SECURITY AWARENESS RESOURCE PACK
Four ready-to-deploy templates every business needs. Incident Report, MFA Enrollment Checklist, Vendor Risk Questionnaire, and Quick Reference Card. Mapped to GLBA, HIPAA, CMMC, PCI, NYDFS, and SOC 2. Free for any organization to use.
Every Regulator Now Names Security Awareness Training
Six federal and state frameworks now require documented annual security awareness training. Not optional. Not "best practice." Named control objectives with assessment evidence requirements.
The landscape changed quietly over the last 36 months. The FTC Safeguards Rule (16 CFR Part 314), finalized in late 2021 and amended in late 2023, requires every "financial institution" — and that definition now sweeps in tax preparers, mortgage brokers, motor vehicle dealers, finders, and check cashers — to "provide your personnel with security awareness training" under 16 CFR 314.4(e). Failure to maintain documented training is one of the most common findings in FTC enforcement actions, and the median civil penalty in published 2024 and 2025 settlements ran in the high six figures before remediation costs.
The Department of Defense CMMC 2.0 Level 2 framework, now mandatory for every contractor and subcontractor in the Defense Industrial Base handling Controlled Unclassified Information, names two specific awareness controls: AT.L2-3.2.1 (security awareness training) and AT.L2-3.2.2 (insider threat awareness). Without documented annual training, no Joint Surveillance Voluntary Assessment will issue a passing score. Without a passing score, no DoD contract.
And the same is true for HIPAA covered entities and business associates under 45 CFR 164.308(a)(5), PCI-DSS v4.0 Requirement 12.6 for any merchant that touches a card number, NYDFS 23 NYCRR 500.14(a)(3) for any covered financial entity in New York, and SOC 2 Common Criteria CC1.4 / CC2.2 for any service organization undergoing a Type 2 audit.
This Resource Pack does not replace the training itself. It gives you the documentation chassis — the forms, checklists, and reference materials your employees and your auditor expect — so the training that does happen produces the evidence that satisfies the rule.
Four Templates, One ZIP Download
Editable HTML files. Open in any browser, paste into Word or Google Docs, brand with your logo, deploy.
Incident Report Template
One-page form for any employee to report a suspected phishing email, lost device, suspicious vendor message, social engineering attempt, malware sighting, or unauthorized access. Sections capture detection time, reporter and detector, affected systems and data, immediate actions taken, and disposition (closed, escalated to IT, escalated to legal, escalated to law enforcement, breach-notification triggered). Used as the front-end intake for your incident response runbook and as primary evidence for HIPAA 164.308(a)(6), CMMC IR.L2-3.6.1, NIST 800-171 03.06.01, and SOC 2 CC7.3.
MFA Enrollment Checklist
Step-by-step walkthrough for enabling multi-factor authentication on the six accounts that matter most: Microsoft 365 with Authenticator app or hardware key, Google Workspace, Apple ID for any device touching work data, the company password manager (1Password, Bitwarden, Keeper, Dashlane), business banking, and personal social accounts most often used as a foothold. Includes the order of operations, what to do if enrollment fails, and the recovery path if a device is lost. Phishing-resistant MFA options (FIDO2 / passkey) are flagged separately because that is the bar CMMC and NYDFS now expect.
Vendor Risk Questionnaire
Twenty-five questions in five sections: company and contact information, security and compliance posture (SOC 2, ISO 27001, HIPAA BAA, PCI attestation), data handling (storage location, encryption at rest, encryption in transit, retention, deletion), incident history (24-month breach disclosure, breach-notification practice, cyber insurance carrier and limits), and contractual security terms (audit rights, subprocessor disclosure, data residency). Calibrated for SMB-to-mid-market onboarding any new SaaS provider — short enough that vendors will actually fill it in, deep enough to surface real risk before signature.
Quick Reference Card
Single-page tri-fold designed to live on every employee's desk and ship in every new-hire welcome packet. Front: how to spot a phishing email in under five seconds — sender domain, urgency cues, mismatched links, requests for credentials, requests for gift cards or wires. Inside: company password rules, MFA reminders, AI-deepfake voice and video warning signs, and the single rule for reporting any suspicious message. Back: IT helpdesk number, security incident reporting channel, after-hours escalation path. Print on cardstock, laminate, distribute. Recall data: a printed reference is recalled at roughly 4x the rate of an emailed PDF.
Five High-Leverage Use Cases
New-Hire Onboarding
Drop the four templates into the day-one packet. The Quick Reference Card sets baseline expectations on day one; MFA enrollment is completed in week one; the Incident Report form lives in the wiki; the Vendor Risk Questionnaire flags any tools the new hire wants to bring with them.
