Does the Applicant employ mandatory annual InfoSec/privacy training for employees and contractors?
The word to check in this question is contractors, because that is the population most training programmes quietly omit.
What the carrier is actually asking
The carrier is asking whether information security and privacy training is mandatory, annual, and delivered to everyone with access to systems, including contractors and temporary staff.
Why it is underwritten
Training addresses the human element that appears in the majority of breaches. Carriers ask because it is inexpensive, because completion is measurable, and because the populations excluded from training are usually the ones with the least oversight.
Where the answer lives in Microsoft 365, Entra ID, and Azure
Training records live in a learning platform, so this is attested. Completion rate is the number that matters.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| Training platform | Assignment and completion records by population | Completion rate against total workforce including contractors. Attested |
| Onboarding | Training delivered before or shortly after access is granted | New joiners trained at the start rather than at the next annual cycle |
| Content | What the training covers | Phishing, data handling, incident reporting, and role-specific content for higher-risk groups |
| Enforcement | Consequence for non-completion | A real consequence, since voluntary completion plateaus well below full coverage |
| Contractors | Whether contractors are enrolled | Included, since they often hold access and sit outside the human resources system that drives assignment |
Training is usually assigned from the human resources platform, which contains employees. Contractors with system access frequently exist only in the directory, so nothing assigns them training and nobody notices the omission.
What a defensible yes requires
- Training is mandatory and completion is tracked to a percentage.
- Contractors and temporary staff are included.
- New joiners are trained at onboarding.
- Higher-risk roles receive additional targeted content.
- Non-completion has a consequence that is actually applied.
How this answer goes wrong
Training is assigned annually and completion sits at seventy percent, with no follow-up. The answer is yes because the programme exists, and nearly a third of the workforce has not taken it. Carriers occasionally ask for the completion rate, which turns a yes into a number.
Frequently asked
How often should training run?
Annual as the baseline with shorter reinforcement through the year. A single long annual session is the least effective format.
Does phishing simulation count as training?
It complements rather than replaces it. Carriers ask about both, and the simulation question is where click rate is measured.
What completion rate is expected?
Above ninety percent reads well. Below that suggests the mandatory element is not enforced.
What about the board?
Include them. Executives and board members are high-value targets and are the group most commonly exempted.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture