Frequently Asked Questions

Frequently Asked Questions About CFISA Training

Find answers about CFISA cybersecurity training, eLearning administration, pricing, live training, enterprise delivery, Security Awareness Training, PCI DSS and HIPAA.

Training & Course Basics

Start with the basics.

Learn what security awareness training is, who should receive it and the ways CFISA can deliver training to your organization.

What is security awareness training?

Security awareness training teaches employees how to recognize and respond to cybersecurity risks they may encounter at work, including phishing, social engineering, unsafe passwords, email threats and other common attack methods.

CFISA provides cybersecurity awareness training designed to help employees make safer decisions and understand their role in protecting organizational information and systems.

For a deeper overview, visit What Is Security Awareness Training?

Who should receive security awareness training?

Security awareness training is appropriate for employees, contractors and other workforce members who use organizational systems, email, devices or sensitive information.

Because attackers frequently target people rather than technology, training should extend beyond IT staff to the broader workforce. Some organizations may also have industry, contractual or regulatory requirements that affect who must be trained.

How often should employees receive security awareness training?

Security awareness should be reinforced regularly rather than treated as a one-time event. Many organizations provide training when employees are hired and repeat or refresh training periodically based on their risk, policies and compliance requirements.

Specific requirements can vary by industry. For example, PCI DSS includes its own security awareness training requirements.

What training formats does CFISA offer?

CFISA offers several ways to deliver cybersecurity awareness training:

• Self-paced eLearning
• Live in-person training
• Live virtual webinar training
• Enterprise and LMS-based delivery for organizations with broader deployment requirements

The right option depends on your workforce, training goals and how you want to administer the program.

eLearning & Administration

Simple for employees. Practical for administrators.

CFISA-hosted eLearning gives organizations a straightforward way to assign training, manage employees and document completion.

How does CFISA eLearning work?

CFISA-hosted eLearning gives employees access to online cybersecurity training they can complete through a web browser. Organizations can add employees, assign training and monitor completion through the administrative platform.

For organizations that prefer to deliver CFISA courses through their own LMS, separate enterprise and SCORM options are also available.

Can employees complete training on their own schedule?

Yes. CFISA eLearning is self-paced, allowing employees to complete assigned training online rather than requiring everyone to attend a scheduled live session.

Organizations can still establish their own training deadlines and completion expectations.

How are employees added to CFISA eLearning?

Administrators can add individual employees to the training platform as needed. This works well when onboarding new employees or making occasional additions to an existing training group.

For larger groups, CFISA also supports bulk employee uploads.

Can administrators add employees in bulk?

Yes. Administrators can add multiple employees through a bulk upload rather than entering each person individually.
This makes it easier to launch training for larger teams or import an existing employee roster.

How are courses assigned?

Courses can be assigned to employees through the CFISA training platform. Depending on how your organization’s training program is configured, assignments can be managed for individual employees or groups of employees.

CFISA can help organizations determine the appropriate course assignments when setting up their training program.

Can multiple managers administer training?

Yes. Organizations can support multiple managers or administrators where appropriate, making it possible to distribute responsibility for managing training across departments, locations or other organizational groups.

What reporting is available?

Administrators can monitor employee training activity and completion through CFISA’s reporting tools. Reports help organizations identify who has completed assigned training and who still has training outstanding.

This provides documentation that can support internal training records, management follow-up and compliance programs.

Do employees receive Certificates of Completion?

Yes. Employees receive a Certificate of Completion after successfully completing their assigned CFISA training.

The certificate documents completion of the course. It should not be interpreted as a general certification that an individual or organization is compliant with HIPAA, PCI DSS or another regulatory standard.

Pricing & Purchasing

Pay for the training you actually use.

CFISA-hosted eLearning uses a simple usage-based pricing model, while live training, LMS delivery and enterprise programs are quoted separately.

How much does CFISA-hosted eLearning cost?

CFISA-hosted eLearning is priced based on the employees who actually complete training during the month.

