Safeguard 14.8 Insecure network risks training: evidence

What CIS Safeguard 14.8 asks your workforce to learn about insecure networks

CIS Safeguard 14.8 asks you to train your workforce on the dangers of connecting to enterprise resources and sending enterprise data over insecure networks, and, if you have remote workers, to include guidance on setting up their home network infrastructure securely. It sits in Control 14, under the security awareness program described in Safeguard 14.1, and it is an Implementation Group 1 Safeguard, so every enterprise is expected to address it regardless of size. For a security lead, the practical question is less about what the words mean and more about what a reviewer will see in your training records and content. The risk is simple to state. Public Wi-Fi in cafés, airports and hotels, and unfamiliar networks, can be monitored, spoofed or used to redirect traffic to a fake login page. A laptop joining such a network may also expose files, sessions or credentials that a user did not intend to share. Remote work makes this harder because staff move between networks throughout the day, and the enterprise has little visibility into the routers, firmware and access settings in a home network. Most of those devices are controlled by the employee, not by IT, so the training has to change behavior the enterprise cannot enforce directly.

Because remote workers are common in most enterprises, the home network guidance is not optional for them. Your training should explain how to change default router passwords, keep router firmware current, use WPA3 or WPA2 where the router supports it, separate guest and work devices where possible, and when to use the corporate VPN or other approved remote access method. Confirm the exact settings with your own standards and with the router vendors your staff use, because supported features vary by device. Give staff a short checklist they can apply on their own equipment, and state clearly which steps are recommended and which are required by company policy.

To evidence this Safeguard, keep a dated copy of the training module on insecure networks, a record of who completed it, and the schedule for refreshing it. The CIS Controls Assessment Specification measures Safeguard 14.8 through initial training compliance and up-to-date training, and it gives a failing score if no module on insecure networks exists, so the module itself must be present before any completion data matters. An LMS such as Moodle can record completion; its activity completion feature can mark a learner complete when they view a page, receive a grade or tick a box, so choose the condition that proves they engaged with the content. Your next step is to check the CIS Controls Assessment Specification for Safeguard 14.8 against your current training materials.

Which workforce groups and networks fall under Safeguard 14.8

Safeguard 14.8 applies to every enterprise in every Implementation Group, so the scoping work is about who gets trained and which networks the training addresses. The enterprise owns both decisions and should write them down before building the module, because the assessment checks whether the training covers the workforce the enterprise actually has.

All workforce members

Start with the full workforce, not only staff in offices. Employees, part-time staff and anyone who handles enterprise data or accounts should receive initial training and periodic refreshers. The assessment measures the share of workforce members who have received initial training, so a roster that leaves out a group leaves a gap in the score. Ask HR and IT to produce one list that both teams agree on, and reconcile it against identity system accounts each cycle.

Remote workers and home networks

Remote workers need the same module plus guidance on configuring home network infrastructure, since Safeguard 14.8 explicitly calls for it when an enterprise has remote staff. Cover router administrator passwords, firmware updates, guest network separation and WPA-protected Wi-Fi in plain terms. Confirm whether your training content reaches people who work from home on a regular basis, not only those with a formal remote agreement.

Contractors and temporary staff

Contractors who access enterprise data or connect to enterprise systems over untrusted networks belong in the training population. The enterprise decides whether they complete the same module, a shorter version or an equivalent course from their own employer, but that decision must be documented. Check contract language so that training obligations and completion records are part of the engagement, not an informal request.

Personal devices used for work

Staff who read email, open files or join meetings on personal phones, tablets or laptops create exposure that the training should address. Explain which activities are allowed on personal devices, which networks they may use and when a managed device or virtual desktop is required. Ask whether the enterprise's mobile and bring-your-own-device policy matches what the training tells people to do.

Public, hotel and shared networks

Public Wi-Fi in cafes, airports, hotels and co-working spaces is the setting most people associate with insecure networks. Training should cover the risks of sending enterprise data over open or unknown networks, the value of an enterprise VPN, and the habit of avoiding sensitive work when a trusted connection is unavailable. Describe these scenarios concretely (for example, illustrative: a finance analyst opening a report in an airport lounge), since abstract warnings are less likely to change behavior.

Office networks and the enterprise decision

Office networks are usually managed, but guest Wi-Fi, networks shared with tenants and unmanaged connections still count as networks the training may need to address. Under Safeguard 14.8 the enterprise decides which networks its training covers, and the decision should be written into the training scope document. Record the decision and the reason for it, so an assessor can see that the enterprise considered its actual network environment.

