Safeguard 14.3 Authentication training: requirements and evidence

What Safeguard 14.3 authentication training requires

Safeguard 14.3 asks the enterprise to train its workforce on authentication best practices, with multi-factor authentication, password composition and credential management given as example topics. In practice, a compliance lead or engineer must be able to show two things: a written training module that covers authentication, and evidence that the workforce members who need it have completed it. The safeguard sits in Implementation Group 1, so it applies to IG1, IG2 and IG3 enterprises alike. The CIS Controls Assessment Specification scores it on two measures, Initial Training Compliance (the share of workforce members who have received initial training) and Up to Date Training (the share of compliant workforce members), and it fails the enterprise outright if no authentication module exists.

The risk behind the safeguard is credential compromise that users enable without realizing it. Staff who reuse passwords, share credentials, approve unexpected push prompts or enter codes on a phishing page can hand attackers valid sessions that bypass technical controls. Training on MFA fatigue and prompt bombing, for example, teaches people to deny unexpected prompts and report them, and it covers the password composition and credential storage rules the enterprise has adopted. Illustrative example: a finance employee who receives repeated push requests at 2 a.m. should know that the correct response is to deny the prompt and notify security, not to approve it to stop the noise.

Three problems make this safeguard hard in practice. The first is the missing module: many enterprises mention authentication inside general awareness slides, which an assessor may not accept as a module on authentication best practices. The second is unmeasured completion, where training is delivered but no record ties each person to a completion date. Learning platforms such as Moodle can record activity completion, but the enterprise must configure the completion conditions and retain the reports. The third is staleness, since the Up to Date Training metric requires content and completion to be refreshed, so the owner should confirm the refresh cycle and who approves changes to the module.

Which workforce, accounts and tools this training covers

Safeguard 14.3 asks for training on authentication, but the module only works when its audience is defined. The cards below separate who must take it, which authentication topics it must cover, and where training ends and technical controls begin for shared and service accounts.

Employees and full-time staff

Every employee who signs in to enterprise systems belongs in the audience, since they generate most of the authentication events the training is meant to shape. Confirm the population from the identity provider and HR records, not from a list maintained by hand. Check that new hires receive the module before their first login, and that leavers and role changes are reflected in the roster that the completion report uses.

Contractors and temporary workers

Contractors who hold enterprise accounts are part of the workforce for this purpose and should be scoped in explicitly. Decide whether training is delivered by your organization or accepted as equivalent from the contractor's firm, and write that decision into the contract. Without a rule, contractors with live accounts often fall outside the completion metric entirely.

Administrators and privileged users

Administrators hold the accounts an attacker most wants, so the module should address privileged sign-in directly: separate admin credentials, stronger MFA methods and no reuse of personal passwords. Role-specific depth belongs to Safeguard 14.9, so here the aim is a clear baseline for every privileged user. Confirm that administrators complete the module before receiving elevated access.

Scope of the authentication topics

The module should cover three areas: multi-factor authentication (what it protects, how to respond to unexpected push or code prompts), password composition and reuse, and credential management (password managers, not sharing credentials, reporting suspected compromise). Write each topic as a checkable learning objective so the content can be reviewed against the Safeguard. Avoid promising specific password lengths unless your policy sets them.

Shared and service accounts

Training cannot change how a shared mailbox or a service account authenticates, because no person is making the decision each time. Teach staff not to share credentials and to route shared access through the approved mechanism, then rely on technical controls such as Control 5 and Control 6 for vault storage, rotation and MFA where supported. Document which accounts are excluded from the training and which control covers them.

Tools that deliver and record training

The learning platform must record who completed the module and when, because the Safeguard is measured on completion. Moodle's activity completion can mark a module complete when a learner views it, when they receive a grade, or when they tick it manually, so pick the condition that proves the learner engaged with the authentication content. Confirm the chosen condition with your assessor before you rely on it.

How an assessor tests Safeguard 14.3

This table maps how the CIS Controls Assessment Specification scores Safeguard 14.3, from the presence of an authentication training module to the two training metrics and the evidence an assessor requests. Read each row as a question the assessor asks, the evidence that answers it, and where enterprises usually fall short.

