Compliance training built for the audit, priced for the team

Compliance training that maps to the controls you are audited against

Petronella Training Academy is the training platform of Petronella Technology Group, Inc., a cybersecurity and compliance firm based in Raleigh, North Carolina, in business since 2002 and a Cyber AB Registered Provider Organization (RPO #1449). Every course here is built and taught by practitioners who run CMMC, HIPAA and security awareness programs for clients, led by founder Craig Petronella (CMMC-RP, CCNA, CWNE, NC Licensed Digital Forensic Examiner #604180, MIT AI certificate), who has more than 30 years in cybersecurity.

The catalog covers the four things compliance-driven organizations ask for most: security awareness training for employees, HIPAA training for healthcare practices, CMMC Level 2 awareness and role-based training, and CPA firm cybersecurity with the IRS WISP module. Every paid course ends in a dated, verifiable certificate of completion, and team buyers get a roster with progress tracking and CSV export.

Training is one layer of a compliance program. When your team needs the services side, such as an SSP, a POA&M or a gap assessment, the same practitioners who teach the courses deliver them. This page explains what each training track covers, what it costs, and where to start.

How to choose a starting point

Start from the framework you answer to, not from the course list. Healthcare practices and business associates usually begin with HIPAA workforce training. Defense contractors begin with the CMMC Level 2 awareness course and add role-based training for the staff who touch CUI. Teams with no framework mandate, or an insurance renewal asking for proof of training, begin with security awareness. CPA firms, tax preparers and auto dealers begin with the FTC Safeguards course. If you are unsure, call Penny at 919-348-4912 and describe your next audit or client requirement; the recommendation is free and takes one conversation.

Every course is self-paced and on demand, so learners start the day they are enrolled and certificates are issued the moment they pass. There is nothing to schedule and nothing to attend live, which is why most team rollouts here finish inside a single quarter. Organizations that prefer live instruction can look at the corporate cohort format instead.

HIPAA training for healthcare practices and business associates

The HIPAA Security Rule at 45 CFR Part 164 requires covered entities and business associates to train workforce members on security awareness and to conduct a periodic technical and nontechnical evaluation of their safeguards. The U.S. Department of Health and Human Services publishes the HIPAA Security Rule guidance and is clear that there is no HHS-issued HIPAA certification, so the goal of workforce training is documented competence, not a certificate from a regulator.

Two HIPAA courses serve this intent. HIPAA Rescue Manual for Healthcare Practices ($999, about 6.3 hours) is the practical track for medical, dental and therapy practices that need their workforce trained and their paperwork defensible. HIPAA Compliance & Cybersecurity Mastery ($2,997, about 6.3 hours) goes deeper on the security side: risk analysis, breach notification, and the safeguards auditors ask to see evidence of.

If you need a managed program rather than a course, the main site's HIPAA training program page describes the video-plus-quiz format with completion documentation, and the HIPAA security awareness training guide covers how awareness training fits into a risk analysis under 45 CFR 164.308(a)(1)(ii)(A). For a custom healthcare cohort, call Penny at 919-348-4912.

CMMC training for defense contractors handling CUI

The CMMC Program rule, 32 CFR Part 170 (eCFR), took effect December 16, 2024. CMMC Level 1 covers Federal Contract Information with the 15 basic safeguarding requirements of FAR 52.204-21 (acquisition.gov). CMMC Level 2 covers Controlled Unclassified Information with all 110 security requirements of NIST SP 800-171 Revision 2 (NIST), organized into 14 domains, with a C3PAO assessment for most programs. DoD suspended the Phase 2 implementation milestones in July 2026, so self-assessments remain the current obligation; plan against DFARS 252.204-7019, which already requires a current self-assessment score in SPRS when you submit an offer.

Three of the 110 requirements sit in the Awareness and Training (AT) family, and they are the ones your workforce feels directly:

• AT.L2-3.2.1 (Role-Based Risk Awareness): the practice asks that managers, system administrators and users are made aware of the security risks of their activities and of the policies, standards and procedures that apply to them.
• AT.L2-3.2.3 (Insider Threat Awareness): the practice asks that security awareness training covers recognizing and reporting potential indicators of insider threat.
• AT.L2-3.2.2 (Role-Based Training): the practice asks that personnel are trained to carry out their assigned information security duties and responsibilities.
• AT.L2-3.2.2 (Role-Based Training): the practice asks that personnel are trained to carry out their assigned information security duties and responsibilities.

