---
title: "PCI, ISO and NIST: awareness is not annual training | Whalemate"
description: "ISO, NIST, PCI DSS, CISA and ENISA point to a continuous, role-based program. Completion or click rates alone do not prove effectiveness."
url: https://www.whalemate.com/en/resources/blog/pci-iso-nist-awareness-not/
lang: en
updated: 2026-11-13
alternates:
  es: https://www.whalemate.com/recursos/blog/pci-iso-nist-awareness-curso/
  pt-BR: https://www.whalemate.com/br/recursos/blog/pci-iso-nist-awareness-nao/
index: https://www.whalemate.com/llms.txt
---

[Back to blog](https://www.whalemate.com/en/resources/blog/)

Blog

# PCI, ISO and NIST: awareness is not annual training

ISO, NIST, PCI DSS, CISA and ENISA point to a continuous, role-based program. Completion or click rates alone do not prove effectiveness.

Nov 13, 2026
By [Federico Hombre](https://www.whalemate.com/en/resources/blog/author/federico-hombre/)
12 min read

[Awareness](https://www.whalemate.com/en/resources/blog/topic/awareness/)

![PCI, ISO and NIST: awareness is not annual training](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/pci-iso-nist-awareness-not.webp)

In this article

1. [What changes when the frameworks are compared side by side](#s1)
2. [Why annual training is no longer enough](#s2)
3. [What ISO adds that a course does not solve](#s3)
4. [Are awareness and training the same?](#s4)
5. [What is being measured today, and what does NIST criticize?](#s5)
6. [Does click rate work as the main KPI?](#s6)
7. [What do simulations show when put in context?](#s7)
8. [Are simulations overrepresented?](#s8)
9. [Is the evidence of improvement solid or disputed?](#s9)
10. [Which metrics hold up better in an audit and a risk decision?](#s10)
11. [What minimum content should the program cover?](#s11)
12. [What does this mean for LATAM, compliance and data protection?](#s12)
13. [Operational consequences for CISOs, IT and compliance teams in LATAM](#s13)
14. [What to read next?](#s14)

Cybersecurity awareness training, viewed through ISO/IEC 27001:2022, ISO/IEC 27002:2022, NIST, PCI DSS v4.0, CISA, NCSC and ENISA, cannot be managed like an annual course with a completion rate. Comparing the frameworks with operational evidence points to a different model: a [continuous program](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-50r1.pdf) tailored to role, delivered through multiple channels, and measured through behavior and reporting as well. At the same time, several sources question whether [click rate](https://www.whalemate.com/en/resources/blog/nist-what-measure-security-awareness/) should be the main or only KPI for judging risk or effectiveness.

## What changes when the frameworks are compared side by side

None of the source material brings together in one view what each framework requires or recommends on frequency, role tailoring, channels, content and evidence. Placed side by side, the issue is not choosing between a course, a simulation or a campaign, but designing a continuous, auditable control with behavior-based metrics.

