CIS 14.5 unintentional data exposure training

What Safeguard 14.5 asks your workforce to learn

Safeguard 14.5 requires training on the causes of unintentional data exposure. If you are a compliance lead or engineer who must show this Safeguard is met, the evidence you need is a training module that teaches staff how data leaks by accident, plus proof that the workforce has completed it. The Safeguard gives misdelivered sensitive data, losing a portable end-user device and publishing data to unintended audiences as example topics. Each one is an ordinary mistake: an email sent to the wrong recipient, a laptop left on a train, a shared folder set to public or a spreadsheet with a hidden tab uploaded to a website. None of these needs an attacker, which is why this topic sits apart from the deliberate attacks covered in Safeguard 14.2. Staff who understand social engineering may still send a customer file to the wrong address, so the two topics need separate content and separate evidence.

The requirement is hard to evidence for three reasons. First, the topics are broad, so a generic security course that mentions data in passing will not show the specific causes are covered. Second, the training must be documented as a module that exists, not only as general awareness. The Assessment Specification scores the Safeguard as failing when no training module on unintentional data exposure exists, so the module itself is the first artifact to produce. Third, the Assessment Specification measures two things: initial training compliance, which is the share of workforce members who have received initial training, and up-to-date training, which is the share of compliant members. Your learning platform must therefore report completion by person and date, not just publish course content. Confirm with your assessor how they will sample staff records and which completion dates they will accept.

Because Safeguard 14.5 is in Implementation Group 1, it applies to IG1, IG2 and IG3 enterprises alike, and it has no prerequisite safeguards under the Assessment Specification. That makes it a good early item for a small team: the scope is clear and the evidence can be built from a module, a completion report and a roster. For a self-hosted learning platform such as Moodle, released under GPL-3.0-or-later, activity completion can record when a learner views a resource, receives a grade or ticks the activity manually, so choose the condition that matches what your assessor will accept as proof of training. Document that choice in your procedure. The CIS Controls Navigator also maps this Safeguard to NIST SP 800-53 Rev. 5 control AC-22 and ISO/IEC 27001:2022 Annex A control 6.3, which may help you reuse the same records.

Which people, data and teams 14.5 covers in practice

Safeguard 14.5 looks simple on paper, but the scope decisions around who is trained, which data examples to use and who owns the content determine how much work the training creates. The cards below cover the decisions most likely to change the program and the checks to make before the scope is agreed in writing.

Workforce members in scope

Decide whether employees, contractors, temporary staff and interns all receive the module. The Safeguard speaks of workforce members, so a scope that excludes contractors with access to sensitive data leaves a gap an assessor will ask about. Check that the training population is generated from HR and identity records, not from a manual list, so new starters and leavers are picked up automatically.

Sensitive data types for examples

Choose the data types the scenarios will use, such as customer records, payroll files, health information, source code or board papers. Examples that match the work people do are more likely to change behavior than generic ones. For illustration, a scenario about a spreadsheet of customer account numbers sent to the wrong recipient is more useful to a finance team than a general warning about confidentiality.

Users asset class

Safeguard 14.5 is assigned to the Users asset class in v8.1, so the people themselves are the asset under review. Map the training population to user accounts and roles so the completion records can be tied to who holds access to sensitive data. Confirm which systems hold the data those users can misdeliver or publish, since those systems define the examples.

Devices and documentation in view

Portable end-user devices are named as a cause of exposure, so the scope should list laptops, phones and removable media that carry sensitive data. Documentation also matters: the training content, the completion records and the policy it refers to must be kept and version controlled. Confirm which device types and document repositories the module references before content is written.

Content owners versus delivery teams

Separate the people who write the scenarios, usually security or privacy, from those who host and track delivery, usually IT or the learning platform. Record who approves content changes and who answers for completion data. Without that split, the module can go out of date when data flows change, and no one is accountable for the evidence an assessor requests.

Program context from Control 14

Safeguard 14.5 sits inside the security awareness program set by Safeguard 14.1, which requires training at hire, at least annually, and periodic content review. Treat 14.5 as one module in that program, not a standalone course. Confirm that the program owner, review cycle and retention of completion records are defined once and then applied to this topic.

How an assessor tests Safeguard 14.5 and what fails it

This table sets out how an assessor measures Safeguard 14.5, the evidence they will ask for and the findings that most often lead to a failing or weak score. Read each row as a question the assessor will put to the program owner before deciding whether the training is in place and kept current.