How a CIS assessor tests Safeguard 14.8

This table shows how the CIS Controls Assessment Specification scores Safeguard 14.8, which evidence an assessor expects and where submissions usually fail. Read it as a checklist of what to have ready before an assessor asks, and note that the specification defines what to measure while your organization decides how to meet it.

Assessment element	What the assessor looks for	Common finding
Initial Training Compliance	The share of workforce members who have received initial training covering insecure networks, measured against the full workforce list	Roster is incomplete, contractors and temporary staff are excluded, or new joiners are not tracked
Up to Date Training	The share of compliant workforce members who have completed the current insecure networks module within the training cycle	Completion records are older than the current module version or the cycle has lapsed
Training module on insecure networks	A training module that covers the dangers of connecting to and sending enterprise data over insecure networks	No module exists, so the Safeguard receives a failing score
Remote worker guidance	Content that explains how to securely configure home network infrastructure for staff who work remotely	Module covers public Wi-Fi only and omits home router configuration guidance
Training content and version record	The actual module material, its version history and the date of the last content review	Slides or videos cannot be produced, or the content has no date or owner
Completion and roster records	Learner-level completion data linked to a roster of workforce members, with dates	Records are exported as totals only, without individual names or dates
Scope of the specification	CIS CAS defines what to measure for Safeguard 14.8, not how the enterprise must deliver the training or which tool it must use	Organizations assume a specific platform or vendor is required and skip the measurable outputs

Steps to build and deliver the insecure networks module

This sequence turns Safeguard 14.8 into a delivered module with recorded completion, so the enterprise can show every workforce member received initial training and stays current on it. Each step ends with a specific output that feeds the next.

Confirm the workforce and remote worker population
Compare the current HR roster, contractor lists and identity directory to establish who must take the module, and flag which people work remotely or from home. Assign a named owner from security or compliance to sign off the list. The output is a dated audience list with a remote worker flag, which becomes the denominator for the Initial Training Compliance measure in the CIS Controls Assessment Specification. Ask HR and procurement to confirm how contractors and temporary staff are onboarded, because they can fall outside the roster if no one checks.
Write the core module on untrusted networks
Draft the module content covering public Wi-Fi, hotel and airport networks, captive portals, rogue access points and the rules for sending enterprise data over networks the company does not control. Set out which activities need the corporate VPN or an approved connection method, and which data classes may never travel over an open network. Security and the data owner review the draft against the enterprise's data handling policy. The output is an approved script or slide set with a short knowledge check, and the review record is kept with the policy evidence.
Add home network configuration guidance for remote workers
Write a separate section for remote workers on securely configuring home network infrastructure, such as changing default router credentials, keeping router firmware current, using strong Wi-Fi encryption, separating guest and work devices, and knowing when to use the corporate VPN at home. Ask IT to confirm which settings the enterprise can support or require on managed devices. The output is an approved home network guide, versioned and linked from the module, that a remote worker can follow without specialist help.
Load the module into the learning platform
Build the module in the organization's learning management system, or in a self-hosted platform such as Moodle, with the audience list enrolled through the directory or a manual import. Configure the completion conditions so that a learner is marked complete only when the module is viewed, graded or ticked as the course design requires. Test the course with a pilot group. The output is a published course with tested completion rules and a sample completion report.
Deliver the module and track completion
Assign the module to the audience list, send reminders through the normal channels, and record completion for every enrolled person, including contractors and remote workers. Export the completion report on a regular cadence and reconcile it against the audience list to find gaps. Escalate non-completion to managers according to the enterprise's policy. The output is a reconciled completion record that shows which workforce members have received initial training and which remain outstanding.
Confirm the Up to Date Training measure
Check the completion record against the training cadence the enterprise has set, and identify which workforce members are current and which are overdue for refresh. Calculate the share of compliant workforce members for the Up to Date Training measure and keep the working file with the calculation. The output is a measured percentage with the names of overdue members removed from the compliant count, ready for the assessment report.
Schedule the refresh and review cycle
Set a refresh date for the module and a review of its content each time network threats, remote work arrangements or the data handling policy change. Record the owner, the review trigger and the version history in the security awareness program records that support Safeguard 14.1. Ask the assessor or internal auditor which review cadence they expect for the enterprise's risk profile. The output is a documented refresh schedule and version log that shows the module is maintained rather than delivered once.

