Safeguard 14.1 Security awareness program: evidence

Safeguard 14.1 security awareness program: what it asks for and why it fails

Safeguard 14.1 asks for a security awareness program that educates the workforce on using enterprise assets and data securely, with training delivered at hire and at least annually. If your enterprise must show CIS Controls v8.1 alignment, this is the Safeguard an assessor will check first, because every other training topic in Control 14 depends on it. The risk behind it is simple: people are the most common route into an enterprise. Phishing, misused credentials, misdelivered files and unpatched software all become incidents through ordinary staff actions, and a documented, repeated program is the mechanism that keeps those actions informed. Safeguard 14.1 sits in Implementation Group 1, the essential cyber hygiene baseline, so it applies whether you are an IG1, IG2 or IG3 enterprise.

The program is an umbrella. Safeguards 14.2 to 14.9 name the topics it must cover, including social engineering, authentication, data handling, unintentional exposure, incident reporting, missing updates, insecure networks and role-specific skills. Safeguard 14.1 requires the program itself to exist, to reach everyone, and to stay current, so the topic safeguards have a vehicle to run through. A useful first check is to confirm that the program has a named owner, a written purpose, and a record of who completed which training and when.

Programs usually fail in three places. Training exists but nobody tracks completion, so the enterprise cannot show how many workforce members have received initial training or stayed up to date. Content is written once and never reviewed, even though the Safeguard expects review at least annually and after significant enterprise changes such as a new cloud platform or a merger. New joiners are never trained because onboarding and the awareness program are owned by different teams. Ask your HR and IT leads to show you the onboarding checklist, the completion report for the last cycle, and the date the content was last reviewed. If any of those three answers is missing, the gap is the first thing to fix.

Who and what the awareness program covers

Safeguard 14.1 applies to every enterprise in IG1, IG2 and IG3, but the size of the work depends on who counts as workforce and which assets and data they touch. The cards below cover the decisions to settle in writing before the first training session, because each one changes the roster, the content and the evidence an assessor will ask for.

Define the workforce roster

The Assessment Specification scores Safeguard 14.1 on the share of workforce members who have received initial training and the share whose training is up to date, so the denominator matters. Decide which records feed the roster, such as the HR system, the identity provider or the directory, and who keeps it current. Confirm how leavers and transfers are removed or updated, because a stale roster inflates or deflates both metrics. Ask whether the roster can be exported so the figures can be reproduced during an assessment.

Decide on contractor and third-party scope

Contractors, temporary staff and third parties with enterprise access are often missed because they sit outside the HR system. Write down which groups with accounts, devices or data access must complete the same training, and which must complete a shorter briefing or rely on their own employer's program. Record the decision and the basis for it. Where a third party is trained by its own organization, confirm how that training is evidenced and when it is refreshed.

Map the assets and data people touch

Training content should reflect the enterprise assets and data each group uses, such as laptops, shared workstations, cloud consoles, customer records or payment data. Build a short list of the systems and data classes that matter most for each role, using the asset inventory and data inventory the enterprise already maintains. This list becomes the basis for the content review and shows an assessor that the program reflects the real environment rather than a generic course.

Handle remote and shared-device users

Remote workers, kiosk users and people sharing devices or generic accounts face risks that a head office course may not address. Decide how they receive training, whether through the same learning platform, on-site sessions or printed guidance, and how completion is recorded for each. Confirm that shared-device users are counted in the roster and that their training status can be traced to a person, not only to a device.

Set the content update triggers

Safeguard 14.1 requires content to be reviewed and updated annually or when significant enterprise changes could affect the safeguard. Define in advance which changes count, such as a new cloud platform, a change to the identity provider, a merger, a new regulated data type or a major incident. Record each trigger, the date the content was reviewed and the reason, so the review history can be shown to an assessor.

Assign program ownership

Security usually owns the content, HR owns hiring and onboarding triggers and the training record, and IT owns the systems and accounts that training covers. Write a RACI or equivalent that names one accountable owner, because unclear ownership is the usual reason initial training dates are missed. Confirm who approves content changes and who signs off the annual review. Safeguard 14.1 has no prerequisite Safeguards for measurement, so this program can begin before other controls mature.