Test element	What the assessor checks	Evidence to prepare	Common findings
Training module existence	Whether a training module on unintentional data exposure exists at all. The Assessment Specification scores a missing module as a failure.	Current module content, its title, version history and the topics it covers, such as misdelivered sensitive data, lost portable devices and publishing to the wrong audience.	No dedicated module, or exposure topics folded into a general privacy slide with no examples or actions.
Initial Training Compliance	The share of workforce members who have received initial training on unintentional data exposure.	Audience list drawn from the HR or identity system, and completion records matched to each named person.	Contractors, temporary staff or new joiners missing from the audience list, or completion records that cannot be traced to a person.
Up to Date Training	The share of compliant workforce members whose training is current under the enterprise's own refresh cycle.	Completion dates per person, the refresh interval the enterprise has set and a report of anyone overdue.	Completions that predate the current content, or no defined refresh interval, so currency cannot be shown.
Audience scope	Whether the training reaches the workforce members who handle sensitive data, not only those who sit in a specific department.	Documented audience rules, such as role or group membership, and a reconciliation against people who hold data access.	Training limited to a single team while others send or publish sensitive data.
Completion evidence	Whether completion is recorded in a way that can be verified after the fact.	Learning platform exports with timestamps, user identifiers and the module version completed. Confirm the platform's completion rules before relying on them.	Manual spreadsheets, or completion marked by a click without any check that the content was viewed.
Process documentation	Whether the enterprise can explain who owns the module, how it is updated and who follows up on gaps.	Owner named in the awareness program, update trigger, and the follow-up procedure for overdue staff.	No named owner, and content last reviewed before the current data handling practices were adopted.
Link to the awareness program	Whether the module sits within the security awareness program described under Safeguard 14.1 and is reviewed with it.	Program plan showing this module, its audience and its review date.	Module run as a one-off project, with no link to the wider program or its annual review.

How to build the 14.5 training module step by step

This sequence turns Safeguard 14.5 from a policy line into a working training module, with an exposure scenario list, a delivered course, an audience roster, completion records and a dated review log that an assessor can trace from requirement to evidence.

Identify exposure scenarios for your data and devices
Start by listing how sensitive data could reach the wrong people in your own environment. Work with data owners, the service desk and the teams that manage email, file sharing, publishing and laptops or phones. Typical entries include misdirected email or file shares, lost or stolen portable end-user devices, and content published to an audience wider than intended. Your output is a scenario list that names each scenario, the data types involved and the staff roles most likely to meet it. It is done when each scenario is tied to a real workflow in your organization and a data owner has reviewed it.
Write the module content from the scenario list
Turn each scenario into a short lesson with a plain description of what went wrong, the warning signs, the correct action and who to tell. Use examples drawn from your own tools, such as the email client, shared drive or publishing platform staff actually use. Label any hypothetical example as illustrative. Have security and the data owners approve the wording. The output is a versioned training module with a stated owner and a link between each lesson and the scenario it covers. It is done when every scenario on the list has a matching lesson.
Decide delivery method and training frequency
Choose how the module will be delivered, such as a learning management system course, a recorded session or an instructor-led briefing, and set the frequency that your security awareness program requires. Safeguard 14.5 is tested on whether workforce members receive initial training and stay current, so write the required frequency into the program document and confirm it with the assessor's expectations. The output is a delivery and schedule specification. It is done when the schedule is approved and the training platform can run it without manual workarounds.
Set audience and enrolment rules
Define who must take the module, including all workforce members, contractors with access to enterprise data, and any new joiner. Write enrolment rules that assign the course automatically at hire and when a workforce member changes role or receives a new device. Connect the audience to your identity or HR records so the roster stays accurate. The output is an audience roster and written enrolment rules. It is done when HR or identity data can produce the roster on request and the rules have an owner.
Run the first cohort and confirm comprehension
Deliver the module to the first cohort, starting with a pilot group that includes a few people from high-exposure roles. Collect feedback on clarity and ask staff to explain the correct response to one scenario, which shows whether the content works. Correct gaps before wider rollout. The output is a cohort record with delivery dates, attendance and feedback, plus a list of changes made after the pilot. It is done when the pilot group has completed the module and the changes are logged.
Record completions as audit evidence
Configure the learning platform to record completion for each learner. In Moodle, for example, activity completion can mark an activity complete when a learner views it, receives a grade or ticks it manually, depending on the conditions you set, so choose a condition that proves the learner engaged with the content and not just opened the page. Export the completion data regularly and keep it with the roster. The output is a completion record per workforce member showing initial training and the date of the most recent completion. It is done when you can reconcile the completion list against the audience roster and find any gaps.
Review content and completion records on schedule
Review the module on a fixed schedule and whenever a relevant incident, new data type, new device or publishing tool changes exposure. Check each scenario against current workflows, update lessons and retire obsolete ones. Reconcile completion records to show that current staff remain up to date. Record each review with the reviewer, date, changes and the reason. The output is a review log that links module versions to completion records. It is done when the log shows that content and completions were reviewed on schedule and that gaps were closed.