Assessment element	What the assessor checks	Evidence that answers it	Common finding
Existence of module	A training module on authentication best practices exists; absence produces a failing score	Module outline or course record naming authentication topics	Training program covers passwords generically but has no authentication module
Topic coverage	The module addresses authentication practices such as MFA, password composition and credential management	Slide or lesson content, quiz questions, learning objectives	Module exists but covers no MFA or credential topics
Initial Training Compliance	Share of workforce members who have received initial training on authentication	Enrollment list compared with completion records, dated per learner	Completion not tracked per person, so the share cannot be calculated
Up to Date Training	Share of compliant workforce members whose training is current	Completion dates, refresh schedule, learner status export at assessment date	Completions are old and no refresh cycle is recorded
Content currency	Training reflects the enterprise's current authentication方式 and policy	Version history, review sign-off, change log tied to the authentication policy	Content still describes retired methods or a superseded password rule
Workforce scope	Training reaches the workforce members in scope, including contractors where they hold accounts	Population list from HR or identity systems matched to the training roster	Contractors and temporary staff with accounts are absent from the roster
Assessor request set	Records that let the assessor reproduce both metrics independently	Module content, enrollment and completion exports, dates, review records	Exports are screenshots or manual summaries that cannot be reproduced

Steps to build and evidence the authentication training module

This sequence turns the organization's own MFA, password and credential rules into a training module, assigns it to the right people, records completion and keeps the content current, so an assessor can trace each step to a dated artifact. CIS defines what to measure for Safeguard 14.3 but not how to run the program, so the outputs below are the records the assessor will ask to see.

Define authentication topics from current policy
Start from the organization's own MFA, password composition and credential management policies, not from a generic template. The owner, usually the security or identity team, lists each rule a workforce member must follow, such as where MFA is required, how passwords are composed and stored, what to do with a shared or suspected-compromised credential, and how to reset access. Each topic is traced to the policy clause it comes from. The output is a short topic list with policy references, approved by the policy owner. If the policies are out of date, fix them first, because training that contradicts policy will fail review.
Write or adapt the training module
Turn the approved topic list into a module that a learner can complete. Teams either write original material or adapt existing courseware to match their own rules and tooling. The module should explain why each rule exists, show the steps for enrolling in MFA and changing a password in the systems staff actually use, and include a short check of understanding. Keep the version number, date and author on the module so later changes are visible. The output is a versioned module and a sign-off from the policy owner that its content matches current policy.
Set the audience and due dates
Define who must complete the module: every workforce member with an account, including employees, contractors and temporary staff, and any role with privileged credentials that needs extra depth. Record the due date rule for each group in writing, aligned with the organization's own training policy. Assign the module in the learning platform or learning management system so that enrolment is recorded against a named person. The output is an audience list reconciled against the identity directory, so that gaps between accounts and trained people can be found and explained.
Deliver at hire and on a recurring cycle
Deliver the module when a person joins and then again on the cycle set in the training policy. Initial delivery covers the first-time learner, and the recurring cycle keeps the content current for everyone already in the workforce. Changes to authentication practice should also trigger a targeted update rather than waiting for the next cycle. The output is a delivery schedule and a log of the sessions that actually ran, with dates and the people reached.
Record completion in the learning system
Configure the learning platform so that completion is recorded per person, per module version. In Moodle, for example, activity completion can mark an activity complete when the learner views it, receives a grade from it, or ticks it manually, depending on the conditions set for the activity. Choose the condition that proves the learner understood the content, typically a passed knowledge check rather than a page view, and document that choice. The output is an exportable completion report showing who completed which version and when. Confirm the exact completion options in your own platform version.
Review content when authentication policy changes
Set a trigger that reopens the module whenever MFA, password or credential policy changes, and review it against the current policy at each change. Record the review, even when no change is needed, so the assessor can see that content stayed aligned with practice. The output is a review log entry for each trigger, the updated module version where changes were made, and a note of which learners must retake the changed material.
Report the two assessment metrics
Calculate the two metrics in the CIS Controls Assessment Specification for Safeguard 14.3. Initial Training Compliance is the share of workforce members who have received initial training, and Up to Date Training is the share of compliant workforce members whose training is current. Produce both from the completion report and the audience list, keep the calculation method and data extract with the report, and resolve any gaps. Confirm the exact measurement rules in the specification before reporting, because an assessor will test the method as well as the result. The output is a dated metrics report that an independent assessor can re-perform.

Evidence that passes for authentication training

The CIS Assessment Specification scores Safeguard 14.3 on two measures: initial training compliance and up-to-date training. The cards below describe the records that show both, and how to keep them current between assessments. Your organization owns the training program; an independent assessor decides whether the evidence is sufficient.

Authentication training module record

Keep the module itself as evidence, with a version number, the date it was last revised and the authentication topics it covers, such as multi-factor authentication, password composition and credential management. The assessment specification fails the Safeguard if no authentication module exists, so the module must be identifiable as a discrete piece of content, not a paragraph inside a general course. Store a copy of each version so you can show what was taught on any past date.