Evidence that shows the training is delivered and current

An assessor testing Safeguard 14.8 looks for two things: that the insecure networks module exists and reaches the workforce, and that it is kept current. The artifacts below connect those two points, and each one needs a named owner and a review date so it still holds when the next assessment arrives.

Approved training content with version history

The insecure networks module itself, with its slides, script or video, knowledge check and the home network section for remote workers. Keep each approved version with its date, author, approver and a change summary, so the assessor can see exactly what learners received at a given point. Check that the module still covers public Wi-Fi, untrusted networks, transmitting enterprise data over unmanaged connections and, where remote work applies, securing the home network. A missing module is a failing score under the assessment specification, so this is the first artifact to confirm.

Home network guidance document

A standalone guide for remote workers on configuring home routers, changing default administrator credentials, enabling WPA3 or WPA2 where available, updating router firmware and separating guest devices. Version it like any policy document and state which device types and connection methods it covers. Reissue it when the workforce's remote arrangements change, and record who approved each revision. Ask your IT team to confirm that the guidance matches the corporate VPN and endpoint requirements, so staff are not told two different things.

Enrollment and completion exports

Exports from your learning management system showing who was assigned the module, when they started, when they completed it and whether they passed any assessment. The two measured metrics, Initial Training Compliance and Up to Date Training, are calculated from this data, so the export must include every workforce member, including contractors where they hold enterprise data. If you run the module on Moodle, activity completion can be set to mark it complete when a learner views it, receives a grade or ticks it manually. Choose the condition deliberately, because viewing alone does not prove understanding.

Dated workforce attestations

Signed or electronically acknowledged statements from workforce members confirming they completed the insecure networks module and agree to follow the home network guidance. Each attestation should carry a date, the version of the content completed and the person's role. Attestations support completion records but do not replace them, so keep both. Confirm with your HR and legal teams how acknowledgments are stored and how long they are retained under your own policies and any applicable employment rules.

Content review record

A dated log showing that someone checked the insecure networks module and home network guidance against current threats, current corporate network designs and any changes to the Safeguard 14.1 annual review cycle. Record the reviewer, the date, the findings and any change requests raised. The record shows the content is kept current between audits, which is what the Up to Date Training metric is meant to reflect. Schedule the review ahead of time and keep it in the same repository as the approved content.

How a self-hosted learning platform records training completion

An assessor will look for proof that each workforce member finished the insecure networks module, and the platform's completion setting decides what that proof looks like. Moodle's activity completion can mark an activity complete when a learner views it, when they receive a grade from it, or when they tick it manually, depending on the conditions set for that activity. Each option produces a different record. A view-based condition shows the learner opened the page, a grade-based condition shows the learner was scored, and a manual tick shows only that the learner claimed to have finished. Before configuring anything, ask the auditor or the internal assessor which of these records they would accept as evidence that the training was delivered and understood.

For a module on the risks of insecure networks and securing home network infrastructure, a view-based condition alone is usually weak evidence, because it confirms the page was opened but not that the content was absorbed. A manual tick is weaker still, since it depends entirely on the learner's honesty and leaves no independent trace. A graded quiz with a passing threshold, linked to the module as its completion condition, gives a stronger record. Check the activity completion settings and the grade conditions in the Moodle documentation for your installed version, and test the setup with a dummy learner account before relying on the reports. Keep the completion reports and quiz attempt records exported on a schedule, since the assessment specification measures both initial training and up to date training across the workforce.

What meeting Safeguard 14.8 costs in money and effort

This table breaks down the cost and effort of training the workforce on insecure network risks, showing who is paid for each component and whether it is one-time or recurring. Use it to build a quote request and to see where open-source tooling can remove license spend. No prices or durations are given because none were supplied for this safeguard.

Cost component	Who is paid or who spends effort	One-time or recurring	What drives it up or down
Training content development	Internal staff or an outside provider writing the insecure networks module	One-time, then revised	Number of audiences, languages and the depth of network guidance; reusing existing awareness material lowers it
Remote worker home network guidance	Security or IT staff writing guidance on configuring home routers and Wi-Fi	One-time, then reviewed	Size and variety of the remote workforce and device types; a short standard guide is cheaper than tailored guides per role
Content licensing	Vendor of a commercial training library, if purchased	Recurring subscription, often per learner	Number of learners and features; self-hosted open-source learning platforms can remove this line
Learning platform hosting	Cloud or data center costs, or internal infrastructure team	Recurring	Hosting model, learner count and availability needs; confirm whether hosting sits inside existing infrastructure
Platform implementation and integration	Implementation partner or internal engineers configuring the platform and completion tracking	One-time	Number of integrations with HR systems and single sign-on; fixed-scope work agreed in writing before it starts
Staff time for delivery and tracking	Training coordinators and managers assigning, reminding and reviewing completions	Recurring	Workforce size and turnover; automated completion records reduce manual follow-up
Annual refresh	Content owners reviewing the insecure networks module and updating guidance	Recurring	Changes in remote work practices, threats and tooling; a fixed review cycle keeps updates small
Assessor or auditor time	Independent auditor or assessor checking the module and completion records	Recurring if assessed	Scope of the assessment and quality of evidence; clean completion reports shorten testing