Current pricing is available on the CFISA Pricing page. Organizations that need live training, SCORM licensing, customer-hosted LMS delivery or a custom enterprise deployment should Request a Quote.

How does CFISA’s “Don’t train, don’t pay” pricing work?

With CFISA-hosted eLearning, you pay for employees who actually train during the month.

Employees who remain on your roster but do not complete training that month do not generate a training charge.

In simple terms: Don’t train, don’t pay.

This pricing model applies to CFISA-hosted eLearning. It does not apply to in-person training, webinar training, SCORM licensing, customer-hosted LMS delivery or custom enterprise agreements.

Do we pay for unused seats or employees who do not train?

No. With CFISA-hosted eLearning, you are not paying for unused seats.

If an employee is in your account but does not train during the month, you are not charged for that employee’s training that month.

That can be especially useful for organizations with changing employee rosters, seasonal workforces or training programs that are rolled out over time.

How do we purchase CFISA training?

Organizations that want CFISA-hosted eLearning can purchase training online through Start Training Today.

After purchase, CFISA provides access to the training platform so your organization can begin adding employees and assigning training.

For live training, LMS delivery or larger enterprise requirements, use Request a Quote instead.

When should we request a quote instead of buying online?

Request a quote if you need something beyond standard CFISA-hosted eLearning, including:

• In-person training
• Live webinar training
• SCORM licensing
• Delivery through your organization’s LMS
• Large or distributed enterprise deployments
• Custom training or implementation requirements

For standard hosted eLearning, you can begin through Start Training Today.

Live & Enterprise Training

Training that fits your organization.

CFISA offers live in-person and webinar training, along with enterprise delivery options for organizations with larger, distributed or LMS-based training requirements.

Does CFISA offer in-person cybersecurity training?

Yes. CFISA provides live cybersecurity awareness training for organizations that want an interactive on-site experience, led by Michael Levin.

In-person sessions can be adapted to the audience, organization and issues that deserve the most attention.

Learn more about In-Person Cybersecurity Training.

Does CFISA offer live virtual or webinar training?

Yes. CFISA offers live cybersecurity training by webinar for remote, distributed and multi-location organizations, led by Michael Levin.

Webinar delivery provides the interaction of a live session without requiring employees to be in the same physical location.

Learn more about Webinar Cybersecurity Training.

Can CFISA live training be tailored to our organization?

Yes. CFISA works with organizations before live sessions to understand the audience, training goals and cybersecurity issues that should receive additional attention.

That allows Michael to make the session more relevant to the people in the room rather than delivering a completely generic presentation.

Who leads CFISA live training?

CFISA live training is led by Michael Levin, a former U.S. Secret Service Agent and former Deputy Director of the National Cyber Security Division at the U.S. Department of Homeland Security.

His background in cybersecurity, investigations and government security brings real-world context to topics such as phishing, social engineering, fraud and employee security behavior.

Learn more about Michael on the About CFISA page.

Can CFISA training be delivered through our existing LMS?

Yes. Organizations that already operate a learning management system can discuss enterprise delivery options for incorporating CFISA training into their existing training environment.

This is separate from CFISA-hosted eLearning and is handled through an enterprise agreement.

Is CFISA training available in SCORM format?

Yes. CFISA supports SCORM delivery for organizations that want to deploy training through their own compatible LMS.

SCORM licensing and customer-hosted LMS delivery are quoted separately and are not covered by CFISA’s hosted eLearning “Don’t train, don’t pay” pricing model.

Can CFISA support large or distributed organizations?

Yes. CFISA works with organizations that need to deliver cybersecurity training across larger workforces, multiple locations or different organizational groups.

Enterprise options can include CFISA-hosted training, LMS-based delivery, SCORM and live training depending on the organization’s requirements.

Learn more about Enterprise Cybersecurity Training.

How do enterprise organizations get started?

Organizations with LMS, SCORM, live training or larger deployment requirements should Request a Quote.

CFISA can then review your workforce, delivery requirements and training goals to determine the most appropriate approach.

Security Awareness Training

Help employees recognize today’s threats.