Workforce audience list

Maintain a current list of every workforce member who must take the training, including employees, contractors and temporary staff with access to enterprise accounts. Export it from the identity or HR system on a fixed schedule and record the date of each export. Assessors compare this list against completions to calculate the share of the workforce that has been trained, so gaps between the roster and the training records will show up immediately.

Completion records per member

For each workforce member, record the module version completed, the completion date and the method of completion. An LMS such as Moodle can mark an activity complete when a learner views it, receives a grade or ticks it manually, depending on how the activity is configured. Confirm which condition your course uses, because a view-only completion may not prove that the learner understood the material.

Initial training dates

Record the date each member first completed authentication training, measured from their start date or access grant. This timestamp supports the Initial Training Compliance metric. Check that new hires cannot receive enterprise credentials before this date, or document the exception and the period allowed. Dates that are missing or entered after the fact weaken the record.

Refresh and up-to-date records

Track when each member last completed the module and whether that completion falls within the period your policy sets. The Up to Date Training metric depends on these dates, so the refresh interval must be written down and enforced through reminders, access restrictions or manager reports. Keep the reminder history and escalation notes, since they show that lapsed members were followed up rather than ignored.

Content review log and change triggers

Keep a dated log showing who reviewed the authentication module, what they checked and what changed. Tie each review to triggers such as a change in the MFA method, a new password or credential rule, a new identity platform, or a security incident involving credentials. When a trigger fires, update the module, issue a new version and retrain affected staff. The log proves the content reflects current practice, which is the question the assessor will ask.

What meeting Safeguard 14.3 costs in money and effort

This table breaks down the cost and effort of training the workforce on authentication practices, showing who is paid for each component and whether it is one-time or recurring. Use it to shape the questions you ask in a quote, since no supplied figures exist for these costs and the largest variables are your workforce size and how often authentication content changes.

Cost component	Who is paid or who spends effort	One-time or recurring	What drives it, and what to ask for in a quote
Authentication content development	Internal writers, instructional designers or an outside content provider	One-time to build, recurring to refresh	Number of topics such as MFA enrollment, password composition and credential handling. Ask which modules are included and who updates them.
Learning platform licenses	Commercial LMS vendor or hosting provider	Recurring, often per user or per year	Workforce size and whether the LMS is commercial. Ask for pricing by user count, renewal terms and any fees for reporting features.
Self-hosted open-source LMS	Staff time for installation, hosting and upgrades; no license fee for the software itself	One-time setup, recurring upkeep	Hosting infrastructure and administrator time. Ask the implementation partner to itemize setup, backup, upgrade and support effort separately.
Completion tracking configuration	Engineering or LMS administrator time	One-time, with occasional changes	Number of training modules and how completion is defined, such as viewing a module, passing a quiz or ticking a checkbox. Ask how completion records will be exported as evidence.
Evidence upkeep	Compliance lead or security team	Recurring, usually tied to review cycles	Frequency of assessments and the number of workforce members to track. Ask for a report that shows initial training compliance and up-to-date training status.
Refresh and review of authentication content	Security team, with content owners and HR where policy changes	Recurring	How often MFA, password and credential guidance changes. Ask how updates are triggered by policy changes and new threats.
External review	Independent auditor or assessor, or an outside consultant	Periodic, tied to assessment cycles	Scope of the assessment and whether a third party reviews training content or only the completion records. Confirm with the assessor what evidence they will request before buying help.
Staff time for participation and follow-up	Workforce members and managers	Recurring	Length of each module and how often staff must retake it. Ask the provider to estimate effort per module so you can plan around business hours.

How a self-hosted learning platform produces the evidence

The evidence for Safeguard 14.3 is a record that each workforce member received training on authentication practices, and that the record stays current. A self-hosted learning platform can produce that record, but only if its activity completion settings are configured so that a completion mark means the learner actually took the training. In Moodle, completion can be triggered when a learner views an activity, when they receive a grade from it, or when they tick it manually. Each trigger proves something different. A view shows the page was opened, not that the content was understood. A grade shows an assessment was passed. A manual tick is the weakest signal because anyone can set it, so it should be avoided for an authentication module or limited to a named approver with a logged reason.

Before relying on Moodle for this safeguard, the team should confirm three things in its own configuration. First, that the authentication training activity uses a completion condition that matches the content, such as a graded quiz on MFA enrollment, password composition and credential handling. Second, that the completion data can be exported in a form the assessor can sample, including learner identifiers, completion status, timestamps and the course and activity they relate to. Third, that the two CIS Assessment Specification metrics, Initial Training Compliance and Up to Date Training, can be calculated from that export against the current workforce list. The Assessment Specification defines what to measure, so the team should check the metric definitions directly in the CIS Controls Assessment Specification before designing reports.