Annual SAT Refresh
Re-issue the templates at the start of every fiscal year alongside the actual training course. Auditors and underwriters look for evidence of an annual touchpoint; this pack supplies the documentation proof that the touchpoint happened.
SOC 2 / HIPAA / CMMC Evidence Binder
Save completed Incident Reports, MFA enrollment confirmations, and Vendor Questionnaires into your evidence repository (SharePoint, Drive, ComplianceArmor, etc.). When the assessor walks the floor, you point at the binder.
Vendor Onboarding Gate
Make the Vendor Risk Questionnaire a required step before any new SaaS subscription is signed. Procurement teams that adopt this pattern catch about 1 in 5 prospective vendors with a meaningful security gap, before contract.
Post-Incident Lessons-Learned
After any reported event, walk the affected team through the Quick Reference Card and the MFA Checklist. Behavioral change post-incident is the single largest lift in awareness program effectiveness.
Five Steps from Download to Documentation
Download and unzip
Enter your work email below. We send the ZIP within 60 seconds. Unzip locally; the four HTML files open in any browser for preview.
Brand and edit
Open each template in Word, Google Docs, or your CMS. Replace the placeholder logo and contact details with your own. The HTML uses inline styles so paste-into-anything works without extra CSS.
Distribute to staff
Email the Quick Reference Card and MFA Enrollment Checklist to all employees. Print the Quick Reference Card on cardstock; pin it next to every monitor.
Wire into operations
Add the Incident Report URL to your IT helpdesk page and the new-hire wiki. Make the Vendor Risk Questionnaire a required gate in your procurement workflow.
File for the auditor
Save completed instances (incident reports, vendor reviews, MFA confirmations) into a versioned evidence folder. When the SOC 2, HIPAA, or CMMC assessor arrives, you point to that folder. Done.
Free Download — Email Below
Enter your work email. We send the ZIP within 60 seconds and add you to our monthly cybersecurity newsletter (one-click unsubscribe). No credit card. No upsell ambush.
Pair the Pack with the Course
The pack is the documentation chassis. The course is the actual training that produces the evidence the documentation describes.
2026 Security Awareness Training Course
Annual SAT for every employee. Six modules, twelve lessons, 90 minutes, audio narrated, ends with a 20-question certified exam. $99 per seat per year. Volume pricing at 5 seats.
View course →Security Awareness Training Service Page
Full overview of our SAT delivery: regulatory mapping, syllabus, group pricing tables, certificate sample, FAQ, and the case for choosing a practitioner-built course over a platform library.
Service overview →Industry-Specific Resource Packs
If you operate in a regulated vertical, the industry-specific packs ship templates calibrated to your auditor's checklist.
CPA Firm Cybersecurity Resource Pack
For accounting and tax practices subject to IRS Publication 4557 and the FTC Safeguards Rule. WISP template, Qualified Individual designation memo, vendor SOC 2 review tracker, breach-notification 30-day matrix.
Download CPA pack →FTC Compliance Resource Pack
For any business operating under FTC jurisdiction. GLBA Privacy Notice template, Safeguards Rule annual report, claim substantiation log, marketing disclosure checklist.
Download FTC pack →Frequently Asked Questions
Twelve questions we hear most often about the SAT Resource Pack, the templates, the licensing, and how the pack fits into a complete program.
What is in the free Security Awareness Training Resource Pack?
Is the resource pack really free?
Which compliance frameworks does this pack support?
Do I need to be a Petronella client to use the pack?
How does the Incident Report Template work?
What does the MFA Enrollment Checklist cover?
How is the Vendor Risk Questionnaire structured?
What is the Quick Reference Card for?
Can I rebrand the templates with our company name and logo?
How often is the pack updated?
How does this pair with the paid 2026 Security Awareness Training course?
What other free resource packs do you offer?
Built by Practitioners, Not Curriculum Writers
Get the Pack. Train the Team. Pass the Audit.
Free SAT Resource Pack now. Optional paid course when you are ready to layer on the actual annual training.
Petronella Technology Group, Inc. — 7000 Six Forks Road, Raleigh, NC 27615 — 919-348-4912 — support@petronellatech.com. The free Security Awareness Training Resource Pack is provided "as-is" for single-organization internal use. Templates are not legal advice. Consult counsel for jurisdiction-specific compliance interpretations. The 2026 Security Awareness Training course is sold separately at $99 per seat per year.