Compliance frameworks and training for the United States

Lavawall® maps 21 compliance frameworks specific to the United States and offers 97 staff training courses written for it. Open a framework for its requirements and assessment tiers; the courses are listed below.

This is general information to help you find the right material, not legal advice. Which rules apply to you depends on your organization.

States we cover

Compliance frameworks

Staff training for the United States

Courses your team can take in the browser, with a short quiz and a completion record. See all Lavawall training.

• AI for US Business Leaders — A Plain-Language Guide (about 40 minutes)
  Non-technical AI primer for US business leaders whose IT is managed by an MSP. Plain-language tour of the major AI tools, why free vs. paid matters, AI notetakers including invisible side-channel and hardware capture,...
• AI in US Healthcare: HIPAA Compliance & Safe Use (about 45 minutes)
  For US healthcare workers. Covers HIPAA and BAA requirements, FDA-regulated AI, malicious add-ons, agentic AI agent risks, patient-facing AI security, and compliant clinical applications.
• Arizona Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-AZ. Contact your training administrator for questions.
• CMMC Level 1 — Foundational Cybersecurity for US Defence Contractors (about 38 minutes)
  For US defence contractors. Covers CMMC 2.0 Level 1 (Foundational): 17 practices for protecting Federal Contract Information (FCI). Covers access control, identification and authentication, media protection, physical ...
• Colorado Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-CO. Contact your training administrator for questions.
• EU GDPR for US Businesses (about 38 minutes)
  For US organisations with EU customers, website visitors, or employees. Covers GDPR extraterritoriality, lawful bases, data subject rights, Standard Contractual Clauses for transatlantic data transfers, and breach not...
• FTC Safeguards Rule — Financial Data Security (about 33 minutes)
  For US financial services organisations subject to the FTC Safeguards Rule (16 CFR Part 314). Covers the required elements of a written information security programme.
• Florida Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-FL. Contact your training administrator for questions.
• Georgia Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-GA. Contact your training administrator for questions.
• Gramm-Leach-Bliley Act (GLBA) — Financial Privacy and Safeguards (about 33 minutes)
  For US financial institutions. Covers the GLBA Privacy Rule (customer financial privacy notices) and the Safeguards Rule (written information security programme).
• HIPAA Privacy and Security Training (about 38 minutes)
  Required compliance and HR training. Course code: HIPAA-PRIVACY-SECURITY. Contact your training administrator for questions.
• Illinois Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-IL. Contact your training administrator for questions.
• LLM and AI Strategy for US MSPs (about 77 minutes)
  Technical AI strategy course for US MSP technicians and leaders. Covers the 2026 provider landscape, Microsoft 365 Copilot SKUs and Copilot Credits transition, AI notetakers, US data residency (default US, in-country ...
• Maryland Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-MD. Contact your training administrator for questions.
• Massachusetts Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-MA. Contact your training administrator for questions.
• Michigan Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-MI. Contact your training administrator for questions.
• Minnesota Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-MN. Contact your training administrator for questions.
• NIST SP 800-171 — Protecting Controlled Unclassified Information (about 48 minutes)
  For US organisations handling Controlled Unclassified Information (CUI). Covers the 110 security requirements across 14 families including access control, awareness training, audit, configuration management, incident ...
• Nevada Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-NV. Contact your training administrator for questions.
• New Jersey Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-NJ. Contact your training administrator for questions.
• New York Employment Law for Small Business Owners (about 20 minutes)
  Required compliance and HR training. Course code: US-HR-NY. Contact your training administrator for questions.
• North Carolina Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-NC. Contact your training administrator for questions.
• Ohio Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-OH. Contact your training administrator for questions.
• Online Safety for Elementary Students (United States) (about 25 minutes)
  US-specific online-safety course written for the student themselves, age-appropriate to this grade band. Covers stranger contact, predator-grooming patterns, sextortion and the response that actually works (US reporti...
• Online Safety for High Schoolers (United States) (about 40 minutes)
  US-specific online-safety course written for the student themselves, age-appropriate to this grade band. Covers stranger contact, predator-grooming patterns, sextortion and the response that actually works (US reporti...
• Online Safety for Middle Schoolers (United States) (about 35 minutes)
  US-specific online-safety course written for the student themselves, age-appropriate to this grade band. Covers stranger contact, predator-grooming patterns, sextortion and the response that actually works (US reporti...
• Online Safety for Parents of Early Childhood Kids (United States) (about 30 minutes)
  US-specific online-safety course for parents at this grade band. Covers stranger contact in games, sextortion (financial and predator-driven), AI image generation under the federal TAKE IT DOWN Act, social-media setti...
• Online Safety for Parents of Elementary-Aged Kids (United States) (about 35 minutes)
  US-specific online-safety course for parents at this grade band. Covers stranger contact in games, sextortion (financial and predator-driven), AI image generation under the federal TAKE IT DOWN Act, social-media setti...
• Online Safety for Parents of High Schoolers (United States) (about 40 minutes)
  US-specific online-safety course for parents at this grade band. Covers stranger contact in games, sextortion (financial and predator-driven), AI image generation under the federal TAKE IT DOWN Act, social-media setti...
• Online Safety for Parents of Middle Schoolers (United States) (about 40 minutes)
