What this control covers
Train workforce members on how to identify and properly store, transfer, archive, and destroy sensitive data. This also includes training workforce members on clear screen and desk best practices, such as locking their screen when they step away from their enterprise asset, erasing physical and virtual whiteboards at the end of meetings, and storing data and assets securely.
Why it matters
Most successful attacks involve a human; training closes the gap technical controls cannot.
How to implement
AWS
Manage all changes in Terraform/CloudFormation; enforce SCPs that deny console writes for prod. Use AWS Config rules + conformance packs (CIS, HIPAA, PCI) to detect drift.
Azure
Azure Policy + Blueprints baseline landing zones; Bicep/Terraform as IaC and Policy Insights for drift.
GCP
Org Policy Service for guardrails and Config Validator in CI to pre-check Terraform plans against policy as code (Rego).
On-premises
Roll out role-based security awareness annually + phishing simulations quarterly. Track completion in your LMS and tie to performance review for repeat-fails.
Evidence to collect
infra_scan— See the iCompaas Evidence library for the canonical source for this evidence type.
Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Train Workforce on Data Handling Best Practices.
Quick checklist
- Securely — Network / Sensitive
- Protect — Network / Sensitive
- Train — Network / Sensitive
Related articles on this site
- Microsoft Cloud Security Posture Management (CSPM)
- 2.10 Ensure that Microsoft Cloud App Security (MCAS) integration with Security Center is selected
- Ensure that Activity Log Alert exists for Create or Update Network Security Group
- 5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group