Establish and Maintain a Security Awareness Program

frameworkCIS Controls v8.1 section14. Security Awareness and Skills Training csf 2.0GV.RR-01 PR.AT-01 topicsAwareness & Training frameworks7 3 2

Official text · not licensableSafeguard title © CIS (CC BY-NC-ND 4.0). See CIS Controls v8.1 for details.

gap from CIS v8.1 → gap to CIS v8.1 →

Wrong or missing mapping? Report it

Equivalents of CIS 14.1 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AT-01 PR.AT-02	Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind; Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind	Crosswalk	Same topic: Awareness & Training 1 loosely related (not mappings) GV.RR-01 Organizational leadership is responsible and accountable for cybersecurity risk and fosters a culture that is risk-aware, ethical, and continually improving Loosely related Only shares CSF GV.RR-01: related, not a mapping
ISO 27001	A.6.3 Clause 7.3	Information security awareness, education and training; Awareness	Crosswalk	Same topic: Awareness & Training 2 loosely related (not mappings) A.5.4 Management responsibilities Loosely related Only shares CSF GV.RR-01: related, not a mapping Clause 7.2 Competence Loosely related Only shares CSF GV.RR-01: related, not a mapping
SOC 2	CC1.4 CC2.2	Commitment to attracting, developing and retaining competent people; Internal communication of objectives and responsibilities	Editorial	Same topic: Awareness & Training (editorial pick) 3 loosely related (not mappings) CC1.2 Board independence and oversight of internal control Loosely related Only shares CSF GV.RR-01: related, not a mapping CC1.3 Structures, reporting lines, authorities and responsibilities Loosely related Only shares CSF GV.RR-01: related, not a mapping CC1.5 Accountability for internal control responsibilities Loosely related Only shares CSF GV.RR-01: related, not a mapping
PCI DSS	12.6.1 12.6.3	Formal security awareness programme; Awareness training on hire and at least annually	Crosswalk	Same topic: Awareness & Training 4 loosely related (not mappings) 6.2.2 Developers trained in secure software development Loosely related Only shares CSF GV.RR-01: related, not a mapping 12.1.3 Security roles and responsibilities defined Loosely related Only shares CSF GV.RR-01: related, not a mapping 12.1.4 Executive responsibility for information security assigned Loosely related Only shares CSF GV.RR-01: related, not a mapping 12.10.6 Plan updated from lessons learned and industry changes Loosely related Only shares CSF GV.RR-01: related, not a mapping
CMMC	AT.L2-3.2.1 AT.L2-3.2.2 AT.L2-3.2.3	Role-Based Risk Awareness; Role-Based Training…	Crosswalk	Same topic: Awareness & Training
800-53	AT-2 AT-3	Literacy Training and Awareness; Role-based Training	Crosswalk	Same topic: Awareness & Training 6 loosely related (not mappings) PM-2 Information Security Program Leadership Role Loosely related Only shares CSF GV.RR-01: related, not a mapping PM-19 Privacy Program Leadership Role Loosely related Only shares CSF GV.RR-01: related, not a mapping PM-23 Data Governance Body Loosely related Only shares CSF GV.RR-01: related, not a mapping PM-24 Data Integrity Board Loosely related Only shares CSF GV.RR-01: related, not a mapping PM-29 Risk Management Program Leadership Roles Loosely related Only shares CSF GV.RR-01: related, not a mapping PS-9 Position Descriptions Loosely related Only shares CSF GV.RR-01: related, not a mapping
HIPAA	§164.308(a)(5)§164.308(a)(5)(ii)(A)	Security Awareness and Training; Security Reminders	Crosswalk	Same topic: Awareness & Training 4 loosely related (not mappings) §164.308(a)(2) Assigned Security Responsibility Loosely related Only shares CSF GV.RR-01: related, not a mapping §164.308(a)(5)(ii)(B) Protection from Malicious Software Loosely related Only shares CSF PR.AT-01: related, not a mapping §164.308(a)(5)(ii)(C) Log-in Monitoring Loosely related Only shares CSF PR.AT-01: related, not a mapping §164.308(a)(5)(ii)(D) Password Management Loosely related Only shares CSF PR.AT-01: related, not a mapping
GDPR	Art.39(1)(b)	Tasks of the data protection officer	Editorial	Same topic: Awareness & Training (editorial pick) 2 loosely related (not mappings) Art.37(1) Designation of the data protection officer Loosely related Only shares CSF GV.RR-01: related, not a mapping Art.39(1) Tasks of the data protection officer Loosely related Only shares CSF GV.RR-01: related, not a mapping
NIS2	8.1 8.2	Awareness raising and basic cyber hygiene practices; Security training	Crosswalk	Same topic: Awareness & Training
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(4)Art.13(6)	Governance and organisation; Learning and evolving	Editorial	Same topic: Awareness & Training (editorial pick) 3 loosely related (not mappings) Art.5(2)(c) Governance and organisation Loosely related Only shares CSF GV.RR-01: related, not a mapping Art.5(3) Governance and organisation Loosely related Only shares CSF GV.RR-01: related, not a mapping Art.6(4) ICT risk management framework Loosely related Only shares CSF GV.RR-01: related, not a mapping
CPS 234	Para 13 Para 14	Board ultimately responsible for information security; Define information security roles and responsibilities	Loosely related	No mapping. Only shares CSF GV.RR-01: related, not a mapping
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.