| Standard | Program nature | Minimum frequency | Role tailoring | Channels or methods | Minimum content | What to measure or evidence | Source |
| --- | --- | --- | --- | --- | --- | --- | --- |
| NIST | Distinguishes awareness from training. Awareness aims to focus attention on security and enable people to recognize issues and respond, while training is more formal and seeks to build knowledge and skills for job performance. SP 800-50 Rev. 1 defines it as a foundational cybersecurity and privacy program for all personnel | not specified | intended to help participants understand their role in protecting information assets, cybersecurity and privacy | instructor-led or online courses, exercises or other methods | acceptable uses and risks of organizational systems | percentage of participants who changed a work behavior, for example reporting a suspicious phishing email. The NIST Phish Scale includes click rates, report rates, repeat click rates and protectors. NIST warns that click rate alone is not enough | NIST |
| ISO/IEC 27001:2022 | requires awareness within the information security management system | not specified | people working under the organization’s control must know their contribution to the effectiveness of the information security management system | not specified | the information security policy, their contribution to the system’s effectiveness, and the consequences of failing to meet system requirements | whether people know the policy, their contribution and the consequences of noncompliance | ISO/IEC 27001:2022 |
| ISO/IEC 27002:2022 control 6.3 | staff and relevant interested parties should receive appropriate information, education and training, plus periodic updates on policies and procedures according to their role | periodic updates | according to role | physical or virtual channels, such as campaigns, brochures, posters, newsletters, websites, briefings, e-learning modules and emails | management commitment, applicable obligations, personal responsibility, basic security procedures and points of contact for advice | not specified | ISO/IEC 27002:2022 control 6.3 |
| PCI DSS v4.0 | security awareness education is an ongoing activity and requires a formal awareness program | program review at least once every 12 months, training at hire and at least once every 12 months, acknowledgment at least once every 12 months | all staff must know their role in protecting cardholder data | use multiple communication methods | entity security policies and procedures, threats and vulnerabilities that could affect CDE security, including phishing and related attacks, and social engineering | obtain acknowledgment that the person read and understood the security policies and procedures. PCI SSC recommends recording who takes the training, whether it is completed successfully, comprehension through assessments and feedback, and reports of malicious emails | PCI DSS v4.0 |
| CISA | recommends basic cybersecurity training and anti-phishing training as part of a standard program | at least annually, new employees within 10 days of onboarding, annual review of phishing material | for all employees and contractors | a six-week Phishing Campaign Assessment that measures workforce susceptibility to phishing lures and whose results can guide anti-phishing training | phishing, business email compromise, operational security and passwords, education on social engineering and phishing, and communicating the importance of reporting suspicious emails, links, attachments or other lures | workforce propensity to click on phishing lures | CISA |
| NCSC | warns that phishing simulations are often overrepresented in defenses | not specified | not specified | training package for staff on strong passwords, device protection, phishing defense and incident reporting | phishing defense and incident reporting | in addition to how many people clicked, measure how many reported. Do not reprimand people who struggle to recognize phishing because fear of retaliation can keep them from reporting | NCSC |
| ENISA | recommends measuring cybersecurity behavior, conducting regular assessments of trends and challenges, and planning awareness campaigns as parts of an awareness program | campaigns repeated at least six times | messages aimed at specific audiences through the channels and devices they prefer | campaigns, regular phishing simulations, initial assessment before intervention | not specified | define metrics before designing activities, percentage decrease in incidents, number of incidents reported, number of positive test results and increased knowledge level | ENISA |
| Chile according to Fensivo | for providers of essential services and operators of vital importance, it describes an obligation for continuous training and awareness | continuous | not specified | must be planned, carried out and documented within a continuously maintained information security management system | not specified | lack of records of training actions and programs counts as noncompliance | Fensivo |

## Why annual training is no longer enough

PCI DSS v4.0 turns the requirement into concrete obligations. According to PCI DSS v4.0, the program must be reviewed at least once every 12 months, training must be given at hire and at least once every 12 months, and acknowledgment that the person read and understood the security policies and procedures must also be obtained at least once every 12 months.

But the PCI Security Standards Council guidance says something stricter in practice: awareness should be a continuous program, not a yearly standalone activity, to maintain awareness on a daily basis. Whalemate’s reading is that the annual minimum may satisfy documentary compliance, but it does not prove sustained management of human risk.

## What ISO adds that a course does not solve

ISO/IEC 27001:2022, in [clause 7.3 Awareness](https://www.whalemate.com/en/resources/blog/iso-27001-2022-requires-continuous/), requires people to know the information security policy, their contribution to the system’s effectiveness, and the consequences of not meeting the requirements, according to the public text of the standard. That shifts the focus from attending training to proving the organization achieved understanding relevant to the management system.

ISO/IEC 27002:2022 control 6.3 adds that staff and relevant interested parties should receive appropriate information, education and training, with [periodic updates](https://service.securitm.ru/docs/iso-iec-27002-2022-en-c6-7/6-3-information-security-awareness-education-and-training) according to their role, according to the public copy of the control. It also lists physical and virtual channels, from campaigns and posters to newsletters, briefings, e-learning and emails. Whalemate reads this as ISO pushing a segmented, multimodal program, not a single uniform module for the entire organization.

