Training Completion & Evidence Register

Records completion by person, module and date as audit evidence of competence and awareness.

Available soon

Format: Excel
Size: 111 KB
Length: 10 sheets
Version: 1.0
Updated: 1 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.01 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	On the Summary sheet, set the As-at date and the period you report (a month). The EXAMPLE uses 30 Sep 2026. Type both; never a formula that changes them. Enter your public holidays there so due dates and lateness skip them.
2	On the Modules sheet, keep the modules from the Role-Based Security Training Matrix with their current version and repeat period. When a module's content changes, change its version, and record each completion with the version taken.
3	On the Completions sheet, add a row when a module falls due for someone: the person, their type, the role group, the module, the due rule and its date. Due rules: Joiner: induction window (10 working days after the start date (the joiner window, p04 pf-09)); Before first use (the date the access or authority is first used unsupervised: a privileged right made eligible (p14 pa-07), a first payment, a first change to production, a first reset); Mover: by the move date (the move date (p13 jml-08)); Renewal (12 months after the last completion). The due date calculates.
4	When it is done, enter the date, the version taken, how it was delivered (e-learning; classroom or briefing, with attendance sheet; floor terminal; supplier's equivalent training, with its record) and the evidence reference: the learning system's record, or the attendance sheet for a briefing. A supplier's staff may show equivalent training under the contract instead (AW-04): record it with the supplier's evidence.
5	Read the Status and Record check columns. Chase anything Overdue at once: a person in a role at higher risk works under supervision until it is done (AW-06). Say why in Notes for anything done late. Clear every Record check that does not say OK.
6	Each month, read the Summary: give HRM-05 to the Human Risk Metrics Dashboard, and the two staff counts from the learning system for P11 MC-36, counted as P11 defines it, unchanged (AW-04, P11 MR-04).
7	Keep each record for [[the period your records policy sets]], with the evidence it points to. Never record simulation results here: they are personal data kept separately and for a shorter time (AW-13, AW-17).
8	Delete the EXAMPLE rows before the register is used. Do not type over the white calculated columns.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

Rule AW-17: "Every completion must be recorded with the person, the module and its version, the date and how it was delivered, and kept for [[the period the records policy sets]]. Simulation results are not completion records and are not kept with them."

Rule AW-05: "A joiner must receive the day-one essentials at first sign-in, on the day their account is enabled (P13 JML-07), and complete the induction within [[10]] working days of the start date, the window in which they acknowledge the policies that apply to them (P04 PF-09). No simulation is sent to a joiner in their first [[30]] days."

EXAMPLE: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Its September joiners (P13): six finished the induction on time, one (J-02) a day late because the course was on a shared office PC, and two are inside the window. The three Tier 0 administrators took LM-08 before Tier 0 moved on 21 Sep 2026; four more are due before 19 Oct 2026. Staff completion is 828 of 900: the 72 still to complete are warehouse night shift staff.

Tailoring — small organisation: a learning system is not needed. One row per completion, with the attendance sheet or a signed note as evidence, is the record.

Tailoring — regulated entity (NIS2, DORA): this register is the evidence that staff are trained and that roles needing security skills are trained for them, kept for as long as your records policy says. A supervisor or auditor tests the evidence reference, so keep it pointing to something that exists.

Tailoring — IT run by a service provider: the provider's staff with accounts on your systems are recorded here too, as Supplier staff, with the provider's evidence of equivalent training where the contract allows it.

Summary

Summary

The period's completions, as at the As-at date. Yellow cells are yours; everything else is calculated from the Completions sheet.

As-at date	30 Sep 2026	EXAMPLE date (the example quarter end). Type the date you read the register.
Period starts	1 Sep 2026	The first day of the month you report.
Period ends	30 Sep 2026	The last day of the month you report.
Induction window (working days)	10	AW-05: the joiner window of the policy pack (P04 PF-09).
Renew every (months)	12	AW-04, AW-06. A module's own repeat period on the Modules sheet is used where set.
HRM-05 target (share)	100%	All: every role module that fell due, done by its due date.
HRM-05 tolerance limit (share)	90%	EXAMPLE [[90%]]: below it, the status is Outside tolerance. Set by the security and IT leadership team (P11 MR-07).

