CIS Control 14 Calls for Ongoing, Role-Specific Security Awareness Training
Summary
The article explains CIS Control 14’s security awareness requirements, including skills-gap analysis, regular and updated training, secure authentication, social engineering, sensitive data handling, and incident reporting.
Key points
- CIS Control 14 calls for an ongoing security awareness program intended to reduce cybersecurity risks across the workforce.
- The article recommends identifying role-specific skills gaps and using them to guide training.
- Training should be continuous and engaging, with frequent topical updates rather than relying only on an annual video.
- The listed requirements cover secure authentication, identifying social engineering, handling sensitive data, preventing accidental exposure, and reporting incidents.
- Examples include tailoring content to industry risks and training finance staff to recognize payment-change scams.
Article Details
- Topic
- CIS Control 14 security awareness training requirements and guidance
Vendors
Industries
financialTraining should also consider the enterprise’s different regulatory and threat posture. Financial firms might have more compliance-related training on data handling and use, healthcare enterprises on handling healthcareHealthcarethreat posture. Financial firms might have more compliance-related training on data handling and use, healthcare enterprises on handling healthcare data, and merchants for credit card data.