Add-on packs

The modules your regulator names. Cited by section.

A pack adds three or four modules written by people who work in that sector, cites the provision it supports on screen and in the record, and exports in the form that framework's reviewer expects. Core first, pack on top, one record.

Available now · design-partner pilot

Clinical & GxP

Clinical sites, CROs, sponsors, and the recruitment and data vendors around them.

E.1Clinical trial and regulated data protection
E.2Electronic records, audit trails and data integrity
E.3Security incident identification, escalation and reporting

21 CFR § 11.10(i) · ICH E6(R3) · ALCOA+

The clinical research page →

Roadmap · built with a design partner

Healthcare & HIPAA

Covered entities and business associates: providers, health plans, and the vendors that touch their data.

Protected health information and the minimum-necessary standard
Recognizing a breach and who to tell, in what order
Security reminders, malware, log-in monitoring and passwords as the rule lists them

45 CFR § 164.308(a)(5) · § 164.530(b)(1)

Become the design partner →

Roadmap · built with a design partner

Financial services

Lenders, brokers, advisers, insurers and fintech under the FTC Safeguards Rule.

Customer financial information and who may see it
Payment fraud, invoice redirection and executive impersonation
Training that tracks the risk assessment, as the rule requires

16 CFR § 314.4(e)(1) · NY DFS 23 NYCRR Part 500

Become the design partner →

Roadmap · built with a design partner

Payment card

Merchants and service providers with a cardholder data environment.

What cardholder data is and where it is allowed to exist
Skimming, tampering and social engineering at the point of sale
Handling card data on the phone and in support tools

PCI DSS v4.0 · Requirement 12.6

Become the design partner →

Roadmap · built with a design partner

Defense & government contractors

Suppliers handling controlled unclassified information under CMMC and DFARS.

CUI and FCI: recognizing, marking and handling it
Insider threat awareness
Reporting a cyber incident up the contract chain

NIST SP 800-171 · Awareness and training family (3.2) · CMMC 2.0

Become the design partner →

Roadmap · built with a design partner

SaaS & technology vendors

Companies proving SOC 2 or ISO 27001 to their customers.

Customer data handling and tenant isolation, for non-engineers too
Secrets, tokens and access hygiene
What the auditor will ask about your training, and the evidence they accept

ISO/IEC 27001:2022 · Annex A 6.3 · SOC 2 Trust Services Criteria

Become the design partner →

Roadmap · built with a design partner

Privacy & data protection

Organizations processing EU, UK or state-privacy-law personal data.

Lawful handling, purpose limitation and data minimization in daily work
Data subject requests and what not to say in the reply
Breach notification duties and the internal escalation that makes them meetable

GDPR Art. 32 · Art. 39(1)(b)

Become the design partner →

Roadmap · built with a design partner

Energy & critical infrastructure

Utilities and operators with personnel who touch bulk electric system cyber systems.

Operational technology is not IT: the differences that matter to the person at the console
Physical and electronic access to protected systems
Awareness and role-based training as the standard separates them

NERC CIP-004 · Personnel & Training

Become the design partner →

Roadmap packs are built with a design partner in that sector. If yours is on the list, that partner could be you.

Why packs

Everyone can sell you phishing simulation.

Nobody else will teach your people the module your assessor actually cites.

Incumbents sell one generic curriculum with a compliance module bolted on. Packs are written by people who have sat on the wrong side of an audit in that sector, and every module names the provision it supports — on screen, in the record and in the export.

Core first. Everyone completes Tracks A through D. A pack adds to the core; it never replaces it, because the phishing email does not care which regulation you are under.
Role variants. Each pack module has a full version for the people who do the work and a short version for everyone else who needs to recognize it.
Cited, not implied. A pack module says which section it supports and what a reviewer would look for. No acronym soup, no claims we cannot back.
One record. Core and pack completions land in the same training record and the same inspection packet, with the same timestamps, versions and signatures.

What it maps to

Every module cites the provision it supports.

On screen, in the record, and in the export — because that is what the reviewer is checking for.

Framework	Provision	Obligation	Where
HIPAA Security Rule	45 CFR § 164.308(a)(5)	A security awareness and training program for all workforce members, including periodic reminders, malware protection, login monitoring and password management.	Core · Healthcare
HIPAA Privacy Rule	45 CFR § 164.530(b)(1)	Training of all workforce members on the policies and procedures for protected health information, as necessary for their functions.	Healthcare
FDA 21 CFR Part 11	§ 11.10(i)	Determination that persons who develop, maintain or use electronic record and electronic signature systems have the education, training and experience to perform their assigned tasks.	Clinical & GxP
ICH E6(R3) GCP	Computerised systems	Expanded expectations for computerised systems, data governance and risk-proportionate quality management across sponsors, CROs and sites.	Clinical & GxP
FTC Safeguards Rule	16 CFR § 314.4(e)(1)	Security awareness training for personnel, updated as necessary to reflect risks identified by the risk assessment.	Financial services
PCI DSS v4.0	Requirement 12.6	Security awareness education as an ongoing activity for all personnel, with acknowledgment of the security policy.	Payment card
NIST SP 800-171	Family 3.2	Awareness and training requirements for organizations handling controlled unclassified information, the basis of CMMC assessment.	Defense & government
ISO/IEC 27001:2022	Annex A 6.3	Information security awareness, education and training for personnel and relevant interested parties.	SaaS & technology
GDPR	Art. 32 · Art. 39(1)(b)	Security appropriate to risk, and an explicit data protection officer duty covering awareness-raising and training of staff involved in processing.	Core · Privacy
NERC CIP-004	Personnel & Training	Security awareness and role-based training for personnel with access to bulk electric system cyber systems.	Energy
NIST SP 800-53	AT control family	Awareness and training controls, for customer security questionnaires and federal or government-contract-adjacent work.	Core

Pilot program

Start with the core. Add the pack.

We're onboarding a small number of design partners. Clinical research organizations get the Clinical & GxP pack now; if your sector's pack is on the roadmap, a design partner is how it gets built. You get the program first, we get your audit findings and your people's honest opinion of the content. Fair trade.

Request a pilot Ask for the curriculum outline

Developed with a clinical research design partner · STACSTRAT LLC