  US-specific online-safety course for parents at this grade band. Covers stranger contact in games, sextortion (financial and predator-driven), AI image generation under the federal TAKE IT DOWN Act, social-media setti...
• Online Safety for Post-Secondary Students (United States) (about 35 minutes)
  US-specific online-safety course written for the student themselves, age-appropriate to this grade band. Covers stranger contact, predator-grooming patterns, sextortion and the response that actually works (US reporti...
• Oregon Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-OR. Contact your training administrator for questions.
• Pennsylvania Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-PA. Contact your training administrator for questions.
• Sarbanes-Oxley Act (SOX) — IT Controls and Financial Reporting (about 30 minutes)
  For publicly traded US companies. Covers SOX Sections 302 and 404, IT general controls covering access management, change management, and computer operations, and audit implications for IT staff.
• Security Awareness for Accounting and Tax — United States (about 26 minutes)
  Practical security training for Accounting and Tax professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Accounting and Tax — United States (CaseWare) (about 26 minutes)
  Practical security training for Accounting and Tax professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Agriculture — United States (about 23 minutes)
  Practical security training for Agriculture professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Architecture and Engineering — United States (about 26 minutes)
  Practical security training for Architecture and Engineering professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Automotive Dealerships — United States (about 26 minutes)
  Practical security training for Automotive Dealerships professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Colleges and Universities — United States (about 26 minutes)
  Practical security training for Colleges and Universities professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Construction and Trades — United States (about 23 minutes)
  Practical security training for Construction and Trades professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Dental and Healthcare — United States (about 26 minutes)
  Practical security training for Dental and Healthcare professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Energy and Utilities — United States (about 23 minutes)
  Practical security training for Energy and Utilities professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Environmental Services — United States (about 26 minutes)
  Practical security training for Environmental Services professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Financial Technology — United States (about 26 minutes)
  Practical security training for Financial Technology professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Hospitality and Hotels — United States (about 29 minutes)
  Practical security training for Hospitality and Hotels professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Insurance — United States (about 26 minutes)
  Practical security training for Insurance professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Legal and Law Firms — United States (about 26 minutes)
  Practical security training for Legal and Law Firms professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Marketing and Media — United States (about 26 minutes)
  Practical security training for Marketing and Media professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Municipal and Local Government — United States (about 23 minutes)
  Practical security training for Municipal and Local Government professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Pharmacy and Life Sciences — United States (about 26 minutes)
  Practical security training for Pharmacy and Life Sciences professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Property Management — United States (about 26 minutes)
  Practical security training for Property Management professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Real Estate — United States (about 26 minutes)
  Practical security training for Real Estate professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Schools and Education — United States (about 23 minutes)
  Practical security training for Schools and Education professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Security and Investigations — United States (about 26 minutes)
  Practical security training for Security and Investigations professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Social Services — United States (about 26 minutes)
  Practical security training for Social Services professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Sports, Fitness and Recreation — United States (about 26 minutes)
  Practical security training for Sports, Fitness and Recreation professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Staffing and Recruitment — United States (about 26 minutes)
  Practical security training for Staffing and Recruitment professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Telecommunications — United States (about 23 minutes)
  Practical security training for Telecommunications professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for Transport and Logistics — United States (about 26 minutes)
  Practical security training for Transport and Logistics professionals in United States. Covers how to spot fake emails, payment fraud, account security, device safety, and privacy obligations.
• Security Awareness for US Managed Service Providers (about 55 minutes)
  Comprehensive security awareness training for staff at a US MSP. Covers sector-specific threats, applicable regulatory regime, the scam patterns aimed at your role, and your breach-reporting obligations. The core secu...
• Security Awareness for US Manufacturing (about 50 minutes)
  Comprehensive security awareness training for staff at a US manufacturer. Covers sector-specific threats, applicable regulatory regime, scam patterns aimed at your role, and breach-reporting obligations. The core secu...
• Security Awareness for US Non-Profits in Healthcare (about 55 minutes)
  Comprehensive security awareness training for staff at a US healthcare non-profit. Covers sector-specific threats, applicable regulatory regime, the scam patterns aimed at your role, and your breach-reporting obligati...
• Security Awareness for US Oil & Gas (about 55 minutes)