## Are awareness and training the same?

NIST says no. According to the NIST glossary, awareness aims to focus attention on security and enable people to recognize issues and respond, while training is more formal and seeks to build knowledge and skills for job performance.

The difference matters for budget, design and evidence. According to NIST SP 800-50 Rev. 1, awareness and training is a foundational program for all personnel, and training can include instructor-led or online courses, exercises or other methods. Whalemate’s reading is that mixing both concepts into one course often produces programs that neither change behavior nor build role-specific capabilities.

## What is being measured today, and what does NIST criticize?

In a survey of federal organizations cited by NIST, training completion was the most common effectiveness measure, at 84%, and click rate in phishing simulations was second, at 72%. That shows how many organizations still evaluate the program with two easy-to-audit metrics.

But NIST warns that phishing programs often use click rate as the only metric, and says exercises should consider the human element and context to assess effectiveness and progress. According to the NIST Phish Scale, reporting rates, repeat click rates and protectors should also be considered. Whalemate’s reading is that a dashboard based only on completion rate and click rate simplifies audit work, but weakens risk decisions.

## Does click rate work as the main KPI?

It does, but used badly it can confuse more than it clarifies. Proofpoint says click rate in phishing tests alone should not represent the impact or success of an awareness program, even though it reported an average failure rate of 4.93% across all organizations and campaigns analyzed.

NCSC goes in the same direction. According to NCSC, in addition to measuring how many people clicked, organizations should measure how many reported, and measuring only the absence of reports can encourage employees to hide problems. Whalemate’s reading is that click rate can be a useful signal, but not a governing KPI or a basis for discipline.

## What do simulations show when put in context?

UNICC offers a key data point for avoiding apples-to-oranges comparisons. According to UNICC, using NIST difficulty in its report, click rate was 5.74% for low-difficulty messages, 12.10% for medium difficulty and 36.15% for high difficulty.

That contrast makes it risky to use benchmarks without normalizing difficulty or population. Comparing those numbers with the 4.93% average failure rate reported by Proofpoint cannot be read as if both figures measured exactly the same thing, because Proofpoint itself says the number depends on the campaigns and the study population. Whalemate’s reading is that a benchmark without difficulty context can reward easy campaigns and punish better-designed ones.

Whalemate

Want to see Whalemate in your organization?

Book a demo. We will walk through email and QRishing simulations for your team, and what CISO, IT or compliance can decide from there.

[Book a demo](https://www.whalemate.com/en/demo/)

## Are simulations overrepresented?

CISA uses them as an operational tool. According to CISA guidance on counter-phishing, a [six-week](https://www.cisa.gov/sites/default/files/publications/Capacity_Enhancement_Guide-Counter-Phishing_Recommendations_for_Federal_Agencies_1_0.pdf) Phishing Campaign Assessment measures workforce susceptibility to phishing lures and its results can guide anti-phishing training.

NCSC puts a limit on that centrality. According to NCSC, phishing simulations are often overrepresented in defenses, detecting all phishing is difficult, and spear phishing is even harder to identify. Whalemate’s reading is that simulations are useful for spotting exposure and segmenting interventions, but lose value when they replace the entire program.

## Is the evidence of improvement solid or disputed?

There is evidence of improvement, but it is neither linear nor sufficient on its own. According to KnowBe4, based on vendor data covering 67,718,305 simulations, 14,508,441 users and 62,460 organizations, the global average Phish-prone Percentage fell from 32.9% before training to 4.8% after 12 months of sustained training. The source matters because it is not an independent study.

On the other side, the arXiv study titled "Anti-Phishing Training Does Not Work" questions whether anti-phishing training necessarily produces the expected result and says an [isolated click rate](https://www.arxiv.org/pdf/2506.19899) is not enough to infer learning or reduced risk. Whalemate’s reading is that the debate is no longer about whether to train or not, but what kind of training, for whom, with what measurement and against which expected behavior.

## Which metrics hold up better in an audit and a risk decision?

ENISA recommends defining metrics before designing awareness activities so their effectiveness and reach can be assessed in the short and long term. It also proposes measuring the percentage decrease in incidents, the number of incidents reported, the number of positive test results and the increased knowledge level, according to its practical material.