This period

Measure	Value	What it means
Records	17	Rows on the Completions sheet.
Completed	11	Records with a completion date.
Inductions on time (AW-05)	6	The baseline course within 10 working days of the start date.
Inductions done late	1	Say why in Notes; fix the cause.
Inductions not yet due	2	The joiner window is still open.
Inductions overdue	0	Past the window and not done: chase at once.
Role modules that fell due in the period	4	The 'out of' for HRM-05.
Of which done by the due date	4	The value for HRM-05.
HRM-05 Role training done by its due date	4 of 4	Give this to the Human Risk Metrics Dashboard.
HRM-05 status	On target	With nothing due, none was missed: on target.
Role modules due after the period, not yet done	4	Book them before their due dates.
Overdue (any module)	0	Not done and past due, as at the As-at date.
Records to resolve	0	Rows whose Record check does not say OK.

Staff security training completion (P11 MC-36, imported unchanged)

Staff in post at the period end who have completed the security training due for their role in the last 12 months, as a share of all staff in post. Count it from the learning system's records of the training due for each role, not from this sheet alone.

Item	Value	Note
Staff in post at the period end	900	EXAMPLE: from HR.
Of whom completed the training due for their role in the last 12 months	828	EXAMPLE: from the learning system.
Target (P11 MC-36)	95%	[[95%]], as the metrics pack sets it.
Tolerance limit	85%	EXAMPLE 85% (P03 BM-08).
MC-36 value (calc)	92%	The share, as P11 counts it.
MC-36 status (calc)	Below target, within tolerance	In the metrics pack's words; the colour only repeats it.

Non-working days (public holidays)

Date	Holiday

[[e.g. a public holiday]]

Completions

One row per person per module that falls due (AW-17). Yellow columns are yours; the due date, next due date, status and check calculate as at the As-at date on the Summary.

Row	Person	Person type	Role group	Module	Module title (calc)	Kind (calc)	Module version	Due rule	Rule date	Due (calc)	Completed	How delivered	Evidence reference	Next due (calc)	Status (calc)	Record check (calc)	Notes
EXAMPLE	J-01	Employee	RG-01	Baseline course	All seven baseline modules (LM-01 to LM-07), taken together	Baseline	2026.1	Joiner: induction window	1 Sep 2026	15 Sep 2026	8 Sep 2026	Floor terminal	LMS-J-01-IND	8 Sep 2027	On time	OK
EXAMPLE	J-02	Employee	RG-01	Baseline course	All seven baseline modules (LM-01 to LM-07), taken together	Baseline	2026.1	Joiner: induction window	1 Sep 2026	15 Sep 2026	16 Sep 2026	E-learning	LMS-J-02-IND	16 Sep 2027	Late by 1 working day	OK	The course was on a shared office PC until the floor terminals took it (P03 BM-08).
EXAMPLE	J-03	Employee	RG-01	Baseline course	All seven baseline modules (LM-01 to LM-07), taken together	Baseline	2026.1	Joiner: induction window	7 Sep 2026	21 Sep 2026	17 Sep 2026	Floor terminal	LMS-J-03-IND	17 Sep 2027	On time	OK
EXAMPLE	J-04	Employee	RG-01	Baseline course	All seven baseline modules (LM-01 to LM-07), taken together	Baseline	2026.1	Joiner: induction window	7 Sep 2026	21 Sep 2026	9 Sep 2026	E-learning	LMS-J-04-IND	9 Sep 2027	On time	OK
EXAMPLE	J-05	Employee	RG-01	Baseline course	All seven baseline modules (LM-01 to LM-07), taken together	Baseline	2026.1	Joiner: induction window	14 Sep 2026	28 Sep 2026	16 Sep 2026	E-learning	LMS-J-05-IND	16 Sep 2027	On time	OK
EXAMPLE	J-06	Employee	RG-01	Baseline course	All seven baseline modules (LM-01 to LM-07), taken together	Baseline		Joiner: induction window	21 Sep 2026	5 Oct 2026					Not yet due	OK	Induction window still open.
EXAMPLE	J-07	Employee	RG-01	Baseline course	All seven baseline modules (LM-01 to LM-07), taken together	Baseline		Joiner: induction window	28 Sep 2026	12 Oct 2026					Not yet due	OK	Induction window still open.
EXAMPLE	J-08	Agency worker	RG-01	Baseline course	All seven baseline modules (LM-01 to LM-07), taken together	Baseline	2026.1	Joiner: induction window	14 Sep 2026	28 Sep 2026	25 Sep 2026	Floor terminal	LMS-J-08-IND	25 Sep 2027	On time	OK
EXAMPLE	J-09	Contractor	RG-01	Baseline course	All seven baseline modules (LM-01 to LM-07), taken together	Baseline	2026.1	Joiner: induction window	21 Sep 2026	5 Oct 2026	23 Sep 2026	E-learning	LMS-J-09-IND	23 Sep 2027	On time	OK
EXAMPLE	Mark Ellis	Employee	RG-02	LM-08	Privileged access in practice	Role	2026.1	Before first use	21 Sep 2026	21 Sep 2026	18 Sep 2026	Classroom or briefing, with attendance sheet	ATT-2026-09-18-LM08	18 Sep 2027	On time	OK	Account adm-mellis. Before Tier 0 moved to security keys and time-limited elevation (P14).
EXAMPLE	Jana Novak	Employee	RG-02	LM-08	Privileged access in practice	Role	2026.1	Before first use	21 Sep 2026	21 Sep 2026	18 Sep 2026	Classroom or briefing, with attendance sheet	ATT-2026-09-18-LM08	18 Sep 2027	On time	OK	Account adm-jnovak. Before Tier 0 moved to security keys and time-limited elevation (P14).
EXAMPLE	Priya Shah	Employee	RG-02	LM-08	Privileged access in practice	Role	2026.1	Before first use	21 Sep 2026	21 Sep 2026	18 Sep 2026	Classroom or briefing, with attendance sheet	ATT-2026-09-18-LM08	18 Sep 2027	On time	OK	Account adm-pshah. Before Tier 0 moved to security keys and time-limited elevation (P14).
EXAMPLE	J-04	Employee	RG-08	LM-13	Handling customer data by email	Role	2026.1	Joiner: induction window	7 Sep 2026	21 Sep 2026	9 Sep 2026	E-learning	LMS-J-04-LM13	9 Sep 2027	On time	OK	Worked under supervision until done (AW-06).
EXAMPLE	Dan Morgan	Employee	RG-02	LM-08	Privileged access in practice	Role		Before first use	19 Oct 2026	19 Oct 2026					Not yet due	OK	Account adm-dmorgan. Due before Tier 1 moves to time-limited elevation (P14).
EXAMPLE	Li Chen	Employee	RG-02	LM-08	Privileged access in practice	Role		Before first use	19 Oct 2026	19 Oct 2026					Not yet due	OK	Account adm-lchen. Due before Tier 1 moves to time-limited elevation (P14).
EXAMPLE	Elena Lopez	Employee	RG-02	LM-08	Privileged access in practice	Role		Before first use	19 Oct 2026	19 Oct 2026					Not yet due	OK	Account elena.lopez. Due before Tier 1 moves to time-limited elevation (P14).
EXAMPLE	Helen Carter	Employee	RG-02	LM-08	Privileged access in practice	Role		Before first use	19 Oct 2026	19 Oct 2026					Not yet due	OK	Account helen.carter. Due before Tier 1 moves to time-limited elevation (P14).