Because the platform runs inside the client's own infrastructure, the organization owns the completion data, the retention settings and the access controls around the reports. That also means the organization is responsible for backups of the learning database, for restricting who can edit completion settings, and for keeping an audit trail of changes to the authentication module. An implementation partner can configure the platform, build the export and document the procedure, but the organization decides what counts as training complete and who signs off on the records. Ask the partner to show a test export for a sample of learners and to confirm, in writing, which Moodle version and completion settings the evidence depends on. Note that completion behavior is documented in the Moodle developer documentation on the activity completion API, so the version in use should be checked against it.

Who owns the training, who can help and where the auditor stops

Your organization owns Safeguard 14.3 and every decision about what workforce members are taught about authentication. The control is an obligation of the enterprise, so it stays with your security, HR and IT leadership even when an outside party helps build the material or the learning platform. Responsibility sits with the people who can define the policy, decide who must complete the training and answer for the results.

Policy and scope: Define which authentication topics the module covers, such as multi-factor authentication, password composition and credential management, and which rules staff are expected to follow.
Workforce list: Maintain the authoritative list of workforce members in scope, including new hires, contractors and staff whose roles change, because completion rates are only meaningful against a complete population.
Content approval: Review and approve the training content against your own authentication standards, identity platform and any regulatory expectations you carry.
Program operation: Schedule initial training, decide the refresh cycle for up-to-date training, and handle non-completion through a documented escalation path.
Evidence ownership: Keep the completion records, approvals and version history so you can produce them on request.

Confirm internally who signs off the module, who owns the workforce list and how often the content is reviewed before any partner begins work.

Where authentication training usually falls short

Most authentication training gaps are not about missing content. They are about training that never reaches the right people, is never recorded, or drifts away from the policy it is meant to explain. Each card below names one gap, why it matters for Safeguard 14.3, and the closing action an assessor would expect to see.

Generic course without authentication content

A general security course that covers phishing and passwords in passing rarely addresses MFA enrollment, password composition or credential handling as the enterprise actually runs them. Safeguard 14.3 is scored on whether a module on authentication best practices exists, so a generic course may fail the check on its own. Close the gap by adding a dedicated module that walks through the enterprise's own MFA methods, password rules and credential storage rules, and confirm the module is named in the training record.

No record of who completed training

Training that happens but is not recorded cannot be measured or shown to an assessor. The assessment specification measures the share of workforce members who have received initial training, so the organization needs a roster that ties each person to a completion date. Close the gap by using a learning platform that records completion per learner, export the roster each quarter, and reconcile it against the current HR and identity directory.

Training given once at onboarding

Authentication practices change as MFA methods, password rules and attack techniques change, so a single onboarding session goes stale. The Up to Date Training metric checks whether workforce members remain current, not just whether they once completed a course. Close the gap by setting a refresh cadence in the awareness program, assigning annual or event-driven reassessments, and tracking overdue learners as a standing report.

Contractors and temporary staff left out

Contractors, temporary staff and outsourced operators often hold accounts, use MFA and handle credentials, yet they sit outside the HR onboarding flow that triggers training. An assessor reviewing the workforce population will ask whether these people were included. Close the gap by defining workforce membership in policy, tying training assignment to account provisioning, and requiring service providers to show their staff completed equivalent training.

Content that contradicts the authentication policy

When training teaches a password length, reset interval or MFA method that differs from the current policy, staff follow the training and fail the policy, and the organization cannot defend either. This is a common finding in reviews of awareness content that was copied from a vendor template. Close the gap by mapping each training statement to a policy clause, assigning an owner to review both on each policy change, and recording the review date in the training material.

Questions buyers ask about Safeguard 14.3 training

How much effort does Safeguard 14.3 training take in-house?

The effort is mostly in writing and maintaining one authentication training module, delivering it to every workforce member and tracking completion. The Assessment Specification scores the safeguard on two measures: initial training compliance, meaning the share of workforce members who have received initial training, and up to date training, meaning the share of compliant members. Effort rises with headcount, the number of user groups that need different content, and how often the module must be refreshed. Ask your team to estimate the authoring, hosting, reminders and reporting hours separately, since these recur every cycle, not just at setup.

Do we need an outside partner to meet Safeguard 14.3?

