---
title: "Does the Applicant employ mandatory annual InfoSec/privacy training for employees and contractors?"
url: https://insuranceposture.com/questions/governance-and-workforce/applicant-employ-mandatory-annual-infosec-privacy-training-employees-contractors
category: "Governance and workforce"
canonical_key: q_gov_004
evidence_state: attested
updated: 2026-08-24
---

# Does the Applicant employ mandatory annual InfoSec/privacy training for employees and contractors?

URL: https://insuranceposture.com/questions/governance-and-workforce/applicant-employ-mandatory-annual-infosec-privacy-training-employees-contractors
Section: Governance and workforce
Evidence state: Attested, not tenant-verifiable

The word to check in this question is contractors, because that is the population most training programmes quietly omit.

## What the carrier is actually asking

The carrier is asking whether information security and privacy training is mandatory, annual, and delivered to everyone with access to systems, including contractors and temporary staff.

## Why it is underwritten

Training addresses the human element that appears in the majority of breaches. Carriers ask because it is inexpensive, because completion is measurable, and because the populations excluded from training are usually the ones with the least oversight.

## Where the answer lives in Microsoft 365, Entra ID, and Azure

Training records live in a learning platform, so this is attested. Completion rate is the number that matters.

| Platform | Where the setting lives | What has to be true |
| --- | --- | --- |
| Training platform | Assignment and completion records by population | Completion rate against total workforce including contractors. Attested |
| Onboarding | Training delivered before or shortly after access is granted | New joiners trained at the start rather than at the next annual cycle |
| Content | What the training covers | Phishing, data handling, incident reporting, and role-specific content for higher-risk groups |
| Enforcement | Consequence for non-completion | A real consequence, since voluntary completion plateaus well below full coverage |
| Contractors | Whether contractors are enrolled | Included, since they often hold access and sit outside the human resources system that drives assignment |

**Contractors sit outside the assignment system**

Training is usually assigned from the human resources platform, which contains employees. Contractors with system access frequently exist only in the directory, so nothing assigns them training and nobody notices the omission.

## What a defensible yes requires

- Training is mandatory and completion is tracked to a percentage.
- Contractors and temporary staff are included.
- New joiners are trained at onboarding.
- Higher-risk roles receive additional targeted content.
- Non-completion has a consequence that is actually applied.

## How this answer goes wrong

Training is assigned annually and completion sits at seventy percent, with no follow-up. The answer is yes because the programme exists, and nearly a third of the workforce has not taken it. Carriers occasionally ask for the completion rate, which turns a yes into a number.

## If this answer turns out to be wrong

The attestation clause you sign lives in this block, and its wording decides whether your answers are treated as representations or as something stricter. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [whether an answer is a warranty or a representation](https://insuranceposture.com/glossary/warranty). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary).

## Frequently asked

### How often should training run?

Annual as the baseline with shorter reinforcement through the year. A single long annual session is the least effective format.

### Does phishing simulation count as training?

It complements rather than replaces it. Carriers ask about both, and the simulation question is where click rate is measured.

### What completion rate is expected?

Above ninety percent reads well. Below that suggests the mandatory element is not enforced.

### What about the board?

Include them. Executives and board members are high-value targets and are the group most commonly exempted.

## Related questions

- [Are phishing simulations conducted for all employees, with click rate tracking?](https://insuranceposture.com/questions/email-security/phishing-simulations-conducted-employees-click-rate-tracking)
- [Are employees with financial/accounting responsibility given social engineering and phishing training?](https://insuranceposture.com/questions/email-security/employees-financial-accounting-responsibility-given-social-engineering-phishing-training)
- [Does the Applicant terminate computer access promptly when employee/contractor leaves?](https://insuranceposture.com/questions/governance-and-workforce/applicant-terminate-computer-access-promptly-when-employee-contractor-leaves)
- [How does the Applicant handle repeat offenders/clickers in phishing simulations?](https://insuranceposture.com/questions/email-security/applicant-handle-repeat-offenders-clickers-phishing-simulations)

---

Insurance Posture by SecValley. https://insuranceposture.com
The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished.
SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact.
Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.