Modules

The modules a completion can be for, from the Role-Based Security Training Matrix. Rows marked Default are the pack's; set each one's current version. The management body's training is recorded in the NIS2 pack's training plan (AW-07).

Row	Module ID	Title	Kind	Current version	Repeat every (months)	Records (calc)
Default	Baseline course	All seven baseline modules (LM-01 to LM-07), taken together	Baseline	[[e.g. 2026.1]]	12	9
Default	LM-01	Report it	Baseline	[[e.g. 2026.1]]	12	0
Default	LM-02	Fake sign-in pages	Baseline	[[e.g. 2026.1]]	12	0
Default	LM-03	Sign-in codes and prompts	Baseline	[[e.g. 2026.1]]	12	0
Default	LM-04	Unexpected attachments and links	Baseline	[[e.g. 2026.1]]	12	0
Default	LM-05	Money, bank details and urgent requests	Baseline	[[e.g. 2026.1]]	12	0
Default	LM-06	Customer and personal data	Baseline	[[e.g. 2026.1]]	12	0
Default	LM-07	Devices, updates and lost equipment	Baseline	[[e.g. 2026.1]]	12	0
Default	LM-08	Privileged access in practice	Role	[[e.g. 2026.1]]	12	7
Default	LM-09	Payments and supplier bank details	Role	[[e.g. 2026.1]]	12	0
Default	LM-10	Secure development and secrets	Role	[[e.g. 2026.1]]	12	0
Default	LM-11	Executive impersonation	Role	[[e.g. 2026.1]]	12	0
Default	LM-12	Identity checks at the service desk	Role	[[e.g. 2026.1]]	12	0
Default	LM-13	Handling customer data by email	Role	[[e.g. 2026.1]]	12	1

Lists

PersonType	RoleGroup	RoleGroupName	DueRule	Delivery	Kind
Employee	RG-01	Everyone with an account	Joiner: induction window	E-learning	Baseline
Agency worker	RG-02	Privileged users	Before first use	Classroom or briefing, with attendance sheet	Role
Contractor	RG-03	Finance and payment authority	Mover: by the move date	Floor terminal
Supplier staff	RG-04	Developers	Renewal	Supplier's equivalent training, with its record
	RG-05	Management body
	RG-06	Executives and their assistants
	RG-07	Service desk
	RG-08	Customer data handlers