How an assessor tests the security awareness program

This table walks through how the CIS Controls Assessment Specification measures Safeguard 14.1, from the failing condition to the two metrics. Read it as the sequence an assessor follows, paired with the records you should have ready before the review starts.

Test step	What the assessor checks	Evidence requested	Common finding
Confirm a program exists	Whether the enterprise has an established security awareness program at all. Without one, the Safeguard receives a failing score.	Written program scope, owner, and the list of training modules in use	Training happens informally with no defined program or owner
Build the workforce population	The roster of workforce members in scope, against which both shares are calculated. The specification defines the metrics but not how to collect the roster, so the assessor asks how you produced it.	Current workforce roster with hire dates, role changes and departures, plus the method used to build it	Contractors or recent hires missing from the roster, or departed staff still counted
Measure Initial Training Compliance	The share of workforce members who have received initial training, calculated from the roster and the training records.	Completion records per person with dates, matched to roster entries	Records exist for current staff but not for hires made before the platform was adopted
Measure Up to Date Training	The share of compliant workforce members whose training is current under the annual cycle, including training at hire and at least annually.	Dated completion records showing the most recent annual training for each person	Completions recorded once and never refreshed, so records fall out of date after the first year
Review the content	Whether training content was reviewed and updated at least annually, or sooner after significant enterprise changes that could affect the Safeguard.	Dated content review record, version history of course materials, and change log tied to significant enterprise changes	Content reviewed in name only, with no record of what changed or why

How to build the program so it can be measured

This sequence turns Safeguard 14.1 into a program with a named owner, a defined workforce, recorded training and a first measurement against the two metrics the Assessment Specification uses. Each step ends with a record an assessor can inspect.

Define purpose and ownership in writing
Start with a written document that states why the security awareness program exists, what it is meant to change in how the workforce handles enterprise assets and data, and who owns it. Name an accountable owner with the authority to require completion and to report status to leadership. Approval by the owner and a senior sponsor closes this step. The assessor will ask to see the approved document and confirm that it names the owner and the scope of the workforce it covers. Confirm with your own governance team how approvals are recorded before you start.
Build the workforce roster as the denominator
Both metrics divide by the workforce, so the roster must be complete before any training starts. Pull the list of employees, contractors and other workforce members from HR and identity systems, and decide in writing how each group is counted. Record who is added at hire and removed at departure, and who is excluded and why. The roster is complete when someone outside the program owner can reconcile it against HR records. Ask your assessor early which workforce definition they expect to see.
Deliver initial training at hire
Set up the first training module that every new workforce member completes at hire, and make it a condition of receiving access where your policy allows. Use a learning platform, a course in a self-hosted learning management system or a documented live session, as long as the completion for each person can be retrieved. The output is a training record per person showing the date of initial training and the content version they received. Check that new starters appear in the record without manual chasing.
Set the annual training cycle and tracking
Schedule recurring training so every workforce member receives it at least once a year, and record each completion against the individual. The tracking record should show the person, the training, the completion date and whether the person is currently up to date. Automated reminders and escalation to managers are useful, but the record is what the assessor tests. Keep the tracking data exportable so the two metrics can be calculated from it directly.
Schedule annual content review and log changes
Assign a reviewer to check the training content at least once a year and whenever a significant enterprise change could affect the safeguard, such as a new platform, a change in data handling rules or a new regulatory obligation. Record each review with the date, the reviewer, the outcome and the content version issued. The output is a change log that links each revision to its trigger. Assessors commonly ask how the program responded to a specific change, so keep the trigger notes specific.
Run the first internal measurement
Calculate the two Assessment Specification metrics from your own records: the share of workforce members who have received initial training, and the share of workforce members whose training is up to date. Compare the results with the roster and note any gaps, such as people missing from the roster or records without a completion date. Present the results to the program owner with a remediation list. The closed output is a dated measurement report that the program owner has reviewed. Repeat this measurement on a schedule so the trend is visible.
Plug in topic training for Safeguards 14.2 to 14.9
Treat the topic-specific training for Safeguards 14.2 to 14.9 as modules inside this same program, not as separate programs. Each topic, from social engineering to role-specific training, uses the same roster, the same tracking record and the same annual review cycle. Add a topic to the content review log when it changes. The program is complete for this step when each topic module has an owner, a content version and completion records that feed the same two metrics. Confirm the sequence of topic rollout with your own planning.