Which evidence passes an assessment for 14.5

An assessor testing Safeguard 14.5 looks for a training module, a roster, dated completion records and metric calculations that agree with each other. The cards below cover the artifacts that connect them, and the completion rule that makes the records mean something.

Training module content on unintentional exposure

The module itself is the first artifact an assessor asks to see. It should cover the causes named in the Safeguard, including misdelivered sensitive data, lost portable end-user devices and publishing data to unintended audiences, with examples drawn from the organization's own workflows. Under the assessment specification, a missing module on unintentional data exposure scores as a failure, so this artifact must exist in a retrievable form. Keep the exported version alongside the date it was in use.

Workforce roster for the denominator

Both metrics divide by the workforce, so the roster is the denominator an assessor will recompute. It should list every workforce member in scope, with the source system, the export date and the rule used to include or exclude contractors and part-time staff. A roster that differs from the identity directory or HR system will raise questions about the whole calculation. Export it from the system of record each time you compute the metrics.

Learner completion records with dates

Completion records show which workforce members took the module and when. Choose the completion condition before the first learner starts. In Moodle, activity completion can mark an activity complete when a learner views it, when they receive a grade from it, or when they tick it manually. Viewing alone may not show that the content was understood, so document the condition chosen and why it proves the module was taken.

Scoring calculation for both metrics

The assessment scores Safeguard 14.5 with Initial Training Compliance, the share of workforce members who have received initial training, and Up to Date Training, the share of compliant workforce members. Keep a worked calculation that takes the roster and completion records and produces each percentage, with the formula written out. An assessor will test whether the numbers reproduce, so store the inputs with the output rather than a single figure in a slide.

Content review and version history

The program must show that the module is reviewed and kept current as data handling practices and tools change. Keep a review record with the reviewer, the review date, what was checked and what changed. Each published version should carry a version identifier and a date, so the assessor can match a completion record to the content the learner actually saw. Without this link, an update can make earlier completions look like they cover content that no longer exists.

Dated exports between audits

Learning platform data changes daily, so a single export taken at audit time shows only a snapshot. Schedule exports of the roster, completion records and calculations on a fixed cadence, and store them with the date and the platform version. Confirm with your assessor how far back they expect records to go and how the period under review is defined. Dated exports let the team answer questions about any point in the period without rebuilding data from memory.

What meeting 14.5 costs in money and staff time

This table lists each cost component of running Safeguard 14.5 training, who is paid for it, whether it is one-time or recurring, and what pushes it up or down. Read the recurring rows first, because they set the long-term cost of keeping the training current and evidenced. No price or duration is stated here, so use the question column to request figures in a written quote.

Cost component	Who is paid or who spends time	One-time or recurring	Cost drivers and what to request in a quote
Content development on data exposure topics	Internal staff or an external training developer	One-time, then recurring when content changes	Number of data types and exposure scenarios covered. Request the hours or fixed fee, the named topics, and who owns the source files.
Learning platform	Software licensor, or the organization for a self-hosted open-source platform such as Moodle (GPL-3.0-or-later)	Recurring for licensed platforms; recurring hosting and maintenance for self-hosted	Workforce size and hosting model. Self-hosting removes license spend but not hosting, patching or backup effort. Ask whether the quote covers installation and hardening.
Engineering time to configure completion and reporting	Internal platform engineers or an implementation partner	One-time build, with occasional recurring changes	Completion rules, reporting for the two assessment metrics, and integration with the HR roster. Ask for the configuration scope and acceptance tests in writing.
Roster maintenance	HR, IT service desk or training administrator	Recurring	Joiner, mover and leaver volume. Each workforce change must be reflected in the training population used to calculate the Initial Training Compliance share.
Annual refresh of the data exposure module	Internal content owner or external developer	Recurring	Frequency of delivery, changes in data classification or publishing workflows, and the number of languages. Ask whether translation and re-recording are priced separately.
Delivery and tracking of training	Workforce members (time away from work), training administrator	Recurring	Module length and delivery frequency. Staff time is usually the largest unseen cost, so ask the vendor or partner to estimate hours per learner.
External review of content	Independent training or compliance reviewer	Optional, one-time or recurring	Whether the content must be reviewed before an assessment. Ask for the review scope and the reviewer's independence from the content author.
Assessor sampling and evidence preparation	Internal compliance lead, auditor or assessor	Recurring with each assessment cycle	Number of workforce members sampled and how quickly records can be produced. Only the independent assessor sets the assessment scope and conclusions.

