CIS security awareness training policy: what it requires

What a CIS security awareness training policy must require

A CIS-aligned security awareness training policy must require training for every workforce member at hire and at least annually, with the content reviewed and updated each year or whenever significant enterprise changes could affect it. Under Control 14, the IG1 Safeguards 14.1 to 14.8 set the topics the program must cover, including social engineering, authentication, data handling, unintentional data exposure, incident reporting, missing updates and insecure networks. IG2 adds Safeguard 14.9, which requires role-specific training for workforce members whose roles carry particular security responsibilities. Your customer, contract or regulator may ask for IG1 alignment only, or for the IG2 additions, so confirm which level is in scope before you draft.

The organization owns this policy and the training that follows from it. CIS publishes a free policy template, but it is written for IG1 Safeguards only and does not address the IG2 or IG3 requirements. The depth your policy needs depends on its scope, the size of the workforce, the number of locations, how many third parties have access to enterprise assets, and whether you aim at IG2 or IG3. A small team with one office can write a short policy. A distributed workforce with contractors and privileged roles needs role definitions, named owners for each training topic and a documented way to show who has completed what.

Only an independent auditor, assessor or certification body can issue a report or certificate confirming that your program meets the CIS Controls. An implementation partner can help prepare the policy, training content and completion records, but it cannot attest to the result. Use the CIS Controls Assessment Specification to see how completion is measured before you define your evidence, and ask any assessor which records they expect to sample.

How to build the CIS security awareness training policy from the template

This sequence turns CIS's free IG1 policy template into a signed CIS security awareness training policy with named owners, a mapped training plan and records that show who was trained, when and on what.

Define scope and the workforce
Start by listing every group that must be trained: employees, contractors, temporary staff and any third parties with access to enterprise assets or data. Record which systems, sites and data the policy covers, and which groups need role-specific content later. Confirm the scope with HR, IT and the business owners who will sign off on who counts as workforce. The output is a scoped workforce register that the training completion metrics in the assessment specification can later be measured against.
Write the policy statement and assign roles
Adapt the CIS policy template so the statement commits the organization to a security awareness program that educates the workforce on working with enterprise assets and data securely. Name an accountable owner for the program, a person who maintains training content and records, and managers who confirm their teams complete training. Have the policy approved by an executive sponsor and dated. The output is an approved policy document with a roles table that an assessor can trace back to each Safeguard.
Map training content to Safeguards 14.1 to 14.8
Build a content plan with one row per Safeguard, from 14.1 through 14.8, plus 14.9 if the organization is in scope for IG2. For each row, name the course or module, its audience, the delivery method and the owner. Cover the IG1 topics: social engineering, authentication, data handling, unintentional data exposure, incident reporting, missing security updates, insecure networks and role-specific skills where applicable. Confirm each topic against the current CIS Control 14 text. The output is a mapping sheet that shows every IG1 Safeguard has content behind it.
Set the training calendar and triggers
Translate the policy's timing rules into a calendar. Initial training must occur at hire, with recurring training at least annually, and content must be reviewed and updated when significant enterprise changes could affect the safeguard. Schedule the annual review date, the content refresh owner and the trigger events that prompt an early update, such as a new collaboration tool or a change in authentication. The output is a published training calendar tied to hire dates and review dates.
Set up training and completion records
Configure the learning platform so each workforce member's enrollment, completion and date are recorded. If the organization runs a self-hosted learning management system such as Moodle, confirm how its activity completion conditions work, because completion may be set by viewing, grading or manual tick, and choose the setting that matches the evidence you need. Define who reviews records and how gaps are escalated. The output is a sample extract showing initial training status and up-to-date status for each person, ready for assessor sampling.
Run the first cycle and collect evidence
Deliver the initial training to the scoped workforce, then run a completion check against the register. Record exceptions, follow up with managers and document the remediation. Keep copies of course content, the approved policy, the mapping sheet and completion extracts together in one evidence folder. An independent auditor or assessor will test these artifacts, so the organization owns them, while any implementation partner only prepares them. The output is a dated evidence pack with a completion rate and an exception log.
Complete the annual review
Each year, review the policy, the content mapping, the calendar and the completion records. Check whether new threats, tools, incidents or regulatory obligations require changes to the training topics, and whether role-specific needs have changed. Update the policy version, reapprove it and record what changed and why. The output is a revised policy, an updated content plan and a review record that shows the program is maintained as the environment changes.