Evidence that proves a security awareness program

An assessor testing Safeguard 14.1 looks for a documented program and dated records that show who was trained, when, and whether training is still current. The cards below cover the artifacts that answer those questions, and every card depends on the same workforce roster being accurate.

Written program document

This is the document that states the purpose of the security awareness program, names an accountable owner, and describes how training is delivered at hire and at least annually. Its absence is what produces a failing score under the assessment specification, so it is the first thing to produce. Check that the owner is a named role, that the document references the topic-specific training areas it covers, and that it carries a version number and approval date. Export and re-approve it each year, and record the approval in your document control system.

Current workforce roster

The roster is the denominator for both assessment metrics, so every percentage depends on it. It should list every workforce member, including employees, contractors and temporary staff who interact with enterprise assets, with a start date and a status for each person. Reconcile it against the identity provider and HR records before each assessment, because a roster that omits people makes training look more complete than it is. Export a dated copy each quarter and keep the export with the training records it supports.

Initial training completion records

These records show when each workforce member completed initial security awareness training, which is the basis for the Initial Training Compliance metric. For each person, keep the completion date, the course version, and the method of completion, such as a learning management system record or a signed attestation. Confirm that the records match the roster entries and that no hire is missing a record. Learning management platforms such as Moodle can record activity completion, but confirm with your own configuration which completion condition the course uses before treating it as evidence.

Annual training status report

This report shows which workforce members have completed training within the last year, which is the basis for the Up to Date Training metric. Generate it from the same source as the completion records so the two cannot diverge. Flag anyone overdue, record the follow-up action, and keep the report with its generation date. A report generated from a stale export will misstate compliance, so tie each report to the roster export it used. Keep the reports from prior cycles to show trend over time.

Content review log

Safeguard 14.1 expects training content to be reviewed and updated annually, or sooner when significant enterprise changes could affect it. The review log records each review date, the reviewers, what changed, and the reason for the change. Wiki and document platforms with version history, such as XWiki, can keep this trail, but confirm that your retention settings preserve older versions long enough for an assessor to see the full review cycle. Attach the approved version of each course to its log entry.

Records of significant enterprise changes

Safeguard 14.1 requires content updates when significant enterprise changes could affect the safeguard, so assessors look for a link between change events and training updates. Keep records of events such as a new identity platform, a cloud migration, a merger, or a change in approved collaboration tools, each with the decision to review training and the outcome. Connect these records to the change management process so that the trigger is documented rather than remembered. Ask your auditor which change types they expect you to track.

What a security awareness program costs to meet

This table compares the cost components of running a Safeguard 14.1 awareness program, who is paid for each, whether it recurs, and what drives it up. Read it to see where spend concentrates and what to ask for in a quote. The main takeaway is that staff time for tracking and annual content review usually outlasts any one-time build cost.

Cost component	One-time or recurring	What drives it	How to keep it down
Initial content development or licensing	One-time build, plus recurring licence renewals if bought	Number of roles, languages and topics covered, and whether content is written in-house or licensed from a vendor	Start with a core module for all staff, reuse content across the 14.2 to 14.9 topics, and confirm licence terms for reuse
Learning platform cost	Recurring (subscription or hosting)	Licensed seat count for commercial platforms, or hosting and storage for self-hosted open-source platforms	Compare per-seat pricing with hosting cost, and confirm the platform can record completion and export records
Administration and tracking staff time	Recurring	Workforce size, joiner and leaver volume, and how many sources of training records must be reconciled	Automate enrolment from the identity directory and keep one authoritative completion record
Annual content review effort	Recurring	Number of topics, how often enterprise changes occur, and the size of the review group	Keep a change log that triggers reviews, and review by exception between annual cycles
Completion chasing	Recurring, rises with each deadline	Late completions, reminder rounds and manager escalations	Set deadlines at hire and each annual cycle, and publish completion rates to managers
External content or trainer fees	Recurring if used each cycle, one-time if commissioned once	Specialist topics, live sessions, and content localization	Use external content only for topics where internal expertise is thin, and agree reuse rights in writing
Auditor sampling time	Recurring at each assessment cycle	Number of workforce records sampled, and how quickly records can be produced	Keep dated records of training, content versions and review sign-off in one place before the assessment starts

Open-source tools that produce the program evidence

Three open-source platforms can generate much of the evidence an assessor will ask for under Safeguard 14.1. Each one records a different part of the program, so together they support training completion, content review and ownership of materials. None of them decides what the program must contain. The organization still defines the roster, the training content and the review process, and the tools only show that those decisions were carried out.

