Ask the regulators where it says that you are required to educate your customers and also how much, how detailed and how that training has to be delivered.
Last I checked, the CFPB was in charge of training the public
You are dealing with "one" examiners opinion and I would treat it as such.
They want to train people on password protection by sending them snail mail? Well, that makes a lot of sense...........