Key Takeaways
- The cycle never stops: agency training obligations renew annually, every 2 years, or on a date tied to each person's hire.
- Different mandates, different populations: 5 CFR 724.203 reaches every employee, while the annual ethics rules reach filers and specified appointees.
- FISMA is workforce-wide: 44 USC 3554(b)(4) requires security awareness training for agency personnel including contractors.
- New starters have their own clock: 5 CFR 724.203 requires training within 90 calendar days where orientation does not cover it.
- What to automate: the assignment and the renewal, so the coordinator spends time on exceptions.
A training coordinator covering 3 departments is tracking a dozen recurring deadlines at once. Ethics training for covered employees, FISMA security awareness for everybody with system access, harassment prevention for supervisors. Each training on that list renews on a date attached to the person who holds the obligation. The calendar holding all of those dates is usually a spreadsheet.
No single item on that list is unreasonable. What makes the list hard is that each mandate renews on its own clock and reaches a different population, so the coordinator reconciles 4 or 5 overlapping schedules every month. An LMS for employee training earns its place by running those schedules without being asked.
The Mandates Renew on Different Clocks and Reach Different People
Start by separating those mandates, because treating them as one block is what makes the spreadsheet unmanageable. Separating them shows that 5 CFR 724.203 and 44 USC 3554(b)(4) behave quite differently from the annual ethics rules. Those first 2 mandates reach every employee on the payroll. Others reach a defined subset, and the subset changes as people move between positions.
Requirement | Who it reaches | How often |
|---|---|---|
No FEAR Act training, 5 CFR 724.203 | All employees, including supervisors and managers | At least every 2 years |
New employee No FEAR training | New starters not covered by orientation | Within 90 calendar days |
FISMA security awareness, 44 USC 3554(b)(4) | Agency personnel including contractors | Set by the agency program |
Annual ethics training, 5 CFR 2638.307 and 2638.308 | Confidential filers, public filers and specified appointees | Each calendar year |
Of those 4 rows, the ethics ones are most often described loosely. 5 CFR 2638.308 requires annual ethics training for employees who file a public financial disclosure report. Alongside it, 5 CFR 2638.307 covers confidential filers, presidential appointees and employees of the Executive Office of the President. Both ethics rules define their population by position, which is a different list from the payroll.
Why the Population Matters More Than the Count
That distinction between a population and a payroll is the whole scheduling problem. The scale of that difference is easy to miss. OPM counted 2,289,472 federal civilian employees as of March 31, 2025, and only a fraction of that workforce sits in a filer position in any given year. An assignment rule that cannot tell the filers from the rest either over-assigns training or misses the people who need it.
What breaks a list of either kind is a position change. A promotion into a supervisory role in March gives that employee obligations no January spreadsheet recorded. A transfer between departments can move the same employee in or out of a covered population mid-cycle, and the coordinator usually hears about it once a deadline has passed.
What an Automatic Assignment Rule Does
A rule-based assignment turns that discovery problem around. The system holds the condition, such as role, location or hire date, and assigns the course to anybody who matches it on the day they match it. Nobody rebuilds a list under those conditions, and a person who moves into a covered position is enrolled by the move itself.
Before you write those rules, settle 4 things:
- Write down which population each mandate reaches, in the agency's own job terms.
- Decide which attribute the system can read for that population.
- Set the renewal interval and the warning period for each one.
- Name who reviews the exceptions the rule cannot decide.
Auto-recertification handles the second half of the same job. A completion recorded today carries its own expiry, and the renewal fires ahead of that date, which is the difference between a current record and a lapsed one at audit. Automating recurring training covers the same mechanism in a different sector.
Take 1 mandate and 1 department and ask 3 questions. Who is in scope this cycle, how would the system know that, and what happens the day somebody transfers in? Where the answer is a person checking a list, that is the rule waiting to be written.
Let the rule do the assigning.
KC LMS assigns by role, location or hire date and renews before anything expires.
The Record Is What an Audit Asks For
Those rules solve the schedule, and the record is what survives the cycle. An inspector general review or an internal audit asks who was required to complete a course, who did, when, and what version they took. A spreadsheet answers the first 2 questions and rarely the last.
A completion record produced by the system answers all 4 of those questions, because each one is captured as it happens. The date comes from the completion itself, and the course version is attached to the record, so a 2026 answer about a 2024 cycle is readable. For government and public sector teams that is usually the deciding argument.
Keep the Exceptions Visible
Automation of that kind moves the coordinator's judgment to a better place. Those rules handle the ordinary cases, and the coordinator spends their time on the people no rule can classify. A detail assignment, a dual-hatted role and a contractor who needs the security awareness module without the ethics one are all decisions somebody has to make.
Their list of exceptions is worth keeping deliberately. It is the shortest description of where the agency's job structure and its training obligations disagree, and reviewing it once a quarter tends to produce better rules. Ready-made compliance courses against custom ones covers the content side of the same decision.
What KC LMS Changes for an Agency Program
Rule-based assignment is the part KC LMS is built around, which is why it suits an agency carrying 4 or 5 overlapping mandates. Recurring assignments run by role, location or hire date, so a promotion into a supervisory position enrolls that person in the supervisor obligations without anybody watching the personnel action. Bulk assignment with exclusions covers the cases where a whole population needs a course and a named handful does not.
Auto-recertification fires ahead of a certification's expiry, which is what keeps a record current between audits. The completion trail behind each one is built for the question an audit asks. Learning paths and prerequisites hold the sequence where one course has to come before another, such as a security module that opens before the system access it covers is granted.
That sequence still has to reach the staff who are not at a desk. Native mobile apps let an inspector or a field officer complete a module offline and sync on reconnection. Push notifications carry the deadline to the same phone. Workforce readiness reporting for agency leaders covers taking that completion data upward.
Start with the mandate that has the most people in scope, which is usually the 5 CFR 724.203 one, and write its assignment rule this month. Run it alongside your spreadsheet for 1 cycle and compare what each one says about who is due. The difference between those 2 lists is the coordination time you get back.
Frequently Asked Questions
1. How often is No FEAR Act training required?
5 CFR 724.203 requires each agency to train all employees, including supervisors and managers, on a training cycle of no longer than every 2 years. New employees are trained as part of an orientation program, and where an agency does not use orientation for this purpose they must be trained within 90 calendar days of appointment.
2. Does every federal employee need annual ethics training?
No. 5 CFR 2638.308 requires annual ethics training for employees who file a public financial disclosure report, and 5 CFR 2638.307 covers confidential filers, presidential appointees and employees of the Executive Office of the President. Those populations are defined by position, so an assignment rule has to read the position rather than the headcount.
3. What does FISMA require for training?
44 USC 3554(b)(4) requires an agency information security program to include security awareness training to inform personnel, including contractors and other users of agency information systems, of the security risks associated with their activities and their responsibilities under agency policies and procedures.
4. What should a completion record show an auditor?
Who was in scope, who completed, when, and which version of the course they took. A spreadsheet usually answers the first 2 and relies on memory for the version. A record produced by the system captures each as it happens, so a question asked 2 years later is answerable from the record.
References
- Legal Information Institute. 5 CFR 724.203, Training Obligations. law.cornell.edu
- Legal Information Institute. 5 CFR 2638.308, Annual Ethics Training for Public Filers. law.cornell.edu
- Legal Information Institute. 5 CFR 2638.307, Annual Ethics Training for Confidential Filers and Certain Other Employees. law.cornell.edu
- Legal Information Institute. 44 USC 3554, Federal Agency Responsibilities. law.cornell.edu
- U.S. Office of Personnel Management. Federal Civilian Employment. opm.gov