No — no major framework publishes a fixed percentage that staff training completion must hit. PCI DSS, ISO 27001 and the Essential Eight all express the requirement as an absolute: personnel receive awareness training on hire and at least once every 12 months (PCI DSS Requirement 12.6.3), or awareness training is implemented and evidenced (ISO 27001, Essential Eight). What assessors audit is the record — who was trained, when, and who acknowledged the policies — and the failure mode is not 94% versus 97%, it is named individuals with no completion record at all.
TL;DR
- No framework sets a minimum completion percentage — PCI DSS 12.6.3 requires training on hire and at least once every 12 months, full stop.
- What gets audited is evidence: per-person completion records, policy acknowledgments and a training programme reviewed at least every 12 months.
- The real failure is individuals with zero completions — the record gaps, not a rate a few points under an internal target.
- A monthly cadence with automated reminders and per-learner tracking is what keeps the record complete; Cyber Aware's human risk reporting builds the audit view.
Is there a minimum staff completion rate for compliance?
Search any major framework's text for a percentage and you will not find one. PCI DSS v4.0.1 Requirement 12.6.3 requires personnel to receive security awareness training upon hire and at least once every 12 months, through more than one method of communication, and to acknowledge at least once every 12 months that they have read and understood the security policy (Microsoft's PCI DSS awareness-training control mapping reproduces the requirement text directly). There is no "95% or better" clause.
The same pattern holds elsewhere. ISO 27001's Annex A control on awareness and education requires that personnel receive appropriate security awareness training — measured in whether it happened and is evidenced, not in a rate. The Essential Eight's maturity model contains no user-education strategy at all, so there is no completion rate to miss.
So where does the idea of a minimum come from? From good practice and from assessors applying professional judgement. A programme where most people completed but a handful did not is defensible with documented exceptions; a programme where nobody tracked completion is not.
What an assessor actually asks for
The questions that decide an audit are concrete:
- Who was due for training, and when? A roster of personnel mapped to their hire dates and last training dates — the clock under PCI DSS runs per employee from their own training date, not on a calendar year.
- Did they complete? Per-person completion records, not an aggregate number.
- Did they acknowledge the policy? A dated acknowledgment for each person at least once every 12 months.
- Is the programme itself reviewed? PCI DSS 12.6.2 requires the awareness programme to be reviewed at least once every 12 months and updated as needed — a stale programme fails even with perfect completions.
- Does the content cover the threats that matter? For cardholder-data environments, Requirement 12.6.3.1 specifically names phishing and social engineering; 12.6.3.2 covers acceptable use of end-user technology.
Notice what is missing: any question about a percentage. An assessor sampling five names wants five records, and a report showing "94% complete" without the per-person detail behind it answers nothing.
The failure modes that actually cost you
In practice, three gaps trip programmes up:
- The starter gap. Someone joined four months ago, never got assigned training, and nobody noticed until the audit. On-hire enrolment that fires automatically — new hires picked up by M365 or Google sync land in the programme with a welcome email — is the fix, and it is automated on the Cyber Aware platform.
- The silent leaver. A departed employee still on the roster drags the rate down and confuses the record. Clean removal on exit keeps the denominator honest.
- The never-chased overdue. Courses assigned but never nudged, quietly aging past due. A 7-day grace period plus due and overdue reminder emails is what turns an overdue list into completions.
All three are record problems, not motivation problems — and all three are solved by automation rather than by chasing staff by hand.
What rate should you actually aim for?
No framework answer exists, so pick an internal one and defend it. Two considerations set the bar:
- Auditors sample, they do not average. If an assessor pulls five random personnel files, any one of them without a completion record is a finding regardless of the headline rate. That argues for close to 100% of tracked personnel.
- Exceptions are acceptable when documented. Someone on extended leave, a contractor mid-onboarding — document the exception and the compensating control. Undocumented gaps are the problem.
The practical target most programmes land on internally is very high completion of everyone currently tracked, with documented exceptions for the remainder — because the per-person record is what the audit reads.
How to keep the rate up without chasing people
The mechanics that move completion from a spreadsheet chore to a background process:
- Assign on arrival. Sync enrolment from Microsoft 365 or Google Workspace, CSV or signup links, with baseline training assigned automatically.
- Remind on schedule. Due and overdue emails fire daily without anyone maintaining a list.
- Keep the cadence steady. A new course each month, auto-added, beats an annual marathon — short lessons get finished, and finished lessons are the record you need.
- Report by person. Compliance filters slice by overdue, enrolled and completed, so the audit question "show me everyone overdue" is one click — see the human risk reporting suite.
- Score the risk, not just the rate. A per-learner score built from overdue courses, failed quizzes and phishing results tells you who the exceptions are before the assessor finds them.
If you are not sure which framework your clients or contracts actually ask about — PCI DSS, ISO 27001, Essential Eight or SMB1001 — a security gap assessment maps the requirements to evidence you can hand over, and a platform comparison shows which vendors evidence Australian frameworks out of the box.
FAQ
Is there a minimum staff completion rate for compliance? No. PCI DSS, ISO 27001 and the Essential Eight express training requirements as absolutes — trained on hire, at least every 12 months, policy acknowledgment — with no published percentage.
How often does PCI DSS require security awareness training? Under Requirement 12.6.3, upon hire and at least once every 12 months, with policy acknowledgment at least annually and the programme itself reviewed at least every 12 months.
What content must PCI DSS training cover? Requirement 12.6.3.1 names phishing and social-engineering threats; 12.6.3.2 covers acceptable use of end-user technology — both mandatory since 31 March 2025.
Does the Essential Eight require staff training? No. The eight strategies are technical controls and the maturity model includes no user-education requirement — but ML1's own threat model assumes attackers trick users with social engineering.
What completion rate should a business target? One the business sets itself: near-complete coverage of all tracked personnel with documented exceptions, because assessors sample individuals rather than read the average.
What evidence proves completion to an auditor? Per-person completion records with dates, annual policy acknowledgments, the programme's own review record, and a roster showing who was due when.
One last thing
The expensive audit finding is never the rate a few points under target — it is the named person with no record. If your completion evidence lives in a spreadsheet someone maintains by hand, that is the gap to close this quarter.