[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:cis\u002F14":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"cis","14","Control 14","Security Awareness and Skills Training",900,"Center for Internet Security (CIS)","**What it asks for.** Organisations should run a security awareness programme that shapes how staff behave so that they are security conscious and appropriately skilled. It covers general awareness topics and role specific training for those with particular responsibilities.\n\n**In practice.** A good programme trains all staff at onboarding and at least yearly on topics such as social engineering, authentication, data handling and incident reporting, and adds role based training for developers, administrators and executives. Content is refreshed to reflect current threats, and phishing simulations or other exercises measure behaviour. Evidence includes completion records, training content, simulation results and reporting rates over time.\n\n**Common gaps.** Programmes often focus on annual completion rates rather than behaviour change, and role based training for privileged users is frequently missing. Staff are seldom told clearly how and where to report a suspected incident.",null,"https:\u002F\u002Fwww.cisecurity.org\u002Fcontrols\u002Fsecurity-awareness-and-skills-training","Read the control at CIS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},901,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"greek-authority-fined-for-unlawful-publication-of-personal-data-on-transparency-portal","Greek Authority Fined for Unlawful Publication of Personal Data on Transparency Portal","2026-10-18T20:20:25.794+00:00",{"slug":24,"title":25,"published_at":26},"cybersecurity-workforce-shifts-as-ai-roles-surge-and-traditional-postings-decline","Cybersecurity Workforce Shifts as AI Roles Surge and Traditional Postings Decline","2026-10-18T12:20:19.942+00:00",{"slug":28,"title":29,"published_at":30},"government-encryption-backdoors-threaten-global-data-security","Government Encryption Backdoors Threaten Global Data Security","2026-10-17T14:20:19.334+00:00",{"slug":32,"title":33,"published_at":34},"fake-ai-brand-impersonation-campaigns-target-enterprise-developers","Fake AI Brand Impersonation Campaigns Target Enterprise Developers","2026-10-16T22:20:50.472+00:00",{"slug":36,"title":37,"published_at":38},"aitm-phishing-campaign-bypasses-mfa-to-steal-google-credentials-from-taiwan-researchers","AitM Phishing Campaign Bypasses MFA to Steal Google Credentials from Taiwan Researchers","2026-10-16T18:21:24.446+00:00",{"slug":40,"title":41,"published_at":42},"phishing-smishing-attacks-target-election-officials-ahead-of-2026-midterms","Phishing & Smishing Attacks Target Election Officials Ahead of 2026 Midterms","2026-10-16T16:21:30.17+00:00",{"slug":44,"title":45,"published_at":46},"shadow-ai-personal-chatgpt-use-at-work-creates-data-exposure-risk","Shadow AI: Personal ChatGPT Use at Work Creates Data Exposure Risk","2026-10-16T16:21:15.148+00:00",{"slug":48,"title":49,"published_at":50},"romulus-malware-platform-exploits-human-deception-via-clickfix-lures","ROMULUS Malware Platform Exploits Human Deception via ClickFix Lures","2026-10-16T15:20:34.428+00:00",{"slug":52,"title":53,"published_at":54},"ai-chatbots-targeted-by-covert-political-influence-networks","AI Chatbots Targeted by Covert Political Influence Networks","2026-10-15T20:20:35.974+00:00",{"slug":56,"title":57,"published_at":58},"ai-powered-android-defenses-target-voice-cloning-and-messaging-scams","AI-Powered Android Defenses Target Voice Cloning and Messaging Scams","2026-10-15T20:20:20.548+00:00",{"slug":60,"title":61,"published_at":62},"fake-ai-tools-used-to-distribute-malware-and-steal-business-credentials","Fake AI Tools Used to Distribute Malware and Steal Business Credentials","2026-10-15T14:21:08.398+00:00",{"slug":64,"title":65,"published_at":66},"android-rat-hirudo-swaps-legitimate-banking-apps-with-trojanized-clones","Android RAT 'Hirudo' Swaps Legitimate Banking Apps with Trojanized Clones","2026-10-15T12:21:08.907+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",421,{"slug":74,"name":75,"problem":76,"stories":77},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",379,{"slug":79,"name":80,"problem":81,"stories":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",346,{"slug":84,"name":85,"problem":86,"stories":87},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",249,{"slug":89,"name":90,"problem":91,"stories":92},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",161,{"slug":94,"name":95,"problem":96,"stories":97},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",84,[99,105,111,116,121,126,131,137],{"family":100,"item":101,"code":102,"title":103,"together":104},"gdpr","32","Article 32","Security of processing",465,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-800-53","at-2","AT-2","Literacy Training and Awareness",395,{"family":106,"item":112,"code":113,"title":114,"together":115},"ac-2","AC-2","Account Management",273,{"family":106,"item":117,"code":118,"title":119,"together":120},"si-3","SI-3","Malicious Code Protection",268,{"family":122,"item":123,"code":124,"title":124,"together":125},"itil","overview","ITIL",259,{"family":5,"item":127,"code":128,"title":129,"together":130},"6","Control 6","Access Control Management",238,{"family":132,"item":133,"code":134,"title":135,"together":136},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",183,{"family":5,"item":138,"code":139,"title":140,"together":141},"9","Control 9","Email and Web Browser Protections",178]