Compliance & evidence
Do compliance. Then prove it.
Most awareness training ends with an attendance list. Layer 8 ends with evidence: who covered which standard, how they performed, and how your people’s behaviour is changing, ready for whoever asks.
Who asks
Everyone wants proof. Few can give it.
Awareness training is a requirement in most frameworks you answer to. Doing it is the easy part. Showing it worked is where most programmes fall down.
Your board
Directors are expected to oversee cyber risk. Show them where your people stand, team by team, and that it is improving.
Your auditor
ISO/IEC 27001 Annex A 6.3 requires security awareness training. Show records mapped to the controls, not an attendance sheet.
Your insurer
Cyber insurance questionnaires increasingly ask for evidence of awareness training. Have the answer ready before renewal.
The Privacy Act
APP 11 requires reasonable steps to protect personal information, and training your staff is one of them. Show you have taken it.
The Layered Portal
Where training becomes evidence
Every game and quiz feeds the Layered Portal, our training management system. It is live today, and we are building it into a full evidence platform.
- Organisations and teams set up by role
- Every session and game result recorded per team
- Short scored quizzes to check understanding
- Learning pathways that assign the right standard to each role
- A knowledge base staff can come back to
- Records for every person, exportable for your auditor
- Behaviour signals from the games: did they check before clicking, verify before acting?
- A human risk score for each person, team and organisation, tracked over time
- A manager dashboard showing where to focus next
How we measure
Proof that goes past “they finished it”
Completion tells you who turned up. We check what they understood with short quizzes, and see what they actually do when they play.
- 01 · Completion
Did they do it?
Who covered which standard, and when. Where most training stops.
- 02 · Understanding
Do they know it?
Short quizzes after each game check the key points landed.
- 03 · Behaviour
Will they act on it?
What people actually do inside the game, under pressure. The proof that matters.
Our principle
Coaching, not surveillance
People who fear getting caught stop reporting, and reporting is the behaviour that protects you most. So we reward the right call rather than punish the wrong one.
Individual results are seen by the person and their manager only. The board sees teams and trends, never a name-and-shame list.
Mapped to
The frameworks you answer to
ISO/IEC 27001:2022
Annex A 6.3 awareness training, plus the controls each topic maps to
ASD Essential Eight
The user side of MFA, macros, application control and backups
Privacy Act 1988 (APP 11)
Training as a reasonable step to protect personal information
AICD governance principles
Evidence that directors are overseeing cyber risk
See what your evidence would look like
Tell us what you have to prove and who to, and we will walk you through how the portal shows it.
Let’s talk