CIS v8.1 · 14. Security Awareness and Skills Training
CIS 14.7
Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates
frameworkCIS Controls v8.1
section14. Security Awareness and Skills Training
csf 2.0PR.AT-01 PR.AT-02
topicsAwareness & Training
frameworks0 10 3
Official text · not licensableSafeguard title © CIS (CC BY-NC-ND 4.0). See CIS Controls v8.1 for details.
Wrong or missing mapping? Report it
| Framework | Requirement | Title | Link | Source / reason |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.AT-01PR.AT-02 | Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind; Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind | Editorial | Same topic: Awareness & Training (editorial pick) |
| ISO 27001 | A.6.3Clause 7.3 | Information security awareness, education and training; Awareness | Editorial | Same topic: Awareness & Training (editorial pick)1 loosely related (not mappings)A.5.2 Information security roles and responsibilities Only shares CSF PR.AT-02: related, not a mapping |
| SOC 2 | CC1.4CC2.2 | Commitment to attracting, developing and retaining competent people; Internal communication of objectives and responsibilities | Editorial | Same topic: Awareness & Training (editorial pick) |
| PCI DSS | 12.6.112.6.3 | Formal security awareness programme; Awareness training on hire and at least annually | Editorial | Same topic: Awareness & Training (editorial pick) |
| CMMC | AT.L2-3.2.1AT.L2-3.2.2AT.L2-3.2.3 | Role-Based Risk Awareness; Role-Based Training… | Editorial | Same topic: Awareness & Training (editorial pick) |
| 800-53 | AT-2AT-3 | Literacy Training and Awareness; Role-based Training | Editorial | Same topic: Awareness & Training (editorial pick) |
| HIPAA | §164.308(a)(5)§164.308(a)(5)(ii)(A) | Security Awareness and Training; Security Reminders | Editorial | Same topic: Awareness & Training (editorial pick)3 loosely related (not mappings)§164.308(a)(5)(ii)(B) Protection from Malicious Software Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping §164.308(a)(5)(ii)(D) Password Management Only shares CSF PR.AT-01, PR.AT-02: related, not a mapping |
| GDPR | Art.39(1)(b) | Tasks of the data protection officer | Editorial | Same topic: Awareness & Training (editorial pick) |
| NIS2 | 8.18.2 | Awareness raising and basic cyber hygiene practices; Security training | Editorial | Same topic: Awareness & Training (editorial pick)3 loosely related (not mappings)1.1 Policy on the security of network and information systems Only shares CSF PR.AT-02: related, not a mapping |
| Essential Eight | — | No requirement | No mapping in our data | No mapping in our data (Essential Eight links are editorial only). |
| DORA | Art.5(4)Art.13(6) | Governance and organisation; Learning and evolving | Editorial | Same topic: Awareness & Training (editorial pick) |
| CPS 234 | — | No requirement | No mapping in our data | No mapping in our data (CPS 234 is principles-based and its links are editorial). |
| Cyber Essentials | — | No requirement | No mapping in our data | No mapping in our data (Cyber Essentials covers five technical controls only). |
Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.