Security Awareness & Training Standard
Organization: FrontRunnerHC, Inc. (FRHC)
Parent Policy Reference: Summit Technology Holdings – Security Awareness & Training Policy
Framework Reference: Secure Controls Framework – Security Awareness & Training (SAT)
1. Purpose
Section titled “1. Purpose”This standard defines how FrontRunnerHC (FRHC) participates in and supports the enterprise-wide Security Awareness & Training program managed centrally by Summit Technology Holdings, LLC (STH). Security awareness and training for FRHC personnel is provided by STH and is not independently developed at the subsidiary level. This standard documents FRHC’s obligations and compliance approach.
2. Applicability
Section titled “2. Applicability”This standard applies to all FRHC employees, contractors, and third-party personnel who have access to FRHC systems, applications, or sensitive information, including ePHI.
3. Standard
Section titled “3. Standard”3.1 Cybersecurity & Data Privacy-Minded Workforce
Section titled “3.1 Cybersecurity & Data Privacy-Minded Workforce”FRHC supports STH’s enterprise objective of building a security-aware workforce. FRHC leadership reinforces a culture of security and privacy awareness in onboarding, team communications, and day-to-day operations. FRHC managers are responsible for ensuring their teams understand their individual obligations under FRHC’s security and privacy policies.
- Parent Policy Mapping: STH Security Awareness & Training Policy, Section 3.1
- SCF Mapping: SAT-01 (Security, Compliance & Resilience-Minded Workforce)
3.2 Awareness Training
Section titled “3.2 Awareness Training”All FRHC employees, contractors, and applicable third-party personnel complete cybersecurity and data privacy awareness training through STH’s centrally managed training platform. Training is required at hire and at least annually thereafter. Topics include phishing and social engineering, secure data handling, password management, HIPAA awareness, and reporting suspicious activity. Training content is maintained and updated by STH to reflect evolving threats and regulatory requirements.
- Parent Policy Mapping: STH Security Awareness & Training Policy, Section 3.2
- SCF Mapping: SAT-02 (Security, Compliance & Resilience Awareness Training)
3.3 Role-Based Training
Section titled “3.3 Role-Based Training”FRHC personnel in roles with elevated security responsibility—including IT staff, system administrators, developers, and compliance personnel—complete role-based training as required by STH’s program. Role-based training addresses the specific threats and responsibilities associated with elevated access or sensitive functions.
- Parent Policy Mapping: STH Security Awareness & Training Policy, Section 3.3
- SCF Mapping: SAT-03 (Role-Based Security, Compliance & Resilience Training)
3.4 Training Records
Section titled “3.4 Training Records”Training completion records for FRHC personnel are maintained in STH’s centralized training management system. FRHC management monitors completion status and escalates non-compliance to ensure all personnel satisfy training requirements on schedule. Records are made available to support SOC 2 Type II audits and HIPAA Security Rule compliance assessments.
- Parent Policy Mapping: STH Security Awareness & Training Policy, Section 3.4
- SCF Mapping: SAT-04 (Security, Compliance & Resilience Training Records)
4. Compliance & Governance
Section titled “4. Compliance & Governance”FRHC relies on STH’s centralized platform for training delivery and completion tracking. FRHC management reviews training completion reports at least annually to confirm that all required personnel have completed mandatory training. Non-compliance is escalated promptly, and remediation (completion of overdue training) is tracked to resolution.
5. Enforcement
Section titled “5. Enforcement”All users (employees, contractors, part-time and temporary workers) and those employed by others to perform work for the organization, or who have been granted access to IT assets or facilities, are covered by this standard and must comply with its associated policies, procedures, standards and guidelines.
Failure to comply with this standard and associated guidelines may result in suspension of use privileges or other disciplinary actions up to and including termination and/or legal action.
6. References
Section titled “6. References”Parent Policy:
- Summit Technology Holdings – Security Awareness & Training Policy
Regulatory Requirements:
- HIPAA Security Rule:
- 45 CFR §164.308(a)(5) – Security Awareness & Training
- AICPA SOC 2 Trust Services Criteria:
- Security (CC5.2, CC5.3)
Framework Alignment:
- SAT-01 – Security, Compliance & Resilience-Minded Workforce
- SAT-02 – Security, Compliance & Resilience Awareness Training
- SAT-03 – Role-Based Security, Compliance & Resilience Training
- SAT-04 – Security, Compliance & Resilience Training Records
7. Revision Tracking
Section titled “7. Revision Tracking”| Rev | Description | Date | Approved |
|---|---|---|---|
| - | Policy created | July 2021 | M Machin |
| 1.0 | Formatting Update | September 2022 | WSI |
| 2.0 | Updated and approved for 2024 | July 2024 | WSI |
| 3.0 | Updated and approved for 2025 | July 2025 | M Machin |
| 4.0 | Converted to Standard | April 2026 | M Machin |