Who owns the training, who prepares evidence and who issues the opinion

The organization owns Safeguard 14.8 in full. Its security awareness owner decides what the insecure networks module must say, who must complete it, how often it is refreshed and what happens to people who do not finish. Those decisions sit in the organization's own policy, and no partner or auditor can make them on its behalf. Internal staff also own the outcome, so they are the people who answer when a remote worker connects over a hotel network without the guidance the module gave them.

Content ownership: Approve the module text, including the home network guidance that applies to remote workers, and record who signed off on each version.
Audience definition: Maintain the list of workforce members in scope, including contractors and remote staff, so the completion share has a correct denominator.
Policy and cadence: Set the initial training requirement and the refresh interval in the security awareness policy, and keep the review record.
Follow-up: Chase overdue learners, escalate repeated non-completion and document exceptions with an approver.
Quote and scope control: Own the written scope that any partner works from, and check that the deliverables match it.

Before engaging anyone, confirm internally who holds each of these duties, because an assessor will ask the organization, not the vendor, to explain them.

Common gaps that fail the insecure networks training

Safeguard 14.8 is easy to claim and easy to fail on evidence. The gaps below are the ones that most often turn a training program into a finding, and each one can be checked before an assessor asks. Work through them in order, because a missing module makes every later gap moot.

No module on insecure networks

The most direct failure: the enterprise has no training module that covers the dangers of connecting to and sending enterprise data over insecure networks. Under the CIS Controls Assessment Specification, this absence alone produces a failing score for Safeguard 14.8. Check that a dedicated module exists in the learning system, names public and untrusted Wi-Fi, and is assigned to the whole workforce, not only to staff who travel.

Generic training that omits networks

Many annual security courses cover phishing and passwords but say nothing about networks. A course that never mentions hotel Wi-Fi, shared café connections, rogue hotspots or sending files over unencrypted channels does not evidence this Safeguard, even if it is marked complete. Review the course outline against the Safeguard wording and confirm that network risk appears as a named topic with its own content, not a passing sentence.

No home network guidance for remote workers

Where the enterprise has remote workers, the training must include guidance on securely configuring home network infrastructure. Organizations often cover public Wi-Fi and forget the home router, which is where most remote work actually happens. Confirm that the module covers changing default router credentials, keeping router firmware current, separating guest and work devices, and who to contact when a home setup cannot meet the standard.

Completion records that cannot be exported

An assessor needs to see who received the training and when, so the Initial Training Compliance and Up to Date Training measures can be calculated. If the learning platform only shows a dashboard, or completion cannot be exported with user identifiers and dates, the enterprise cannot prove its share of the workforce. Test an export before the assessment: pull the completion list for the networks module and confirm it reconciles with the directory of current staff.

Content not reviewed annually

Safeguard 14.8 depends on current content. Public Wi-Fi threats, home router vulnerabilities and remote work tools change, and a module written several years ago may describe networks that no longer apply. Record the date of the last content review, the reviewer, and the changes made, and tie the review to the annual security awareness cycle set by Safeguard 14.1. If no review record exists, that gap is visible to an assessor immediately.

Completion that does not show comprehension

A learner who opens a page may be marked complete without engaging with the content. Learning platforms can mark an activity complete on viewing, on receiving a grade, or on a manual tick, depending on how the activity is configured. For a networks module, configure completion to require a graded knowledge check or a defined set of pages, and confirm that the chosen condition is documented so the completion record means something to an assessor.

Questions buyers ask about Safeguard 14.8 training

Can we build Safeguard 14.8 training in-house?