Which eight IG1 training topics the policy must cover

Safeguard 14.2 names social engineering as a required training topic, and the other IG1 Safeguards in Control 14 add authentication, data handling, unintentional exposure, incident reporting, missing updates and insecure networks. Confirm the exact list of eight topics against the CIS Control 14 page before publishing, because the grouping below is a working structure, not a quotation of the Safeguard list.

Social engineering recognition

Safeguard 14.2 asks that workforce members learn to recognize social engineering, with phishing, business email compromise (BEC), pretexting and tailgating named as examples. The policy should name each attack type and state who owns the reporting path. A training module for this group should show real-format sample messages, a call script with a pretext, and a tailgating scenario at a secured door, each followed by the correct reporting step. Check that the module is refreshed when new lures appear in your sector.

Authentication and credential habits

This group covers how workforce members create, store and use credentials, including multi-factor prompts and password reuse. The policy should require staff to decline unexpected MFA prompts, avoid sharing credentials, and use approved password storage. A training module should walk through a fake MFA fatigue prompt, a shared-password request and an approved password manager workflow. Confirm the authentication wording against the account and credential policy template so the two documents do not conflict.

Data handling and sensitive information

Workforce members need to handle sensitive data according to the classification and retention rules the organization sets. The policy should require training on approved storage locations, sharing rules and disposal. A module can use a short exercise where learners classify three sample documents and choose the correct sharing channel for each. Align the labels used in training with the data management policy template so learners see the same categories the systems enforce.

Unintentional exposure and misconfiguration

This group covers accidental disclosure, such as posting data publicly, sending a file to the wrong recipient or leaving a cloud share open. The policy should name the common exposure paths and require staff to report them immediately. A module can show a mis-addressed email, a link-sharing setting that exposes a folder, and a screen left visible in a public space. Ask the training provider to show how the module is tested so the scenarios stay tied to your own tools.

Incident reporting and missing updates

Workforce members must know how to report a suspected incident and how to flag a device that is missing updates or security software. The policy should name the reporting channel, the contact owner, and the expected speed of the report. A module can include a timed walkthrough of reporting a suspicious email, plus a notice on a laptop that shows overdue patches and the correct request step. Confirm the reporting channel matches the incident response policy template.

Insecure networks

This group covers the risks staff face on untrusted networks, such as public Wi-Fi, unknown access points and remote connections. The policy should require use of the approved remote access method and prohibit connecting enterprise devices to unmanaged networks without approval. A module can show a captive portal that asks for corporate credentials and the approved VPN steps for a home or hotel connection. Confirm the approved remote access method against your secure configuration and access control policies.

How the assessment specification scores Safeguard 14.1

The CIS Controls Assessment Specification scores Safeguard 14.1 with two metrics. Initial Training Compliance is the share of workforce members who have received initial training, and Up to Date Training is the share of those compliant workforce members whose training is current. Both are ratios, so the numerator and denominator are the decisions that matter. Before any figure means anything, the organization has to fix the population it counts. Employees alone is the narrowest choice. Contractors, temporary staff and administrators with elevated access are the groups an assessor is most likely to ask about, because they touch the same enterprise assets and data as employees.

The specification defines what to measure, not how to measure it, so the policy must set the rest. Decide which record proves each training event, such as a learning management system completion, a signed attendance log or a training platform export, and make sure that record names the individual and the date. Then decide the window. A policy that requires training at hire and at least annually still needs a rule for when a person falls out of compliance, for example the day after the anniversary of their last completion, and for how people who join mid-cycle are counted. Pick one window, state it in the policy, and apply it consistently so the two metrics can be reproduced by someone outside the team.

The same specification also covers Safeguard 14.2, which asks that workforce members be trained to recognize social engineering attacks such as phishing, business email compromise, pretexting and tailgating. Its measures should be planned alongside 14.1 rather than afterward, because a single training record often serves both. Confirm with your assessor which evidence they will accept for social engineering content, whether that is a module completion, a simulated phishing result or a quiz score, and confirm it before the first audit cycle starts. Full wording for each Safeguard is in the CIS Controls Assessment Specification for Controls v8.1.

Which option fits: template only, tailored policy or outside build

This table compares three routes for a CIS Control 14 training policy: adopting the IG1 template as written, tailoring it in-house, or engaging an implementation partner under a written scope. Read each row across to see when the route fits, what your organization still owns and what evidence you must keep whichever route you pick.

