The email arrives mid-morning, from the prospective client’s third-party risk team. Attached is a due-diligence questionnaire — 200-plus questions across security, resilience, environmental and governance domains — and a deadline. Somewhere around page nine, between the sections on physical access control and incident management, sits the block that decides how the next 48 hours go for your operations and compliance teams. It isn’t about the generators or the suppression system. It’s about your people: Describe your security awareness training programme. Provide completion evidence for all personnel with access to the facility. Confirm competence records for staff operating critical infrastructure. Include contractors and third parties in scope.
Data centres sell trust, and every framework the industry certifies against verifies it through the workforce. ISO 27001 requires evidenced security awareness and competence for everyone inside the ISMS scope. SOC 2 examines training as part of its control environment. PCI DSS mandates annual security awareness for relevant personnel. Uptime Institute Tier assessments and M&O stamps look hard at operations staffing, shift competence and procedural training. And above all of it sit the clients themselves — hyperscalers, banks, healthcare platforms — whose due diligence asks for the same thing with a commercial edge: prove the people are as reliable as the plant. This article is about that proof, drawing on our State of Data Centre Training Report 2026.
Two operators, two Tuesdays
Consider how the same questionnaire plays out in two operations.
In the first, the compliance manager forwards the training section to HR and the site leads. HR exports what the HR system holds — start dates, some induction records. Site leads dig through shared drives for certificates, emailing supervisors for the gaps. The night-shift records live with a manager who’s on leave. Contractor inductions are signatures in gatehouse folders across three sites. Two days later the response is assembled: mostly complete, visibly stitched together, with three individuals whose refresher status can’t be confirmed and a contractor population described in a paragraph rather than evidenced. The client’s risk team doesn’t fail the operator — but it asks follow-up questions, and follow-up questions delay contracts.
In the second, the compliance manager opens the training platform, filters by site and population, and exports three reports: all personnel with facility access and their security-awareness status; operations staff with their procedural and competence records; contractors and vendors with per-visit induction evidence. Each entry timestamped, each renewal date visible, the whole thing generated in under ten minutes and consistent with what the last surveillance audit saw. The response goes back a day early. Nothing about the second operator’s training is necessarily better — but its evidence is, and in due diligence, evidence is the product.
What the frameworks actually ask of your people
Strip the acronyms back and the workforce requirements across the major frameworks converge on five questions:
- Coverage — has everyone in scope been trained: permanent staff, night shifts, remote hands, and the contractors and vendor engineers who badge into the same rooms?
- Currency — is the training up to date, with annual security-awareness refreshers completed and role competencies renewed before expiry, not after?
- Role-appropriateness — does an HV-authorised engineer’s record show HV competence, a security officer’s show physical-security depth, an escorted cleaner’s show the right induction — rather than one generic module for all?
- Understanding — was the training assessed, not merely attended? A completion with a pass score answers a question a sign-in sheet cannot.
- Evidence — can all of the above be produced per named individual, with dates, on request? Every audit conversation is some combination of these five — and the fifth is the one that turns the other four from claims into facts.
The perimeter problem, again
The population that most often breaks an audit response isn’t the payroll — it’s the perimeter. ISO 27001 and SOC 2 scope everyone with access, and client questionnaires increasingly say so explicitly: including third parties. That drags the vendor engineer, the FM team and the construction contractor into the same evidence standard as the shift technician — which is precisely where gatehouse clipboards fail. The operators that answer cleanly run contractor induction and vendor competence in the same system as employee training, evidenced per person per visit, so “including third parties” is a filter, not a research project. (It’s the same scoping logic their technology and IT services clients apply to their own workforces under the same frameworks — the standard flows down the chain.)
Evidence is a property of the system, not a project
Here’s the structural insight the second operator understood: audit-ready evidence can’t be assembled — it has to be emitted. If training delivery and record-keeping are separate activities, the records will always lag, fragment and require reconciliation under deadline. If every module, assessment, induction and renewal happens through one system, the evidence exists the moment the event does: timestamped, scored, attributed, and queryable forever after. The audit response stops being a project and becomes an export.
That’s an infrastructure decision, and it has infrastructure requirements: complete audit trails logging every completion and attempt; renewal automation with 30/14/7-day alerts so currency never lapses silently; role-based pathways so records are role-appropriate by construction; contractor and vendor populations inside the same perimeter; and the platform itself meeting the security bar — encryption at rest and in transit, granular access control — because in this sector the evidence system sits inside the compliance scope too. (Our platform page sets out that architecture in full.)
What good looks like on the day
Run on a modern corporate learning platform, the Tuesday questionnaire becomes routine: security-awareness completion for every badge-holder in one export; operations competence — EOP and SOP assessments, site authorisations, renewal dates — in a second; per-visit contractor evidence in a third; each report timestamped and consistent with the last audit’s. Annual refreshers renew themselves. New starters and new sites inherit the structure automatically. Training delivered with AI voiceovers in 100+ languages carries the same evidence trail in every language. And when the client’s auditor asks the follow-up — show me this named individual, this date — the answer takes a filter and a click.
That evidence layer is a core part of what our Data Centre Workforce Learning offer delivers, alongside the onboarding and contractor governance it sits on. If due-diligence questionnaires, surveillance audits or Tier assessments are part of your year, book a demo and we’ll run the Tuesday scenario against your own estate — questionnaire to export.
Frequently asked questions
What training evidence do ISO 27001 and SOC 2 audits ask data centres for? Evidence of security-awareness training for everyone within scope (ISO 27001 clause 7.2/7.3 competence and awareness; SOC 2’s control environment), typically including completion records with dates, assessment outcomes, refresher currency, and coverage of contractors and third parties with access — producible per named individual on request.
Do client due-diligence questionnaires really examine training? Yes — workforce training sits alongside physical security and resilience in most enterprise DDQs, with hyperscale and financial-services clients asking for programme descriptions and completion evidence including third parties. The speed and completeness of that response directly affects contract timelines.
Are contractors and vendors inside audit scope? Almost always. Frameworks scope by access, not employment — so vendor engineers, FM teams and construction contractors inside the facility need evidenced, current inductions and competencies to the same standard as staff, ideally recorded per person per visit in the same system.
What’s the difference between attendance records and audit-ready evidence? Assessment and attribution. A sign-in sheet shows presence; audit-ready evidence shows a named individual completed specific, role-appropriate content on a date, passed an assessment, and holds a current renewal status — timestamped in a system whose records can’t be quietly edited.
How fast should an operator be able to produce training evidence? For any site, population or named individual: minutes. If assembling the response takes days of chasing supervisors and folders, the evidence is being reconstructed rather than emitted — and reconstruction under deadline is where gaps and inconsistencies surface.
Does the training platform itself fall within compliance scope? In practice, yes — it holds records auditors rely on and data about everyone with access, so it should meet the same expectations: encryption at rest and in transit, granular role-based access, complete audit trails, and no third-party data sharing.