Who owns 14.5 and what a partner can take on

Your organization owns Safeguard 14.5. The CIS Controls Assessment Specification measures whether the enterprise has a training module on unintentional data exposure and whether workforce members have completed it, so the decisions about what the module covers, who must take it and when, and whether the record is accepted as accurate all sit with you. A partner can draft material, but it cannot accept responsibility for your workforce or your data.

Content decisions: Decide which exposure scenarios apply to your business, such as misdelivered sensitive data, lost laptops or phones, and publishing to the wrong audience, and approve the final wording.
Roster: Maintain the authoritative list of workforce members in scope, including contractors where your policy requires them, and keep it current as people join and leave.
Training record sign-off: Review completion data and accept it as the official record before it is used for reporting.
Policy alignment: Tie the module to your data handling and incident reporting policies so staff know whom to contact.
Ownership of results: Decide how gaps are followed up and who is accountable for the score.

Before you start, confirm that a named owner holds each of these decisions in writing.

Where 14.5 programs usually fall short

Most Safeguard 14.5 programs fail on paperwork and proof rather than on content. The gaps below cluster around scope, roster accuracy, completion rules and evidence that a reviewer can reproduce later. Each card names a gap and the fix that closes it.

Phishing-only training

Many programs teach phishing under Safeguard 14.2 and stop there, so nothing covers misdelivered sensitive data, lost laptops or files published to the wrong audience. Add a separate module on unintentional exposure with examples from your own environment, such as an email sent to the wrong distribution list or a shared folder set to public. Check the module exists as its own item in the training catalog, because the assessment specification scores a failing result when no such module is present.

Rosters that drift from HR

Training metrics are only as good as the population they count. If the learning system holds accounts that HR has already removed, or omits contractors and recent starters, the Initial Training Compliance and Up to Date Training shares will be wrong. Reconcile the training roster against the HR system and the identity directory each cycle, and record who was excluded and why. Ask your provider how the roster is built and who approves changes.

Page views counted as learning

Some platforms mark a module complete as soon as a learner opens it, which makes the completion figure reflect clicks rather than understanding. Write a completion rule for each module, such as a passing quiz score or a tick after a scenario, and configure the platform to match. Moodle, for example, can mark an activity complete on view, on grade or on manual tick, so the rule chosen must be documented and applied consistently across modules.

No record of content review

Safeguard 14.1 expects the awareness content to be reviewed each year, and a 14.5 module that describes last year's systems or retired document tools will not hold up in a sample. Keep a dated revision history for each module with the reviewer, the date and the change made. Retain the prior version so an assessor can see what was taught at a given point in time.

New hires and contractors missed

Training is often assigned once to existing staff, so people who join later or work through a contractor firm never receive the unintentional exposure module. Tie enrollment to the onboarding and access-granting workflow so the training is assigned on the day an account is created. Confirm with each service provider whether its personnel are in scope and how their completion records are returned to you.

Evidence that cannot be reproduced

A completion report exported on one day can be impossible to recreate later if the learner list changed, the module was edited or logs were purged. Set a retention period for training records, store dated exports of the roster, the module version and the completion rule, and be able to rerun the same report for a past date. Test this by pulling a random sample of workforce members and tracing each one from roster to completion record to module version.

Questions buyers ask about meeting Safeguard 14.5

Can we meet Safeguard 14.5 in-house without an outside partner?

Yes, in principle. CIS Safeguard 14.5 asks the enterprise to train its workforce on the causes of unintentional data exposure, and the organization owns that obligation whoever builds the material. An in-house team can write the module, run it and keep records if it has people who understand the enterprise's data handling rules, email and file sharing setup, and portable device policy. The harder part is ongoing upkeep: someone has to track completion, refresh content when tools or policies change, and produce evidence an assessor can inspect. Ask yourself whether those roles already exist before deciding.