CFISA Security Awareness Training helps employees recognize common cybersecurity risks and understand the actions they can take to protect organizational information and systems.

What does CFISA Security Awareness Training cover?

CFISA Security Awareness Training addresses the cybersecurity risks employees are most likely to encounter in their day-to-day work, including phishing, social engineering, password security, email threats, data protection and other common attack methods.

The training is designed for nontechnical employees and focuses on practical decisions and behaviors they can apply at work.

See the CFISA Security Awareness Training page for current course details.

What Security Awareness Training options does CFISA offer?

CFISA currently offers both Security Awareness Training – Essentials and Security Awareness Training – Complete.

Organizations purchasing CFISA-hosted Security Awareness Training receive access to both course options and can assign the version that best fits their training needs.
The Essentials course provides a streamlined training path, while Complete provides broader coverage.

Does CFISA offer Texas DIR-certified security awareness training?

Yes. CFISA offers security awareness training certified by the Texas Department of Information Resources (DIR) for organizations that need training meeting the applicable Texas cybersecurity awareness requirements.

Because certification requirements and approved-course periods can change, organizations with a specific Texas compliance requirement should review the current course information on the Security Awareness Training page.

Does CFISA Security Awareness Training include AI awareness?

Yes. CFISA’s current Security Awareness Training addresses risks associated with artificial intelligence and emerging technology, including how AI can be used to make phishing, impersonation and other social engineering attacks more convincing.

The goal is to help employees recognize that the tools attackers use continue to evolve, even when the underlying security principles remain familiar.

PCI DSS & HIPAA

Understand where training fits into compliance.

Security awareness training can support PCI DSS and HIPAA compliance programs, but training alone does not make an organization compliant or create a recognized compliance certification.

Who should receive PCI DSS security awareness training?

Organizations subject to PCI DSS must maintain a formal security awareness program for personnel.

The goal is to make personnel aware of the organization’s information security policies and their responsibilities for protecting payment card data and related systems.

For current CFISA course options, visit PCI DSS Security Awareness Training.

How often does PCI DSS require security awareness training?

PCI DSS requires security awareness training when personnel are hired and at least once every 12 months thereafter.

The security awareness program itself must also be reviewed periodically so that training remains current with changing threats and organizational requirements.

Does completing PCI DSS training make an organization PCI compliant?

No. Security awareness training is only one part of PCI DSS.

PCI DSS also includes technical, administrative, policy, access-control, monitoring and assessment requirements. Completing employee training can help satisfy applicable security awareness requirements, but it does not by itself establish PCI DSS compliance.

For a broader explanation, visit What Is PCI Compliance?

What is HIPAA training and who needs it?

HIPAA training helps workforce members understand their responsibilities for protecting health information and following applicable privacy and security policies.

Covered entities must train workforce members on relevant HIPAA privacy policies and procedures, and the HIPAA Security Rule requires a security awareness and training program for workforce members. Business associates may also have training responsibilities based on their role, policies and obligations.

Learn more about CFISA HIPAA Training.

How often is HIPAA training required?

HIPAA does not establish a single universal rule requiring every workforce member to complete the same training once every year.

Under the Privacy Rule, new workforce members must receive applicable training within a reasonable period after joining, and additional training is required when material changes to policies or procedures affect their work. The Security Rule also requires an ongoing security awareness and training program, including periodic security updates.

Many organizations choose annual refresher training as part of their compliance program, but annual training should not be presented as a blanket federal HIPAA requirement.

Does completing HIPAA training make someone or an organization “HIPAA certified”?

No. Completing a HIPAA training course does not create a government-recognized HIPAA certification or establish that an organization is HIPAA compliant.

Employees may receive a Certificate of Completion documenting that they completed CFISA training. That certificate is a training record, not a certification of HIPAA compliance.

Ready to Train?

Start online or build a training program around your organization.

Purchase CFISA-hosted eLearning online, or request a quote for in-person training, webinars, LMS delivery, SCORM licensing and enterprise programs.

Start Training Request a Quote