Not necessarily. The organization owns its training program, and an outside partner is useful when internal staff lack time or instructional design skills, or when the module must be hosted on a self-hosted learning platform inside your own infrastructure. An implementation partner such as DeployOpen can prepare the platform, configure completion tracking and document the evidence. Only an independent auditor or assessor issues reports or certificates, so the partner does not confirm that the safeguard is met. Keep the scope, deliverables and ownership written down before work starts.

What does the training team need from the rest of the organization?

The training owner needs a named sponsor, an authoritative source for your authentication policy, and access to the identity platform so the content matches real settings. Security and identity teams must confirm which MFA methods, password rules and credential handling practices are current, because outdated guidance is a common gap. HR or the learning owner must provide the workforce roster so completion can be compared against it. Legal or works councils may need to review monitoring of training completion in some jurisdictions.

How long does setup usually take?

No setup duration has been confirmed for this safeguard, so treat any figure you hear with caution. The time depends on how many authentication topics the module must cover, whether content already exists from an earlier program, how many audiences need separate versions, and how quickly the platform and roster can be connected. Ask any provider for a timeline tied to a written scope, with the dependencies on your identity, HR and approval teams listed separately.

Can Moodle produce the completion evidence for Safeguard 14.3?

Moodle can record evidence that a learner completed an authentication module, provided activity completion is configured for that activity. According to the Moodle developer documentation, an activity can be marked complete when the learner views it, when they receive a grade, or when they tick it manually, depending on the conditions set. Choose the condition that proves the learner engaged with the content, and export completion reports with dates for the assessor. Confirm that your Moodle version and plugins match your evidence requirements, and that retained records meet your own retention policy.

How does Safeguard 14.3 relate to the other Control 14 safeguards?

Safeguard 14.3 covers one topic, authentication best practices such as MFA, password composition and credential management. It sits under the security awareness program in Safeguard 14.1, which requires the overall program, and it runs alongside topic-specific safeguards such as 14.2 on social engineering, 14.4 on data handling and 14.6 on incident reporting. Many organizations combine these topics into one curriculum but keep separate completion records per topic, so each safeguard can be evidenced on its own. Safeguard 14.9 adds role-specific training, which is the only Control 14 safeguard in Implementation Group 2.

Does Safeguard 14.3 need prerequisite safeguards?

The Assessment Specification lists no prerequisite safeguards for measuring Safeguard 14.3. The safeguard is assigned to Implementation Group 1, so it applies to IG1, IG2 and IG3 enterprises. Failing to have any training module on authentication best practices results in a failing score, so the minimum is a documented module that exists and is delivered. Confirm with your assessor how they will sample completion records and whether they expect a link to the authentication policy in the content.

How DeployOpen prepares authentication training evidence

DeployOpen scopes this work in writing before any build starts, so the client knows which learning platform is deployed, which authentication policy the module reflects, who owns each decision and what evidence the package will contain. The platform is a self-hosted open-source learning management system, such as Moodle, installed in the client's own cloud account, data center or air-gapped network. Course data, learner records and completion logs stay inside the client's boundary. DeployOpen configures the course, enrolls the workforce groups in scope and sets up completion reporting so the two Safeguard 14.3 metrics, Initial Training Compliance and Up to Date Training, can be read from the platform rather than reconstructed from spreadsheets. Moodle's activity completion feature can mark an activity complete when a learner views it, receives a grade or ticks it manually, so the client should decide in advance which condition counts as completed training.

The module itself must be built around the client's own authentication policy, not a generic slide deck. Before content work starts, the client should confirm the password composition rules, the multi-factor authentication methods it permits, the rules for credential sharing and storage, and the process for reporting a suspected credential compromise. DeployOpen helps structure the lessons and knowledge check around those rules so an assessor can match each training topic to a documented requirement. Where a policy is still in draft, the client should not train against it, because the assessor will compare the training content with the approved version and the date it took effect. The evidence package typically includes the approved policy, the course outline and content version history, the enrollment list, completion exports and the record of who was trained before each policy change.

DeployOpen does not issue audit reports, attestations or certifications. Only an independent auditor, assessor or certification body can state whether the organization meets Safeguard 14.3 or any framework that maps to it. The client owns its controls, decides what the training must cover, approves the content and remains responsible for keeping the completion records current as staff join, move roles and leave. Ask any implementation partner to confirm in the written scope which deliverables are configuration and documentation and which decisions stay with the client. The CIS Controls Assessment Specification lists the measures used to verify the Safeguard, and the CIS Controls Assessment Specification for Safeguard 14.3 should be read alongside the client's own test plan before scope is agreed.

Safeguard 14.3 Authentication best practices training