NIST SP 800-50 Rev. 1 proposes measuring behavior change per participant, for example the percentage of participants who changed a work behavior such as reporting a suspicious email. PCI SSC recommends recording who takes the training, whether it is completed successfully, comprehension through assessments and feedback, and reports of malicious emails. Whalemate’s reading is that the minimum useful set combines compliance evidence, comprehension and observable behavior.

## What minimum content should the program cover?

Content depends on the applicable framework, but there is a common core. According to ISO/IEC 27001:2022, people must know the policy, their contribution to the system and the consequences of noncompliance. According to ISO/IEC 27002:2022 control 6.3, awareness should cover management commitment, applicable obligations, personal responsibility, basic security procedures and points of contact for advice.

If the organization is under PCI DSS v4.0, the floor is more specific. According to requirement 12.6.3.1, training must include threats and vulnerabilities that could affect CDE security, including phishing and related attacks, and social engineering. CISA also recommends covering phishing, business email compromise, operational security and passwords. Whalemate’s reading is that the content should come from the risk map and the applicable framework, not from a generic vendor catalog.

## What does this mean for LATAM, compliance and data protection?

In Brazil, LGPD, Law 13.709, requires controllers and others involved in any phase of processing to guarantee the information security provided for in the law regarding personal data, even after processing ends, according to Brazil’s ANPD. In addition, ANPD published information security guidance for small processing agents that includes, according to DLA Piper, suggestions such as awareness and training programs.

For Chile, one Fensivo source describes for providers of essential services and operators of vital importance an obligation for continuous training and awareness, and adds that the lack of records of training actions and programs counts as noncompliance. Because the material itself says so, that should be read as that source’s regulatory interpretation, not generalized to all of LATAM. Whalemate’s reading is that, even outside PCI, the regional expectation points to documented, continuous and traceable programs.

## Operational consequences for CISOs, IT and compliance teams in LATAM

If the program had to be redesigned tomorrow, the useful decision is not to chase only who completed the course. The combination of NIST, ISO/IEC 27001:2022, ISO/IEC 27002:2022, PCI DSS v4.0, CISA, NCSC and ENISA suggests treating cybersecurity awareness training as a continuous, auditable control, segmented by function, with onboarding, periodic review, multiple channels and specific content on phishing and social engineering when relevant.

The dashboard changes too. According to ENISA, NIST, NCSC and PCI SSC, it makes sense to combine completion and policy acknowledgment with behavior and risk metrics, such as phishing reports, behavior change, incidents reported, before-and-after results and the difficulty context of simulations. For IT, CISO and compliance teams in LATAM, a [Human Risk Management](https://www.whalemate.com/en/resources/blog/human-risk-management-what-measures/) approach lets them use those signals to prioritize interventions and show effectiveness without reducing the program to clicks or attendance.

## What to read next?

- [Awareness on the platform](https://www.whalemate.com/en/platform/advanced-simulations/)
- [LATAM Awareness Platforms: What to Evaluate](https://www.whalemate.com/en/resources/blog/latam-awareness-platforms-what-evaluate/)
- [NIST and CISA on social engineering](https://www.whalemate.com/en/resources/blog/nist-cisa-social-engineering/)

[See the full topic guide](https://www.whalemate.com/en/platform/advanced-simulations/)

Questions

## Frequently asked questions

**Is cybersecurity awareness training the same as an annual course?**

No. According to NIST, awareness and training are not the same, and according to PCI SSC, awareness must be a continuous program, not an isolated annual activity. ISO/IEC 27002:2022 control 6.3 also points to using periodic updates and multiple channels. An annual course can be one piece of the program, not the complete program.

**What should a CISO measure besides the completion rate?**

According to NIST SP 800-50 Rev. 1, it is advisable to measure behavior change, for example whether reporting of suspicious emails increases. According to ENISA, useful measures also include a decrease in incidents, the number of incidents reported, positive test results, and increased knowledge. NCSC adds another layer: measure reports in addition to clicks.

**Is click rate in simulated phishing enough to demonstrate effectiveness?**

No, not by itself. NIST warns that click rate as a single metric is not enough, and the NIST Phish Scale proposes adding context and other signals such as reports, repeat click rates, and protectors. NCSC and Proofpoint also question using it as a standalone indicator of program success.