Yes, most organizations can build it in-house, because the safeguard asks for a training module on the dangers of connecting to and transmitting enterprise data over insecure networks, not for a specific vendor product. The work needs someone who understands both the enterprise's network usage and the threats (public Wi-Fi, rogue hotspots, unsecured home routers), plus an owner who keeps the module current. Outside help usually makes sense when the team lacks instructional design or security content experience, or when the organization wants an independent review of the module before rollout. The organization owns the training and its records. An implementation partner such as DeployOpen can prepare the learning platform and evidence, but it does not write the policy or certify the outcome.

How much staff time does insecure network training require?

The staff time falls into three groups: the people who build and review the module, the workforce who complete it, and the people who collect completion records for the assessor. The workforce time is the largest and recurs, because the assessment specification measures whether training is up to date across the workforce, not just once. Ask any provider to state the expected learner time for the module, the number of reviewers and how records will be exported. Do not accept an estimate that does not tie to your headcount and learning platform.

How long does it take to build a Safeguard 14.8 module?

No build duration is established in the supplied facts, so treat any number from a vendor as something to confirm. The build time depends on how many remote and office scenarios you cover, how many languages you need, whether you use a learning management system such as Moodle, and how many approval rounds your legal and HR teams require. Ask for a written schedule with milestones for drafting, review, pilot, and release, and confirm which steps the organization must complete itself.

Is Safeguard 14.8 covered by other training modules?

Partly, but 14.8 has its own requirement, so it should not be assumed to be covered by a general awareness course. The assessment specification scores 14.8 against whether a module on insecure networks exists, which means a module that only mentions Wi-Fi in passing may not satisfy the check. Related topics such as social engineering (14.2), authentication (14.3) and data handling (14.4) can reference network risk, but the insecure network content should be identifiable as its own module with clear completion records. Confirm with your assessor how they want overlapping content evidenced.

How does remote worker guidance differ from office guidance?

Office guidance focuses on the corporate network and the controls already in place there, while remote worker guidance must also cover how staff configure home network infrastructure. Under Safeguard 14.8, enterprises with remote workers must include guidance on securely configuring the home network, such as changing default router credentials, keeping router firmware current, separating work devices from other home devices, and using the organization's remote access method. Office content can stay generic, but remote content has to be specific enough that a worker can act on it without IT support.

What will an assessor ask for to verify Safeguard 14.8?

An assessor working from the CIS Controls Assessment Specification will look for evidence that an insecure networks module exists and that the workforce has received it. Expect requests for the module content, the training schedule, and records showing initial training compliance and whether training is up to date across the workforce. For organizations with remote workers, the assessor will also check that the module includes home network configuration guidance. Keep the module version history, completion exports and a clear list of who is in scope, because these are the artifacts that show the measures were met. Use the CIS Controls Assessment Specification for Safeguard 14.8 as the reference your evidence should match.

Can Moodle record completion of an insecure networks module?

Moodle can record completion, which is the evidence most assessors ask for, but it depends on how the activity is configured. Moodle's activity completion can mark an activity complete when a learner views it, when they receive a grade, or when they tick it manually, so choose the condition that matches what you need to prove. For an awareness module, viewing alone may not show understanding, so many teams pair the module with a short graded quiz. Confirm your Moodle version and completion settings in your own environment, and export the completion reports on a schedule so the records are kept outside the platform as well.

How DeployOpen prepares insecure networks training and evidence

DeployOpen helps organizations build the training module, delivery records and home network guidance that Safeguard 14.8 asks for, inside the organization's own learning platform. The organization owns its security awareness program and decides what its workforce is told; DeployOpen prepares the systems and evidence that show it.

How we scope

Agree in writing which workforce groups, remote workers and learning platforms the Safeguard 14.8 training will cover.
Confirm whether the enterprise has remote workers, since home network guidance is required only where they exist.
Define the training content owner, review cadence and the records that will show initial and up to date completion.

How we build

Build a training module on insecure networks, covering public Wi-Fi, untrusted networks and sending enterprise data over them.
Add a home network guidance section for remote workers that the organization's security team has reviewed and approved.
Configure completion tracking so initial training and refresher status can be exported for assessment.

How we hand over

Deliver the module, configuration notes and completion report templates in a documented handover package.
Document how completion data maps to the Initial Training Compliance and Up to Date Training measures in the assessment specification.
Provide a runbook that explains how the organization updates content and retains records for an independent assessor.

How we support

Ongoing support, upgrades and content updates are available as a retainer after handover.
Review training records and completion reports on a schedule the organization agrees in its written scope.
Confirm with the organization's auditor which evidence format and retention period it expects before the assessment.