  Comprehensive security awareness training for staff at a US oil & gas operator. Covers sector-specific threats, applicable regulatory regime, scam patterns aimed at your role, and breach-reporting obligations. The cor...
• Security Awareness for US Restaurants and Food Services (about 45 minutes)
  Comprehensive security awareness training for staff at a US restaurant or food-service operator. Covers sector-specific threats, applicable regulatory regime, scam patterns aimed at your role, and breach-reporting obl...
• Security Awareness for US Retailers (about 50 minutes)
  Comprehensive security awareness training for staff at a US retailer. Covers sector-specific threats, applicable regulatory regime, scam patterns aimed at your role, and breach-reporting obligations. The core security...
• Security While Travelling for Work — United States (about 20 minutes)
  Security training for business travellers in United States. Device security, border risks, hotel networks, and incident response while away.
• Texas Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-TX. Contact your training administrator for questions.
• US Federal Employment Law: FLSA, FMLA, and Title VII Essentials (about 20 minutes)
  Required compliance and HR training. Course code: US-HR-FED. Contact your training administrator for questions.
• US Oil & Gas Cybersecurity: TSA Directives, CISA, and API Standards (about 28 minutes)
  Required compliance and HR training. Course code: US-OIL-GAS-CYBER. Contact your training administrator for questions.
• Using AI Responsibly in Accounting and Tax — United States (about 40 minutes)
  For Accounting and Tax professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Agriculture — United States (about 40 minutes)
  For Agriculture professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Architecture and Engineering — United States (about 40 minutes)
  For Architecture and Engineering professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Automotive Dealerships — United States (about 40 minutes)
  For Automotive Dealerships professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Colleges and Universities — United States (about 40 minutes)
  For Colleges and Universities professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Construction and Trades — United States (about 40 minutes)
  For Construction and Trades professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Dental and Healthcare — United States (about 40 minutes)
  For Dental and Healthcare professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Energy and Utilities — United States (about 40 minutes)
  For Energy and Utilities professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Environmental Services — United States (about 40 minutes)
  For Environmental Services professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Financial Technology — United States (about 40 minutes)
  For Financial Technology professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Hospitality and Hotels — United States (about 40 minutes)
  For Hospitality and Hotels professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Insurance — United States (about 40 minutes)
  For Insurance professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Legal and Law Firms — United States (about 40 minutes)
  For Legal and Law Firms professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Marketing and Media — United States (about 40 minutes)
  For Marketing and Media professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Municipal and Local Government — United States (about 40 minutes)
  For Municipal and Local Government professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Pharmacy and Life Sciences — United States (about 40 minutes)
  For Pharmacy and Life Sciences professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Property Management — United States (about 40 minutes)
  For Property Management professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Real Estate — United States (about 40 minutes)
  For Real Estate professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Schools and Education — United States (about 40 minutes)
  For Schools and Education professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Security and Investigations — United States (about 40 minutes)
  For Security and Investigations professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Social Services — United States (about 40 minutes)
  For Social Services professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Sports, Fitness and Recreation — United States (about 40 minutes)
  For Sports, Fitness and Recreation professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Staffing and Recruitment — United States (about 40 minutes)
  For Staffing and Recruitment professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Telecommunications — United States (about 40 minutes)
  For Telecommunications professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Using AI Responsibly in Transport and Logistics — United States (about 40 minutes)
  For Transport and Logistics professionals in United States. Covers AI risks specific to your work, what information must never enter AI tools, and your data privacy obligations.
• Washington State Employment Law for Small Business Owners (about 18 minutes)
  Required compliance and HR training. Course code: US-HR-WA. Contact your training administrator for questions.
• Working From Home Securely — United States (about 25 minutes)
  Security and privacy training for remote workers in United States.

Frameworks that apply anywhere, such as ISO 27001, SOC 2, and NIST, are on the full framework list.

Common questions

Which compliance frameworks does Lavawall cover for the United States?

Lavawall maps 21 frameworks specific to the United States, including NIST SP 800-171, FTC Safeguards Rule, GLBA: Gramm-Leach-Bliley Act, HIPAA Security Rule, Sarbanes-Oxley Act (SOX), CMMC. Each has assessment tiers, questionnaires, and policy templates, and its requirements map to a shared control set so evidence collected once counts everywhere it applies.

Does Lavawall offer security and privacy training for the United States?

Yes. Lavawall Training has 97 courses written for the United States, each with a short quiz and a completion record you can show an auditor.

Is this legal advice?

No. The frameworks and courses are general information built from the official law and regulator text, to help you find and organize the right material. Ask a lawyer how the rules apply to your organization.