Security Baseline
The questionnaire doesn’t ask if you’re secure. It asks for proof your people are trained.
SOC 2 auditors, enterprise customers and cyber insurers all carry the same line: documented security awareness training. Sixteen courses built from CISA, NIST and FBI guidance, with every claim cited to its source, turn that line from a gap into an attachment.
- SOC 2
- Cyber insurance
- Enterprise questionnaires
- CISA, NIST, FBI
- ISO/IEC 27001
In 80 seconds
Prefer to watch?
The same arc as this page, only faster: where the line shows up, why cited sources are the answer, and what your auditor gets to see.
Where the line shows up
Three moments, one question.
Nobody buys awareness training because a law says so. They buy it the week someone asks for proof.
Every SOC 2 audit and most enterprise vendor questionnaires carry the same control: security awareness training for all staff, with evidence. An empty line here stalls the deal, quietly.
Carriers price the human factor. "Do you run security awareness training?" is a standard underwriting question, and the answer changes premiums, or whether you are quoted at all.
Your largest prospects ask first. In a competitive evaluation, the vendor who attaches certificates the same day beats the vendor who promises them next quarter.
Training your auditor can trace to the source.
Most awareness content is opinion with a quiz. Ours is built the other way around: official text first, CISA guidance, NIST special publications, FBI advisories, then a structured source tree, then the course. Every statement a learner sees carries a citation to that source, and the certificate names what was covered.
That is the difference an auditor can see. "We trained our people" is a claim. "We trained our people on the CISA/NIST guidance, here is the content, here are the pass marks" is an answer.
The curriculum
Fifteen topics, US sources, English throughout.
Plus ISO/IEC 27001 fundamentals. The one standard your customers’ security teams speak everywhere. Our own answers to that questionnaire →
Recognizing Phishing & Social Engineering
CISA/NSA/FBI/MS-ISAC — Phishing Guidance: Stopping the Attack Cycle at Phase One
Story · 20 min + micro seriesPasswords, Passkeys & MFA
NIST SP 800-63B-4 — Digital Identity Guidelines: Authentication
Story · 15 min + micro seriesRansomware & Malware
CISA — Malware, Phishing, and Ransomware
Story · 15 min + micro seriesHandling Email & Attachments Safely
CISA — Recognize and Report Phishing
Story · 15 min + micro seriesMobile & Remote Work
NIST SP 800-46 Rev. 2 — Enterprise Telework, Remote Access and BYOD Security
Story · 20 min + micro seriesClean Desk & Physical Security
CISA — Physical Security
Story · 15 min + micro seriesUsing Cloud & Collaboration Tools Safely
CISA — Secure Cloud Business Applications (SCuBA)
Story · 20 min + micro seriesRemovable Media & USB
CISA — Using Caution with USB Drives
Story · 15 min + micro seriesCEO Fraud & Payment Fraud (BEC)
FBI IC3 — Business Email Compromise
Story · 15 min + micro seriesSocial Media & Information Disclosure
CISA — Staying Safe on Social Networking Sites
Story · 15 min + micro seriesRecognizing & Reporting Security Incidents
NIST SP 800-61 Rev. 3 — Incident Response Recommendations
Story · 15 min + micro seriesUsing AI Tools Safely
NIST AI 600-1 — Generative AI Profile (AI Risk Management Framework)
Story · 20 min + micro seriesSpotting Deepfakes
NSA/FBI/CISA — Contextualizing Deepfake Threats to Organizations
Story · 15 min + micro seriesSecurity for Admins & Power Users
NIST SP 800-53 Rev. 5 — Access Control (AC)
Story · 20 min + micro seriesClassifying Information Correctly
FIPS 199 — Standards for Security Categorization
Story · 15 min + micro seriesISO/IEC 27001 — ISMS Fundamentals
ISO/IEC 27001: the international standard behind most security questionnaires
Story + micro seriesPricing
Per user, per year. In dollars.
All sixteen courses, both formats, certificates and audit export included. Annual billing; three-year prepay takes 20% off. Create an account, invite your team, and book self-serve up to 250 users: above that, a quote takes one email and one business day.
| Users | Annual | 3-year prepay |
|---|---|---|
| 1–25 | $24 /user/yr | $19.20 /user/yr |
| 26–100 | $21 /user/yr | $16.80 /user/yr |
| 101–250 | $18 /user/yr | $14.40 /user/yr |
| 251–1000 | $15 /user/yr | $12 /user/yr |
| 1000+ | Volume quote: get in touch | |
Certificates, pass marks, audit export.
The deliverable is not attendance. It is documented, auditable evidence: per-learner certificates with dates, content and pass marks, exportable as an audit pack the day the questionnaire arrives.
Common questions
What US teams ask first
No, deliberately. We build security awareness training with every claim cited to its official source. State-by-state employment law is a different business with different liability, and there are established vendors for it. If you need both, we will say so and point you to one.
Every topic ships in two formats: a story-driven course (15–20 minutes, scenario-based, with a final test) and a micro series of five short episodes for refreshers and busy teams. All content is written natively in English from the cited US source, not translated.
Certificates with dates, content covered and pass marks, per learner: exportable as an audit pack the day the questionnaire arrives. The deliverable is not attendance; it is documentation an auditor can trace to the source guidance.
That is our second package: EU Readiness: GDPR, the EU AI Act’s training duty, NIS2 supply-chain questionnaires, built from the official EU texts. See conformbase.com/en/eu-readiness.
Per user per year, in dollars: $24 at the entry band down to $15 at 251–1000 users, minus 20% on a three-year prepay. The full table is on this page. Above 1000 users we quote individually, and a demo takes twenty minutes.