What does it cost to train staff on unintentional data exposure?

The cost has four components: staff time spent on the module, content design, the learning platform, and the records and reporting that show completion. Costs rise with workforce size, the number of distinct roles needing tailored examples, how often content must change, and whether the platform is already in place. Most of the spend is labor, and most of it recurs because training must be refreshed. Costs are not published by CIS, so no figure applies here. When requesting a quote from any provider, ask for a written scope that lists the module content, the number of learners covered, the platform setup, the evidence deliverables, and the refresh cycle. Ask which items are one-time and which recur.

How long does it take to build and roll out this training?

The timeline depends on how much existing material you can reuse, how many learner groups need separate examples, and how quickly your team can review drafts. A single general module can be drafted and reviewed faster than a set of role-specific variants. Confirm the timeline in writing with any provider, including review rounds, the date the module goes live, and the date the first completion report is produced. Your own team will need time from data owners, IT, legal or privacy staff, and whoever approves training content. Plan that review time explicitly rather than assuming it will fit into normal work.

Do phishing simulations satisfy Safeguard 14.5?

No. Phishing simulations address Safeguard 14.2, which covers social engineering, and they do not cover the accidental exposure topics that 14.5 names, such as misdelivered sensitive data, a lost laptop or phone, or content published to the wrong audience. A simulation may give you a training signal for one behavior, but it cannot show that staff were taught those exposure causes. Keep the two as separate modules with separate completion records. An assessor will look for content that addresses the exposure causes directly.

How often should the unintentional data exposure module be refreshed?

Refresh it on a schedule your policy sets and on any change that alters the exposure risk, such as a new file sharing tool, a change to the email system, a new device policy, or a notable incident. The CIS Controls Assessment Specification scores 14.5 on initial training compliance and on whether training is up to date, so the timing you choose must be documented and followed. Ask any provider to commit to a refresh cycle in the written scope. Also decide who triggers an off-cycle update when tooling or policy changes.

Will an assessor accept a self-hosted learning platform as evidence?

An assessor looks at the evidence, not the brand of the platform. A self-hosted open-source learning management system such as Moodle can produce completion records, but you must confirm the platform's activity completion settings are configured to record the right event. Moodle's activity completion can mark an activity complete when a learner views it, receives a grade, or ticks it manually, depending on how the activity is set up. Choose the condition that proves the learner engaged with the exposure content, and export records that show learner, module and date. Confirm the approach with your assessor before you rely on it.

How do we choose an implementation partner for this work?

Start with a written scope that names the module content, the learner population, the platform, the evidence to be delivered and the refresh terms. DeployOpen plans, implements and documents self-hosted open-source platforms inside your own infrastructure and prepares systems and evidence for compliance assessments, but it does not issue audit reports or certifications. Ask any partner to show how the work maps to 14.5 and what artifacts you will own afterward. Confirm who will support the platform after handover and how updates are handled. Your independent auditor or assessor should be consulted before scope is finalized.

How DeployOpen prepares 14.5 evidence for your assessment

DeployOpen plans, implements and documents self-hosted open-source learning platforms inside your own infrastructure, so training records for Safeguard 14.5 sit in systems you control. We prepare the module, completion tracking and evidence packs; your organization owns the training content decisions and the control, and an independent assessor reviews the result.

How we scope

The written scope names the workforce population, the in-scope learning platform and where its data is hosted.
We confirm which exposure scenarios the module covers, such as misdelivered sensitive data, lost portable devices and publishing to the wrong audience.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before any work starts.

How we build

We deploy a self-hosted learning platform in your cloud account, data center or air-gapped network, configured to your access rules.
We set up the unintentional data exposure module with activity completion so each learner's completion is recorded for the initial and periodic training measures.
We configure reporting that shows the share of workforce members trained and the share whose training is current.

How we hand over

You receive documentation covering module content, completion rules, reporting queries and the steps to export records for an assessor.
We provide an evidence pack that maps module versions, completion reports and content review records to Safeguard 14.5.
Your team confirms the content is accurate for your organization before the module goes live.

How we support

Ongoing support, upgrades and maintenance are available as a retainer, including updates when the module content needs review.
We can help your team keep completion reports current for each review cycle, so records stay ready for assessment.
Assessment decisions, audit reports and any certification remain with your organization and the independent assessor you choose.