Route	When it fits	What the organization still owns	Evidence it must keep
Template only (adopt as written)	Single-site IG1 scope with a small workforce and an internal owner who can run annual training and track completions	Naming the policy owner, adapting the wording to real systems, choosing the training content and enforcing completion	Signed policy, training dates per workforce member, completion records and the annual review record
Tailored in-house	Multi-site or regulated scope where systems, roles and data handling differ by location and an internal team can write and maintain content	Full authorship of the policy, role-specific content, the review cycle and the decision on when significant enterprise changes trigger an update	Version-controlled policy, training materials with change history, approval records and per-person completion data
Outside build under written scope	Short deadline, a named need for outside capacity, or an assessor-facing program that must be prepared and documented to a defined scope	Accountability for the control, approving the policy and content, supplying workforce data and confirming the final output matches the agreed scope	Scope document, delivered policy and content, configuration records, completion evidence produced by your own systems and sign-off records
Who writes the policy text	Template authors or your staff in the first two options; the partner in the third, under a written scope	Your leadership signs the policy in every option, because the organization owns its controls	Approved policy with owner, approver and effective date
Training platform choice	Use an existing learning system or a self-hosted open-source LMS such as Moodle, if it can record completion per learner	Confirming the platform records completion and dates for each workforce member, since this drives the Initial Training Compliance measure	Platform exports showing enrollment, completion date and course version for each learner
Covering the IG2 role-specific training	Not covered by the IG1 template, which addresses IG1 Safeguards only, so this usually needs in-house or scoped work	Identifying which roles need specialized training and who delivers it	Role matrix, role-specific course materials and records showing each role's training
Independent assessment	Needed in every route if a customer, regulator or certification scheme asks for it	Selecting and paying the assessor and acting on findings	Assessor report or certificate issued by the independent body, not by the template or the partner
Ongoing upkeep	Relevant to all routes, since content must be reviewed annually or when significant changes could affect the Safeguard	Scheduling the annual review and updating training after system, role or threat changes	Dated review records and revised content with version history

What must be in place before an assessor reviews training

An assessor reviewing Control 14 starts with the documents and records behind the training, not the slides. The six items below are the foundation that Safeguards 14.1 and 14.2 are measured against, and each one can be checked with a single question to the person who owns it.

Signed policy with owner and review date

The security awareness and skills training policy should name an accountable owner, carry an approval signature from management, and state an annual review date. Without this, the training has no mandate and no one to answer for gaps. Check that the approved version matches what staff actually follow and that the review date falls within the last twelve months. Ask the owner who approved the current version and when it was last reviewed.

Workforce roster defining scope

The assessment measures the share of workforce members who received initial training, so the denominator must be defined. The roster should list employees, contractors and other workforce members with access to enterprise assets or data, and state how it is kept current. A roster that excludes contractors or temporary staff makes the percentage look better than it is. Ask who maintains the roster and how often it is reconciled against the identity directory.

Dated, version-controlled training content

Each training module needs a version number, a date, and a record of who approved changes. Safeguard 14.1 requires content to be reviewed and updated at least annually or when significant enterprise changes could affect the safeguard, so an assessor will ask which version was delivered to which group and when. Keep the previous versions available for the audit period. Ask the owner which version is live today and where superseded versions are archived.

Completion records retained with dates

Completion records are the evidence for both the initial training and the up-to-date training metrics. Each record should show the learner, the module and version, the completion date and the result. Learning platforms can mark an activity complete when a learner views it, receives a grade or ticks it manually, depending on how the activity is configured, so the completion rule must match the content. Ask which completion condition each module uses and how long the records are kept.

Process for new hires and role changes

Training at hire is a distinct requirement, and role changes can bring new exposure, such as finance staff handling payment instructions or administrators touching production systems. The process should trigger training when someone joins, moves to a new role or gains new access, and it should record the date training was assigned and completed. Ask HR and the platform owner how a transfer between departments creates a training task.

Documented trigger for content updates

The policy should define what counts as a significant enterprise change that forces a content review outside the annual cycle, such as a new collaboration tool, a change in identity provider, a merger or a material incident. Without a written trigger, updates depend on memory. Ask the owner which events have caused a content review in the last year and who decides whether a change is significant.

Can a learning platform produce the completion evidence

A self-hosted learning platform can produce much of the training record that Safeguard 14.1 expects, but only if the organization decides which completion condition counts as proof that training occurred. Moodle's activity completion, documented in the Moodle developer documentation on the activity completion API, marks an activity complete for each learner when they view it, when they receive a grade from it, or when they tick it manually, depending on the conditions the course designer sets. A page view is the weakest condition: it shows the learner opened the material, not that they absorbed the content on social engineering, authentication, data handling or incident reporting. For the training record to support an assessor's Initial Training Compliance and Up to Date Training measures, the policy should name the condition in writing, such as a graded assessment with a passing threshold, and the team should confirm that setting against the Moodle version and configuration actually in use.