Moodle completion records

Moodle's activity completion marks a training activity complete when a learner views it, receives a grade from it, or ticks it manually, depending on the conditions set for that activity. The completion condition must match your own definition of training. If a course counts a page view as completion, a learner who skims the page passes the Initial Training Compliance check. Before launch, decide which condition reflects real understanding, and confirm that the Moodle version you deploy supports it. Check that completion records export cleanly for the assessor.

XWiki version history

XWiki keeps every change to a page under version control, recording what changed, when and by whom. Users can compare any two versions and roll back to an earlier one. This gives you a dated history for the annual content review required by Safeguard 14.1, so you can show that the training material was revised after significant enterprise changes. Confirm that the version history is retained long enough to cover your assessment period, and that reviewers sign off in the page itself rather than in a separate email thread.

BookStack role-based ownership

BookStack assigns abilities through roles, and permissions can be overridden per role at the shelf, book, chapter or page level. This lets you give named content owners edit rights over the training materials they maintain, while staff and contractors only read them. The ownership record is what matters for the assessor: it shows who may change awareness content and who approved the change. Review the role assignments at least once a year, and remove access for anyone who has left the content team.

Who does what: your team, a partner and the auditor

Your organization owns Safeguard 14.1 in full. The security awareness program is a written commitment that you must run, fund and be able to explain. Someone in your organization decides what the workforce learns, who must complete it, how often it runs and what counts as up to date. Those decisions cannot be delegated to a vendor or partner, because the outcomes belong to you.

Written program: Approve a program document that states the purpose, the audience and the owner, and that commits to training at hire and at least annually.
Roster and assignments: Maintain the list of workforce members, including contractors where they hold enterprise access, and assign each person to the right courses.
Content decisions: Choose the topics, decide whether content is built in-house or bought, and approve the material before it reaches staff.
Annual review: Review and update the content each year, and sooner when significant enterprise changes could affect the safeguard.
Outcome ownership: Track initial training compliance and the share of workforce members who are up to date, and act on gaps.

Check that a named executive or manager signs off on the program and that the review date appears in your own governance calendar.

Where programs fall short and how to close each gap

Most Safeguard 14.1 failures are not about missing content. They come from records that do not hold together: the roster, the training log, the review history and the change process. Each card names one gap an assessor is likely to find and the fix that closes it.

No written program

Safeguard 14.1 asks for a security awareness program, and the Assessment Specification scores an enterprise with no program as failing. A program is more than a course library. Check that a written document names an owner, the audience, the topics, the delivery methods and the schedule. Keep it in a controlled location so the version in force can be shown on request. Confirm the owner has authority to require completion across the workforce.

Roster does not match HR records

Both Assessment Specification metrics divide by the workforce, so the roster is the denominator. If the training platform holds accounts that HR no longer employs, or omits contractors and new hires, the completion rate is wrong in both directions. Reconcile the training user list against the HR system and identity directory each cycle, and record who is excluded and why. Contractors with enterprise access belong in scope.

New joiners trained late or never

The safeguard expects training at hire, so a new employee who starts work before completing the first module is a gap, even if the annual cycle is on track. Tie the training assignment to the onboarding workflow so the account is created with the course already assigned. Record the hire date and the completion date so the gap between them can be measured for every person.

Attendance without an annual cycle

Training recorded as attended is not the same as training that is current. The Up to Date Training metric depends on each person's completion falling inside the annual window. Set a fixed cycle date, track each person's most recent completion against it, and generate a list of people who are overdue before the window closes. Completion records should show what was completed and when, not only that a course exists.

No content review log

The safeguard requires content to be reviewed and updated annually, or sooner when significant enterprise changes could affect it. Without a dated review record, an assessor cannot confirm the review happened. Keep a log that shows who reviewed each module, the date, the changes made and the reason. Version history in the wiki or document system that holds the content can serve as this record.

