Treat completing required training as a basic duty, like any compliance task, and credit extra security work such as champion duties. Do not rate people on quiz scores or on how many findings their code produced. Those measures punish honesty and reward gaming.
Definitions
A performance review is a periodic assessment that can affect pay and promotion. A security training result is evidence that someone completed or passed a learning activity. Mixing the two raises the stakes of training and can change how people behave in it.
The risk of scoring people
When a quiz score affects a review, people look for the answers, share them, or avoid hard topics. When finding counts affect a review, people avoid scanning, close findings without fixing, or argue over severity. NIST SSDF PO.2.2 asks to review proficiency and measure outcome performance to improve training, which is a statement about improving the training, not grading individuals.
A decision table
| Item | Include in a review? | Reason |
|---|---|---|
| Completed required training on time | Yes, as a duty | Basic compliance |
| Quiz score | No | Rewards test taking and gaming |
| Findings per developer | No | Penalizes honesty and exposed code |
| Serving as a champion | Yes, as extra contribution | Real work, needs credit |
| Fixing security debt | Yes, as delivery | Visible impact |
| Reporting a mistake or near miss quickly | Yes, as a positive behavior | Encourages reporting |
| Repeated disregard of a clear policy | Handle through normal management | Behavior issue |
This table is our recommendation, not a requirement from a framework we cite.
What to do instead
- Set completion deadlines and handle repeated misses through management, as with any required task.
- Use team level metrics for improvement: repeat findings, fix time, review catches.
- Give feedback in pull requests, not in annual reviews.
- Recognize champions and good reporting behavior.
- Keep a clear route for raising a mistake without blame.
What auditors want
Auditors usually look for evidence that training happened and that you follow up on non completion. They do not ask you to link it to pay. Check your own policy or the standard you are working to, and ask the requester to cite the clause if they ask for more.
How to explain it to leaders
Leaders often ask for a single score per person. Offer team trends and a completion report instead, and explain that individual scores will push people to hide problems. Offer to review the data after two quarters and adjust.
Where Safeguard fits
Safeguard provides compliance and evidence automation, which can hold completion records without turning them into individual scores.
Quick check
What if someone refuses to complete required training?
Handle it as you would any required task: remind, escalate to the manager, and apply normal HR processes if needed.
Should managers see training results for their team?
Completion status, yes. Individual quiz scores are not needed for that purpose.
Sources
Last reviewed: 19 October 2026.