Completion also does not prove comprehension on its own. A learner can pass a quiz by guessing, or be marked complete by a manual tick that a manager applied without seeing the training. The policy should therefore require that each training topic is tied to an assessment that the reviewer can inspect, and that any manual completion carries a named approver and a date. Before relying on the platform, run a test enrollment with a dummy account, complete the course under each condition, and check that the completion report, grade and timestamp appear as expected. Ask the vendor or the implementing team to document these settings so the configuration can be reproduced after an upgrade.

Keep the training records outside the course itself. Course content is revised each year to meet the annual review in Safeguard 14.1, and deleting or rebuilding a course can remove the completion history that proves earlier training. Export completion data, grades and dates on a fixed schedule to a separate system that the security or compliance team controls, and retain those exports under the organization's records policy. Each export should show the workforce member, the course version, the completion condition, the date and the assessor or approver. Storing evidence this way lets the organization show training history for each year, even after the course has changed.

Who owns the policy, who prepares the evidence and who assesses it

Your organization owns the security awareness program, the policy that governs it and every training decision that follows from it. CIS Safeguard 14.1 asks the enterprise to establish and maintain the program, so the accountable owner is inside the organization, usually in the security function with input from HR and the business. The policy is an internal document, and it only takes effect when your leadership approves it and your staff follow it.

Policy ownership: Approve the policy, name an accountable owner, and confirm who reviews it each year and after significant enterprise changes.
Training content approval: Review the course material for the eight IG1 topics and the role-specific material that IG2 adds, and confirm it matches your environment.
Enrollment and completion records: Run enrollment at hire and on the annual cycle, chase overdue learners, and keep the completion records the assessment specification will test.
Annual policy review: Re-read the policy yearly, update it for changes to tools, threats or workforce roles, and record the approval.

Before engaging any partner, confirm internally who will sign off the policy and who answers for the training records if an assessor asks.

How to choose a partner or assessor for CIS Control 14 work

Training policy work often pulls in outside help for the policy text, the training platform setup and the evidence pack. The cards below set out what to verify before signing, and they separate the firm that prepares your program from the party that might later assess it.

Check the credential behind the service

Ask whether the firm holds a credential that matches the service it sells. For CIS Controls work, the relevant reference is CIS Controls Accreditation, which CIS runs with CREST for CIS SecureSuite member organizations that provide implementation, auditing or assessment services. Ask the firm to show its SecureSuite membership and the accreditation status for the specific service in the quote. Do not accept a general claim of CIS expertise in its place.

Confirm independence before assessment

A firm that writes your training policy and builds your training records should not also be the one that tests whether Safeguard 14.1 is met. Ask in writing whether the firm will assess its own deliverables, and whether any staff member worked on both the program and the review. If you need an independent view later, plan a separate reviewer from the start.

Verify experience with training platforms

Ask for examples of work on the learning platform you plan to use, such as completion tracking, enrollment by hire date and annual re-enrollment. Ask how the firm would produce the two Safeguard 14.1 measures, initial training compliance and up-to-date training, from platform records. A firm that cannot explain where those figures come from will struggle to support an assessment.

Require a written scope with exclusions

The statement of work should list each deliverable, such as the policy document, the training content review schedule, the platform configuration and the completion report. It should also state what is excluded, for example phishing simulation operation, content authoring for role-specific IG2 training, or the HR process for onboarding. Unlisted items become disputes later, so agree the exclusions as explicitly as the deliverables.

Agree how evidence is handed over

Define in advance which records you will own: training completion exports, dated course versions, the annual content review sign-off and the policy approval record. Ask whether the firm delivers them as files in your own environment or keeps them in its systems. Confirm that you can export all raw records on termination, since the evidence must survive the engagement.

Ask these questions before signing

Before signing, ask who will do the work and whether they have worked on CIS Controls engagements, how the firm handles content changes when Safeguard 14.1 requires annual review, what the fee covers and what recurs, and what happens if the work falls short of scope. Ask for named references in your sector, and for the contract terms on confidentiality and data handling for workforce records.

Questions buyers ask about the CIS security awareness training policy

Is the CIS policy template enough on its own?