**What does PCI DSS v4.0 require for awareness?**

According to PCI DSS v4.0, awareness is an ongoing activity. Requirement 12.6 calls for a formal program, 12.6.2 requires review at least every 12 months, 12.6.3 requires training at hire and at least every 12 months, multiple communication methods, and annual acknowledgment of policies, and 12.6.3.1 requires content on phishing and social engineering.

**What decision does this approach enable for compliance and IT?**

It enables a shift from an administrative decision, who completed it, to a risk decision, which people, functions, or areas need priority intervention. With combined metrics from courses, simulations, reports, and behavior, the team can segment campaigns, adjust content, document evidence for audit, and demonstrate that the program reduces exposure, not just that it was delivered.

Whalemate

Is this risk in your program?

If this article describes something you already faced — or that the board is asking you to explain — book a demo.

[Book a demo](https://www.whalemate.com/en/demo/)

## Would you like to go deeper on this topic?

Open this article directly in Claude or ChatGPT — ask questions, get a summary, or explore related ideas.

- [Open with Claude](https://claude.ai/new?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CPCI%2C%20ISO%20and%20NIST%3A%20awareness%20is%20not%20annual%20training%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.)
- [Open with ChatGPT](https://chatgpt.com/?q=I%27m%20reading%20a%20Whalemate%20article%20titled%20%E2%80%9CPCI%2C%20ISO%20and%20NIST%3A%20awareness%20is%20not%20annual%20training%E2%80%9D.%20Explain%20the%20key%20ideas%20and%20what%20an%20IT%20team%20or%20CISO%20should%20do%20next.%20Reply%20in%20English%2C%20clearly%20and%20with%20actionable%20steps.)

In this article

1. [What changes when the frameworks are compared side by side](#s1)
2. [Why annual training is no longer enough](#s2)
3. [What ISO adds that a course does not solve](#s3)
4. [Are awareness and training the same?](#s4)
5. [What is being measured today, and what does NIST criticize?](#s5)
6. [Does click rate work as the main KPI?](#s6)
7. [What do simulations show when put in context?](#s7)
8. [Are simulations overrepresented?](#s8)
9. [Is the evidence of improvement solid or disputed?](#s9)
10. [Which metrics hold up better in an audit and a risk decision?](#s10)
11. [What minimum content should the program cover?](#s11)
12. [What does this mean for LATAM, compliance and data protection?](#s12)
13. [Operational consequences for CISOs, IT and compliance teams in LATAM](#s13)
14. [What to read next?](#s14)

Whalemate

Is this risk in your program?

[Book a demo](https://www.whalemate.com/en/demo/)

## Related articles

[!\[NITAM needs a measurable insider threat program\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/nitam-needs-measurable-insider-threat.webp)](https://www.whalemate.com/en/resources/blog/nitam-needs-measurable-insider-threat/)

Awareness

Nov 12, 2026
By Federico Hombre

### NITAM needs a measurable insider threat program

NITAM is useful only if September becomes a measurable program for reporting, detection, and response, not isolated training.

Read more

[!\[CISA and NIST on cyberattack simulations\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/cisa-nist-cyberattack-simulations.webp)](https://www.whalemate.com/en/resources/blog/cisa-nist-cyberattack-simulations/)

Awareness

Nov 10, 2026
By Federico Hombre

### CISA and NIST on cyberattack simulations

CISA, NIST, and ISO/IEC 27001 show what to measure in simulations: clicks, reports, opens, difficulty

Read more

[!\[Phishing types need separate metrics\](https://lvaxvhnlaeradaprhyqy.supabase.co/storage/v1/object/public/editorial/blog-covers/phishing-types-need-separate-metrics.webp)](https://www.whalemate.com/en/resources/blog/phishing-types-need-separate-metrics/)

Awareness

Nov 9, 2026
By Federico Hombre

### Phishing types need separate metrics

CISO, IT, and compliance teams should manage phishing by channel, target, control, and metric, not as a list of labels.

Read more

[See all articles](https://www.whalemate.com/en/resources/blog/)