
	Renewal		FB-4	Confirm any request for money, bank details or data by calling a number you already hold, not one in the message.	Overdue
	Management body: new member		FB-5	Check the recipient before you send customer or personal data, and stop if the warning says it is going outside.
			BB-1	Keep your device as IT set it up: let updates install and restart when asked, lock the screen when you step away, and get software only through the service desk.

Definitions

Definitions

Term	Meaning in this workbook
Role at higher risk	A role whose access or authority would let one mistake or one deceived person cause serious harm: privileged access, payment authority, software development, the management body, executive authority, the service desk's identity checks and the handling of customer data.
Training	A set piece of learning with a defined content and a record: the baseline course, a role module, the induction or the management body's session.
Baseline course	The short course everyone with an account completes every 12 months, made of the baseline modules. It can be taken in pieces across the year.
Role module	Training for a role at higher risk, on top of the baseline course, set by the training matrix.
Induction	The security part of a joiner's first days: the day-one essentials at first sign-in, and the induction course within the joiner window.
Role group	People who share a role at higher risk and take the same module. Everyone is in RG-01; a person can be in more than one group.
Required	The group must take the module, by the due rule its row names.
Due rule	How a person's due date is set: the induction window, before first use, the move date, renewal, or the management body's new-member window.
Status: Done on time	Completed on or before the due date.
Status: Done late	Completed after the due date. Say why in Notes.
Status: Not yet due	Not completed; the due date has not passed.
Status: Overdue	Not completed and the due date has passed.
Under supervision	Using the role's access or authority only with someone trained checking the work, until the module is done (AW-06).
LM-nn, RG-nn, FB-n, BB-n, MT-nn	Modules, role groups, first-month behaviours and the other behaviours the baseline course teaches, of this pack; MT-01 to MT-06 are the management body's topics in the NIS2 pack (P12).
(calc)	A column or cell the workbook calculates. Do not type or paste over it.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Delete before approval.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Annex A 6.3 — Information security awareness, education and training	Matrix and Modules: awareness, education and training for everyone, and more for roles at higher risk
ISO/IEC 27001:2022	Clause 7.2 — Competence	Matrix and Due Dates: the competence each role needs, and when it is acquired
NIST CSF 2.0	PR.AT-02 — “Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind”	The matrix as a whole: people in specialised roles given training for their role
NIS2 — Directive (EU) 2022/2555	Article 20(2) — members of management bodies are required to follow training to identify risks and assess cybersecurity risk-management practices	RG-05 and the MT-01 to MT-06 column: every member of the management body trained, as the NIS2 pack sets
NIS2 — Directive (EU) 2022/2555	Article 21(2)(g) — “basic cyber hygiene practices and cybersecurity training”	The matrix as a whole: cybersecurity training as a risk-management measure
NIS2 — Implementing Regulation (EU) 2024/2690	Article 1 — lays down the technical and methodological requirements of the Article 21(2) measures, and further specifies when an incident is significant, for DNS service providers, TLD name registries, cloud computing, data centre and content delivery network providers, managed service and managed security service providers, providers of online marketplaces, online search engines and social networking services platforms, and trust service providers	Whom the Implementing Regulation binds: for other entities it shows what a supervisor expects
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 8.2.1 — “The relevant entities shall identify employees, whose roles require security relevant skill sets and expertise, and ensure that they receive regular training on network and information system security.”	Matrix: the roles that need security skills, identified, and given regular training
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 8.2.2 — a training program “which lays down the training needs for certain roles and positions based on criteria”, in line with the network and information security policy, topic-specific policies and other relevant procedures	Matrix and Modules: the training needs of each role, set by criteria
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 8.2.3 — “The training referred to in point 8.2.1 shall be relevant to the job function of the employee and its effectiveness shall be assessed.” It covers “(a) instructions regarding the secure configuration and operation of the network and information systems, including mobile devices; (b) briefing on known cyber threats; (c) training of the behaviour when security-relevant events occur.”	Modules: training relevant to the job, on secure operation, known threats and what to do when something happens
NIS2 — Implementing Regulation (EU) 2024/2690	Annex, point 8.2.4 — “The relevant entities shall apply training to staff members who transfer to new positions or roles which require security relevant skill sets and expertise.”	Due Dates, the mover rule: staff who move into a role that needs security skills are trained for it
DORA — Regulation (EU) 2022/2554	Article 5(4) — members of the management body keep up to date with sufficient knowledge and skills to understand and assess ICT risk, including through regular training	Tailoring for financial entities: the management body's own ICT risk training (MT-01 to MT-06)
DORA — Regulation (EU) 2022/2554	Article 13(6) — “Financial entities shall develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. Those programmes and training shall be applicable to all employees and to senior management staff, and shall have a level of complexity commensurate to the remit of their functions. Where appropriate, financial entities shall also include ICT third-party service providers in their relevant training schemes in accordance with Article 30(2), point (i).”	Tailoring for financial entities: training for all staff and senior management at a depth that fits each role
GDPR — Regulation (EU) 2016/679	Article 39(1)(b) — the data protection officer’s task “to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits”	LM-06 and LM-13: the Data Protection Officer monitors the training of staff who handle personal data

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR)

ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.