Regulations and standards for security awareness and training (SA&T) are often outdated and confusing, forcing organizations to focus on compliance as a strategy instead of driving the true behavior and culture change they need. SA&T must move beyond compliance — but in the meantime, it’s still important to understand and comply with current regulations and standards where necessary. Use this guide to understand what important regulations and standards apply in your country or state or to your industry; who needs training and what to train them on; why training is required and how much; and when and how to provide training.