How do you teach cybersecurity standards?

I don't think you can teach cybersecurity standards. You can teach and learn concepts that can help you achieve a certain standard or help in becoming compliant. Figure out the applicability and decide the standard which suits your org the best. One size does not fit all here. Once you have figured out the standard, then you can focus on how to implement it. If it requires upskilling certain people, then do it. If it requires a change in tech approach, then do it. If a change in process is required, do it. The list goes on. Every org has its own journey when it comes to implementing and adhering to cybersecurity standards. You cannot teach standards. You can teach/inform people of their roles and responsibilities according to the standard.

Understanding your audience is so vitally important. Everyone at an organization is a key factor in protecting an organization. You must teach things in a way that they can understand and relate to. It will do not good to put technical content in front of someone who is not technical. Teach them small things they can do to help secure the organization. Don't hold a door open for a non-employee, speak up if they see something suspicious, ensure they never hesitate to ask questions, etc. You can create a great cyber security culture with everyone at an organization.

To add to the already great comments- Knowing your audience is an opportunity to also build partnerships. Show your value by providing concise and relevant information to your target audience. People gravitate to those they can benefit from. If you establish yourself as a quality source of information, people will want to partner with you again. If you are difficult to get concise information from, people may be hesitant to partner with you again. It’s not just about conveying information (one way interaction). Build in interactions (ask questions or solicit opinions). This allows your audience to have a meaningful stake in the discussion. Finally, strategically build in pauses to allow for questions and let the audience process info.

Another way to address this challenge would be, 1. With several standards coming up, its not fair for your staff to know everything. a) Give generic overview of cybersecurity and frameworks to all staff b)for specific functions, cover the relevant standars. Example, GDPR could be in depth session for businesses processing data, for others it an overview. Finance dept needs SOX /GLBA in depth while others need an overview. 2. Most standards for similar comprehensive approach towards security. Identify the commonalities and cover them in session from a comparative standpoint. Again staff play key role in compliance, so they must know their role and duties. However they would not be the party answerable to regulators or auditors.

I found ISO 27k very useful when you actually use it for a practical audit vulnerability, threat and risk audit. The key for any process is the due diligence and frequency of those audit.

Review and evaluate often. Conducting social engineering engagements is a great way to have metrics to measure on the success of security awareness. An organization should work hard every year to ensure they are doing a better job than the year before.

An unpopular opinion: certifications against standards became the objective of many organization, not a mean... as opposed to implementing a real cybersecurity culture. The number of organizations holding cyber certifications especially on ISO27001 is increasing, but the overall cybersecurity / information security status is weaker than ever. Standards were developed to help implementations, but ended as a pretext for certifications. In my country these could be easily bought without implementing any real measure (as openly advertised on the Web).