Safeguard 14.1 Security awareness program
The security awareness program itself: purpose, training at hire and at least annually, and annual content review; the umbrella for the topic-specific training safeguards 14.2 to 14.9.
Control 14 Security awareness and skills training
CIS Control 14 covers the security awareness program and the training topics it must include: social engineering, authentication, data handling, unintentional exposure, incident reporting, missing updates, insecure networks and role-specific skills.
Safeguard 14.2 Social engineering awareness training
Training the workforce to recognize social engineering such as phishing, business email compromise, pretexting and tailgating; the training topic most often evidenced with phishing simulations.
Safeguard 14.3 Authentication best practices training
Training the workforce on authentication practices such as multi-factor authentication, password composition and credential management.
Safeguard 14.4 Data handling training
Training the workforce to identify sensitive data and store, transfer, archive and destroy it properly, including clear screen and clear desk habits.
Safeguard 14.5 Unintentional data exposure training
Training the workforce on how data gets exposed by accident, such as misdelivered sensitive data, lost portable devices or publishing to the wrong audience; distinct from deliberate attacks covered in 14.2.
Safeguard 14.6 Incident recognition and reporting training
Training the workforce to recognize a potential security incident and report it, which links awareness training to the reporting process required by 17.3.
Safeguard 14.7 Missing security updates training
Training the workforce to verify and report out-of-date software patches and failures in automated processes and tools, including notifying IT staff.
Safeguard 14.8 Insecure network risks training
Training the workforce on the risks of connecting to and sending enterprise data over insecure networks, including guidance on securing home networks for remote workers.
Safeguard 14.9 Role-specific security training
Role-specific security awareness and skills training, such as secure administration for IT staff, OWASP Top 10 training for web developers and advanced social engineering training for high-profile roles; the only IG2 safeguard in Control 14.