The three role-based courses map to those practices. CMMC Level 2 Security Awareness: Common Core ($49, about 63 minutes) is the baseline every user takes. General Users ($59, about 30 minutes) covers day-to-day CUI handling, and Executives ($149, about 30 minutes) covers governance for the senior official who signs the CMMC affirmation. Buyers who need all three for a team can get the CMMC Level 2 Awareness and Training License at $300 per user per year, one enrollment code per user.

For the implementation work behind the certificate, CMMC 2.0 Implementation Bootcamp ($2,499, about 12.9 hours) walks practitioners through scoping, the SSP, the POA&M and assessment preparation. The courses support these practices; they do not by themselves make an organization compliant, because a CMMC assessor evaluates your whole program, records included.

Security awareness training that satisfies auditors and insurers

Security awareness training is the control that appears in more frameworks than any other: CMMC AT.L2-3.2.1, HIPAA's security awareness and training standard, PCI DSS requirement 12.6, and the training expectations cyber insurance underwriters ask about in renewal applications. The FTC Safeguards Rule makes annual personnel training a written requirement for financial institutions including CPA firms, auto dealers and tax preparers.

2026 Security Awareness Training ($49, about 90 minutes) is the employee-facing course: phishing and social engineering recognition, password and MFA habits, safe data handling, and incident reporting. It carries team packs from $290 for 10 seats, and every learner earns a certificate. The CMMC Level 2 Common Core variant adds the CUI and insider-threat content defense contractors need.

Running a program rather than a single course? The main site's managed security awareness training service combines the training with simulated phishing campaigns and reporting, and the phishing simulation page explains how testing reinforces what the course taught. For a deeper read, the phishing training program guide on the blog covers building a program end to end.

From training to documentation: the SSP and the POA&M

Training proves your people know the controls; the assessment looks at your documentation too. Two artifacts carry most of that weight in a NIST SP 800-171 or CMMC Level 2 review:

Where do you stand today? The SPRS calculator scores a NIST SP 800-171 self-assessment using the official 1, 3 and 5 point weights (the score range runs from minus 203 to a perfect 110), and DFARS 252.204-7019 requires that score in SPRS when you submit an offer. After you have a score, the CMMC readiness assessment turns the gaps into a plan.

Compliance, forensics and AI training beyond the four intents

Beyond HIPAA, CMMC and awareness training, the catalog covers the rest of a modern security curriculum. Prices and lengths below come straight from the course catalog; every course page carries its full outline, and the complete catalog lists all published courses.

Buying for a team: packs, the license and corporate cohorts

Individual enrollments are one checkout per learner. Teams get three buying paths, all covered on the team packs page:

• Team packs buy a block of seats for one course: 10 seats $290, 25 seats $625, 50 seats $999 or 100 seats $1,499 for the security awareness and CMMC Level 2 awareness courses, or a 5-seat pack for the CPA firm and FTC courses. One checkout gives you one enrollment code for the whole team plus a roster with progress and CSV export.
• The CMMC Level 2 Awareness and Training License ($300 per user per year) covers all three CMMC Level 2 courses for each user with one enrollment code, from 1 to 500 users per order; orders of 25 or more users can be paid by invoice.
• Corporate cohorts for larger or multi-site programs are described on the corporate cohort page, including instructor-led options.

Every certificate is verifiable: anyone can confirm a completion at the certificate verification page, which matters when an auditor or a prime contractor asks for training records. Paid courses carry a 30-day money-back guarantee, details on the refund policy page.

Who teaches these courses

Craig Petronella founded Petronella Technology Group, Inc. in 2002 and leads the curriculum. His credentials: CMMC Registered Practitioner (The Cyber AB), CCNA, CWNE, North Carolina Licensed Digital Forensic Examiner license #604180, and an MIT AI certificate, with more than 30 years in cybersecurity. He is the author of 16 books on cybersecurity and digital marketing. The firm holds Cyber AB Registered Provider Organization #1449, listed on the Cyber AB marketplace, and every engineer assigned to a defense client holds the CMMC-RP credential.

The distinction matters when you pick a training partner: an RPO prepares contractors for assessment and delivers training, while only a C3PAO can issue a CMMC Level 2 certificate. More about the firm is on the about page, and Craig's full background is at his team profile.