If an assessor, insurer or client is asking how your security awareness training maps to the Essential Eight, what they want is evidence — dated, specific and consistent. Here is what to keep, what auditors and reviewers actually check, and the failures that cost marks.
Key takeaways
- The eight Essential Eight strategies do not score general staff awareness training at Maturity Level 1 — but privileged-user training is a specific ISM requirement, and insurers, tenders and clients ask for training evidence anyway.
- A usable evidence pack has five parts: enrolment records, completion rates, phishing simulation history, remediation notes and policy acknowledgement — each dated.
- Assessors look for cadence and coverage, not volume: monthly or quarterly activity across the whole workforce beats one annual certificate.
- Platforms like Cyber Aware generate the pack automatically; the failure mode is keeping evidence in inboxes and spreadsheets nobody can retrieve on assessment day.
Is security awareness training even required for the Essential Eight?
Strictly: the Essential Eight assesses eight technical strategies — application control, patching, multi-factor authentication, admin privileges, macros, application hardening and backups. General staff awareness training is not one of the eight, and an Essential Eight Maturity Level 1 rating does not rise or fall on it.
Two important exceptions make the question moot in practice. First, the ACSC's Information Security Manual requires specific training for privileged users (ISM control ISM-1565), so any organisation targeting higher maturity levels or managing admin accounts needs documented, role-specific training. Second, almost nobody asks for the Essential Eight in isolation: cyber insurance questionnaires, government tenders and client due-diligence forms ask for your Essential Eight posture and your staff training evidence together. Building the training evidence pack now avoids a scramble later.
The evidence pack: what to keep
| Evidence | What good looks like | Why it is asked for |
|---|---|---|
| Enrolment records | Every current staff member auto-enrolled, with start dates | Proves coverage, not just a pilot group |
| Completion reports | Percentage complete per module, per month, with counts | Shows the training actually happens |
| Phishing simulation history | Campaign dates, send volumes, click rates and report rates over time | Demonstrates measured improvement, not a one-off test |
| Remediation notes | What happened after a failed simulation — who was retrained, when | Shows failures trigger action, not blame |
| Policy acknowledgement | Signed or click-accepted security policy with dates | Ties the training to an enforceable rule |
Keep every item dated. An undated training certificate or a screenshot of a dashboard with no timestamp is the single most common reason evidence gets discounted.
What assessors and reviewers actually check
Auditors, insurers and tender reviewers rarely read training content. They check four things:
- Coverage — is every current employee enrolled, including new starters and contractors?
- Cadence — is training happening monthly or quarterly, or was it a one-off induction?
- Trajectory — do phishing simulation click rates fall over time, and do report rates rise?
- Response — when someone clicks, does anything happen?
A one-page report answering those four questions with dates and numbers satisfies nearly every request. A 40-slide course library without completion data satisfies none of them.
Common evidence failures
- Annual-only training. One session in February does not answer an assessor's cadence question in November.
- Aggregates without denominators. "95% completion" means nothing without the headcount it is measured against.
- No baseline. Without a first simulation, you cannot show improvement — the metric reviewers value most.
- Evidence stored in inboxes. If your proof lives in a former IT admin's mailbox, you do not have evidence; you have a story.
- Blame-based remediation. Records showing staff disciplined for simulation failures raise questions about programme quality rather than answering them.
How to generate the pack without admin work
This is exactly what Cyber Aware's human risk reporting produces: enrolment synced from your email directory, completion rates per team, phishing simulation history with click and report-rate trends, and remediation logged automatically — exportable as a dated PDF for an assessor, insurer or tender response. Teams that sync enrolment and run a monthly simulation from day one have a twelve-month evidence trail by the time anyone asks.
If you are starting from zero, run a gap assessment first: it tells you which of the five evidence items you already have and which need building before the next review.
Related questions
Do phishing simulations satisfy Essential Eight requirements?
They are not a scored requirement at Maturity Level 1, but simulation history is the strongest single piece of training evidence you can show an assessor, insurer or client — it is dated, repeated and measured.
How long should training evidence be kept?
Keep at least the current and previous 12 months. Insurers and tender reviewers typically ask about the last policy year; assessors may sample further back for privileged-user training.
Who counts as a privileged user for ISM-1565?
Anyone with administrative access: domain admins, Microsoft 365 global admins, firewall and backup system operators. They need role-specific training records separate from general staff training.
FAQ
Does the Essential Eight require security awareness training for all staff? Not at Maturity Level 1 — the eight strategies are technical controls. But ISM-1565 requires specific training for privileged users, and insurers, tenders and clients routinely ask for all-staff training evidence alongside your Essential Eight rating.
What is the fastest way to build an evidence pack? Sync enrolment from your email directory, run a baseline phishing simulation, then keep a monthly cadence. Automated platforms produce the dated records as a by-product; manual programmes need a spreadsheet discipline most teams abandon by month three.
Can we use our MSP's training programme as our evidence? Yes, as long as the records are in your name and retrievable by you. Ask your MSP for the export before you need it — the report, not the platform, is the evidence.