CIS Control 14.5: Train Workforce Members on Causes of Unintentional Data Exposure

What this means

CIS Control 14.5 requires documented, ongoing security awareness training focused specifically on how employees accidentally expose sensitive data. Rather than generic security training, this control demands targeted education on real exposure scenarios: accidentally emailing files to the wrong recipients, losing devices containing unencrypted data, misconfiguring cloud storage permissions, or publishing information to unintended audiences. The goal is to build organizational awareness of how careless actions—not just malicious ones—compromise data security.

How to comply

1. 1.Identify and document all workforce members who handle, store, or transmit sensitive data across your organization.
2. 2.Develop training curriculum covering specific unintentional exposure scenarios: mis-delivery of emails, portable device loss, misconfigured cloud sharing, and publishing sensitive information publicly.
3. 3.Conduct initial training for all in-scope employees and document attendance and completion dates.
4. 4.Schedule annual refresher training at minimum, or more frequently if exposure incidents occur.
5. 5.Create incident-triggered training: when unintentional exposure occurs, add that scenario to your training curriculum within 30 days.
6. 6.Maintain records of all training delivery including attendee names, dates, topics covered, and assessment results.
7. 7.Measure training effectiveness through phishing simulations, security awareness assessments, or post-training surveys.
8. 8.Document any policy changes, new exposure risks identified, or regulatory updates that require curriculum updates.

Evidence auditors look for

• Training curriculum document detailing data exposure scenarios covered (email mis-delivery, lost devices, cloud misconfiguration, unintended publishing)
• Training sign-in sheets or learning management system (LMS) records showing employee names, dates attended, and topics completed
• Annual training completion attestations or certifications from each workforce member
• Training materials or presentation slides addressing real-world exposure incidents relevant to your organization
• Assessment results: quiz scores, phishing simulation results, or security awareness survey responses post-training
• Incident response documentation showing training updates made after an unintentional exposure event occurred
• Policy documents outlining data handling best practices that align with training content
• Communication logs or emails notifying employees of training requirements and deadlines

Frequently asked questions

GRCWatch automates training assignment and completion tracking for CIS 14.5, automatically notifies employees when annual refresher training is due, and centralizes all training records and assessments in one audit-ready dashboard.

See how GRCWatch handles this control automatically

Related controls