No. The CIS policy template for Control 14 is a starting document for IG1 Safeguards, but it does not run a training program. Your organization still has to choose the training content, the delivery platform, the audience, the tracking method and the review cycle, and then operate them. The template helps you write the policy, while the evidence of training comes from what your workforce actually completes. Ask any implementation partner to confirm which parts of the policy they draft, which they only prepare for, and which remain your organization's decisions.

How often must security awareness training happen?

Safeguard 14.1 asks for training when workforce members are hired and at least annually after that, with the content reviewed and updated each year or sooner when significant enterprise changes could affect the safeguard. Your policy should name the trigger events for an early refresh, such as a new cloud platform, a new identity system or a change in how staff handle customer data. Confirm with your assessor how they will test the annual cycle and whether they expect records for each person or for the program as a whole.

Does IG2 role-specific training apply to every employee?

No. The IG2 addition in Safeguard 14.9 asks for role-specific training for roles that carry higher risk, such as developers, administrators or finance staff who approve payments. General awareness content still reaches the whole workforce. Your policy should list the roles, the skills each one needs and who decides when a role qualifies. Whether IG2 applies depends on your organization's chosen Implementation Group and risk profile, so confirm that scope with your compliance lead before you plan the curriculum.

Can we run this ourselves?

Often yes, if you have someone who owns the policy, a learning platform that records completions and a way to review content each year. The work is mostly writing, scheduling and keeping records current. Organizations usually bring in outside help when they lack instructional design skills, need simulated phishing or social engineering exercises, or want an independent check of their evidence before an assessment. Decide which parts you will own and which you will buy before you request quotes.

What does the work need from our team?

The work needs a named policy owner, a contact in HR who maintains the joiner and leaver lists, a technical owner for the learning platform and reviewers from security, legal and the business units that handle sensitive data. HR and the platform owner carry most of the recurring effort because they keep enrollment accurate. Ask a prospective partner to list each role, the hours they expect from your staff during setup and the monthly or yearly tasks that follow.

Does a completion record prove understanding?

A completion record shows that a person finished a training activity. It does not prove that they understood it or will act securely at work. Assessors commonly look for the dates of initial training and the share of workforce members who are current, which is how the assessment specification scores Safeguard 14.1. To strengthen the evidence, many organizations add short knowledge checks or later phishing exercises. In Moodle, activity completion can be set to mark an item complete when a learner views it, receives a grade or ticks it manually, so choose the condition that matches your policy.

Who issues a CIS Controls report or certificate?

Your organization owns its controls and its training program. An implementation partner can help design the policy, set up the training and prepare the records, but it does not issue reports or certificates. Only an independent auditor, assessor or certification body does that, and the CIS Controls themselves are not a certification scheme. Ask any provider to state in writing which deliverables are preparation and which, if any, come from an independent assessor you select.

What drives effort up or down?

Effort rises with the number of workforce members, the number of locations and languages, the number of roles that need specialized content, the state of existing records and how often your environment changes. It falls when HR already keeps accurate joiner and leaver data and when your learning platform can assign and report automatically. Ask for a written scope that lists the audiences, the topics covered, the systems that hold training records, the review cycle and the evidence each safeguard requires.

How DeployOpen prepares training policy evidence for assessment

DeployOpen helps organizations put a CIS-aligned security awareness and skills training policy into practice inside their own environment, including the learning platform, records and evidence trail. The organization still owns its policy, its training content decisions and its Safeguard results, and an independent assessor reviews the evidence.

How we scope

Confirm which Safeguards from 14.1 to 14.8 apply at Implementation Group 1, and whether 14.9 applies at Implementation Group 2.
Agree which workforce groups, hire dates and training records fall within the written scope for Control 14.
Record the scope, deliverables and timeline in writing before work starts, since engagements are fixed-scope.

How we build

Configure a self-hosted learning platform in your infrastructure so training completion is recorded for each workforce member.
Map the eight IG1 training topics, from social engineering to insecure networks, to course modules and completion records.
Test that completion and grade data can answer the initial training and up to date training measures in the assessment specification.

How we hand over

Deliver the training policy draft, annual review procedure and content update triggers for your review and approval.
Document the evidence trail, including completion exports, enrollment dates and content version history, with an owner for each item.
Provide a handover session so your team can run the training cycle and reports without ongoing DeployOpen involvement.

How we support

Offer ongoing support, upgrades and continuous testing of the training platform as a retainer, if you choose.
Refresh course content and evidence exports when significant enterprise changes could affect Safeguard 14.1.
Remember that only an independent auditor or certification body issues reports or certificates, so confirm assessor expectations early.