REQUIREMENTS MAP • LAST REVIEWED OCTOBER 2026
Which RiseCert lesson answers which audit, insurance or regulatory question.
Find the requirement you're being asked about. Each row shows what the asker usually wants to see, the lesson that covers it, and the record you can hand over.
This map shows where RiseCert training produces evidence. It is not legal advice and does not by itself certify compliance — your auditor, carrier or counsel makes the final call.
Every row below comes in one package.
REQUIREMENT • LESSON • EVIDENCE
SOC 2 — auditors apply existing Trust Services Criteria to AI
CC1.4 • CC2.2
Security awareness and communication of policies: AI-specific training records, not just general awareness
SA, all 15 lessons, plus PD (every employee)
Dated completion report; certificates with verify ID
CC6.7 • CC6.8
Data transmission and unauthorized disclosure: a written AI acceptable-use policy that staff have acknowledged
SA 1.3 “The Data Leakage Paths”, 2.2 “Prompt Hygiene Rules”, 3.1 “An AI Use Policy People Actually Follow” + AI policy template
Signed policy acknowledgment log
CC9.2
Vendor and partner risk: an inventory of AI tools in use and a review of each vendor
SA 3.4 “The Vendor AI Security Questions”; full depth in AI Vendor Risk & Procurement Compliance (Track 5)
Completion records; your AI tool inventory
Cyber insurance applications — questions vary by carrier
Training
Security awareness training for all staff, with completion tracking
SA + PD with automatic reminders to 100%
Per-employee completion status
Social engineering
Staff trained on phishing, impersonation and funds-transfer fraud, now including AI deepfakes and voice clones
PD, all 15 lessons, incl. 2.3 “Payment & Data-Release Controls” and 2.4 “Executive Impersonation & BEC 2.0”
Completion + knowledge-check scores. Pair with your simulation tool if your carrier requires phishing tests
AI governance
“Do you have a formal AI acceptable-use policy?”
AI policy template + SA 3.1
Adopted policy + signed acknowledgment log
Frameworks — voluntary, increasingly cited in questionnaires
NIST AI RMF • GOVERN 2.2
Personnel receive AI risk-management training
RAISE certification; AI Compliance & Governance Essentials (Track 4)
RAISE certificate and exam record
ISO/IEC 42001 • 7.2, 7.3
Competence and awareness of people working with AI
SA + PD + RAISE
Records of competence and awareness
US state AI laws — context for HR teams
Colorado SB 26-189 • Texas TRAIGA
No staff-training mandate. Colorado requires notices and human review for automated decisions from Jan 1, 2027
AI for HR & Recruiting (Track 3)
Completion record for HR staff
GET THE PDF
Send this map straight to your auditor or broker.
Get the PDF version, plus a one-page answer sheet for the AI questions on cyber-insurance applications.
We'll email the PDF and the answer sheet. No card, no sales call.