No link to enterprise changes

A review scheduled once a year misses changes that arrive between cycles, such as a new cloud platform, a new remote access tool or a merger. Name the change triggers in the program document: new systems in scope, new regulatory obligations, incidents that reveal a behavior gap and changes to acceptable use policy. Route those triggers from change management and incident review to the training owner so a content update is opened when the trigger fires.

How much effort does the security awareness program take to build?

How much effort does it take to build and run a security awareness program?

The effort depends mainly on three drivers: the size of the workforce roster, the number of training topics, and how completion is tracked. A small roster with one set of content and manual tracking is a modest project, while a large or distributed workforce with role-based content and automated records takes considerably more work to build and keep current. Building the program is mostly a one-time cost in content design, platform setup and approval. Running it recurs every year through onboarding training for new hires, annual refreshes, completion follow-up and the content review that Safeguard 14.1 requires. Ask any partner to size the work against these three drivers.

How long does it take to be ready for an assessment?

Readiness depends on what training already exists. An organization that already has onboarding training, annual completion records and a dated content review needs to confirm and tidy that evidence. An organization with no program starts from the design stage, which adds time for content, a learning platform and the first full round of completions. No duration is given here because the answer turns on the starting point. Ask for a readiness review of current training records before agreeing a timeline in writing.

Can our own team build and run the security awareness program in-house?

Yes, a team can do this in-house if it has clear ownership of the program. The team needs to own the workforce roster, the tracking of completions, the annual content review and the evidence of each. The work is mostly administrative and content-focused rather than technically complex, so the main risk is that it stalls without a named owner and a calendar of reviews. Organizations often bring in outside help for the initial platform setup, content design or the evidence pack, and then run the recurring cycle internally.

What does the security awareness program need from our organization?

The program needs four things from the organization:

A named owner accountable for the program and its annual review.
Access to the HR roster, so new hires and current workforce members can be identified and tracked.
Access to a learning platform, such as an open-source learning management system, where completions are recorded.
Sign-off on content from security, legal and HR leads, so the material matches written policy and the organization's own environment.

Without these, the program cannot show who was trained, when, or that the content was reviewed.

What will an assessor ask for first about security awareness training?

An assessor usually starts with the program itself and the completion records. They will ask for the written awareness program, proof that initial training is delivered at hire, and records showing that the workforce received training at least annually. They will also check the dated content review and whether updates followed significant enterprise changes. The CIS Controls Assessment Specification measures two points for Safeguard 14.1: initial training compliance and whether training is up to date. Prepare a current roster, a completion report and the review record before the assessment begins.

What should we request in a partner quote for the awareness program?

Ask for a quote built from a written scope that states the roster size, the number of training topics, the tracking method and the platform used. The quote should separate one-time work, such as platform setup and content design, from recurring work, such as annual reviews and completion reporting. Ask which deliverables you receive, who prepares the evidence pack and what the partner does not do. Confirm that the partner prepares systems and evidence, and that an independent auditor, not the partner, issues any report or certificate.

How DeployOpen prepares the program and its evidence

DeployOpen plans, implements and documents the security awareness program that Safeguard 14.1 asks for, inside your own infrastructure, using self-hosted open-source platforms. We prepare the training records, content review cycle and evidence an assessor would check, while your organization keeps ownership of the program and its controls.

How we scope

Agree in writing which workforce groups, hiring points and training platforms fall inside the Safeguard 14.1 scope.
Confirm which metrics your team will track, such as initial training compliance and up-to-date training status.
Define who owns annual content review and the triggers for an out-of-cycle update after significant enterprise changes.

How we build

Configure a self-hosted learning platform so course completion records are captured per learner and retained for review.
Set up a version-controlled wiki or knowledge base to hold the training policy, content and review history.
Test the enrollment and completion workflow with a pilot group before the program is opened to the full workforce.

How we hand over

Deliver written runbooks covering enrollment at hire, annual assignments, reporting and content review steps.
Provide an evidence index that maps each record type to the Safeguard 14.1 measures, so your team or an assessor can locate it.
Train your administrators to run the platform and export completion reports without DeployOpen involvement.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, agreed separately from the fixed-scope build.
Review training records and content changes with your compliance lead before each annual review cycle.
Confirm with your independent auditor or assessor which evidence they require, since only they issue reports or certificates.