Definitions

Definitions

Term	Meaning in this workbook
Training	A set piece of learning with a defined content and a record: the baseline course, a role module, the induction or the management body's session.
Baseline course	The short course everyone with an account completes every 12 months, made of the baseline modules. It can be taken in pieces across the year.
Role module	Training for a role at higher risk, on top of the baseline course, set by the training matrix.
Induction	The security part of a joiner's first days: the day-one essentials at first sign-in, and the induction course within the joiner window.
Due rule: Joiner: induction window	10 working days after the start date (the joiner window, P04 PF-09). Work under supervision until it is done. (AW-05, AW-06)
Due rule: Before first use	The date the access or authority is first used unsupervised: a privileged right made eligible (P14 PA-07), a first payment, a first change to production, a first reset. (AW-06)
Due rule: Mover: by the move date	The move date (P13 JML-08). A move within the same role group carries the module over. (AW-06)
Due rule: Renewal	12 months after the last completion. (AW-04, AW-06)
Evidence reference	Where the proof of the completion is kept: the learning system's record, an attendance sheet, or a supplier's training record. An auditor tests it.
Module version	The version of the module's content the person took. A completion is evidence only of the content of that version.
Status: On time	Completed on or before the due date.
Status: Late by n working days	Completed after the due date, by that many working days. Say why in Notes.
Status: Not yet due	Not completed; the due date has not passed.
Status: Overdue	Not completed and the due date has passed, as at the As-at date.
HRM-05	Role training done by its due date: Role modules that fell due in the period and were completed by their due date (AW-06, AW-07), out of all that fell due.
MC-36	Staff security training completion (P11): Staff in post at the period end who have completed the security training due for their role in the last 12 months, as a share of all staff in post.
(calc)	A column or cell the workbook calculates. Do not type or paste over it.
EXAMPLE	A worked example: a wholesale distributor with about 900 staff, three warehouses and an online ordering service that takes 60% of its orders, as at 30 Sep 2026. Delete before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 7.2 — Competence	The register as a whole: evidence that people have the competence and training their role needs
ISO/IEC 27001:2022	Clause 7.5 — Documented information	Completions: the training records kept as documented information, with the evidence each points to
NIST CSF 2.0	PR.AT-01 — “Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind”	Completions and Summary: awareness and training provided, and shown to have been provided
NIS2 — Directive (EU) 2022/2555	Article 20(2) — members of management bodies are required to follow training to identify risks and assess cybersecurity risk-management practices	Instructions: the management body's record is kept in the NIS2 pack's training plan; staff completions here
NIS2 — Directive (EU) 2022/2555	Article 21(2)(g) — “basic cyber hygiene practices and cybersecurity training”	The register as a whole: evidence of cybersecurity training as a risk-management measure
DORA — Regulation (EU) 2022/2554	Article 13(6) — “Financial entities shall develop ICT security awareness programmes and digital operational resilience training as compulsory modules in their staff training schemes. Those programmes and training shall be applicable to all employees and to senior management staff, and shall have a level of complexity commensurate to the remit of their functions. Where appropriate, financial entities shall also include ICT third-party service providers in their relevant training schemes in accordance with Article 30(2), point (i).”	Tailoring for financial entities: evidence that the compulsory training reached all employees and senior management
GDPR — Regulation (EU) 2016/679	Article 39(1)(b) — the data protection officer’s task “to monitor compliance with this Regulation, with other Union or Member State data protection provisions and with the policies of the controller or processor in relation to the protection of personal data, including the assignment of responsibilities, awareness-raising and training of staff involved in processing operations, and the related audits”	The register as evidence for the Data Protection Officer's monitoring of staff training
GDPR — Regulation (EU) 2016/679	Article 5(1)(e) — personal data shall be “kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed” (‘storage limitation’), with the exceptions the Article sets for archiving, research and statistics	Instructions: records kept no longer than the records policy sets, and simulation results never kept here

Editions referenced: ISO/IEC 27001:2022 incl. Amd 1:2024; NIST CSF 2.0; Directive (EU) 2022/2555 (NIS2) and Implementing Regulation (EU) 2024/2690; Regulation (EU) 2022/2554 (DORA); Regulation (EU) 2016/679 (GDPR)

ISO/IEC 27001 references name the clause or control this document relates to. They do not say that meeting it meets any other framework's requirement.