# CIS 14.4 — Train Workforce on Data Handling Best Practices

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_cis_144_47b78a1dd8-cis-144-train-workforce-on-data-handling-best-practices
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [Protect](https://support.icompaas.com/support/solutions/folders/f_gen_62000112673_protect)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

CIS · Control 14.4 · Priority: critical · Component: Protect

### What this control covers

Train workforce members on how to identify and properly store, transfer, archive, and destroy sensitive data. This also includes training workforce members on clear screen and desk best practices, such as locking their screen when they step away from their enterprise asset, erasing physical and virtual whiteboards at the end of meetings, and storing data and assets securely.

### Why it matters

Most successful attacks involve a human; training closes the gap technical controls cannot.

### How to implement

#### AWS

Manage all changes in **Terraform/CloudFormation**; enforce SCPs that deny console writes for prod. Use **AWS Config rules** + **conformance packs** (CIS, HIPAA, PCI) to detect drift.

#### Azure

**Azure Policy** + **Blueprints** baseline landing zones; Bicep/Terraform as IaC and **Policy Insights** for drift.

#### GCP

**Org Policy Service** for guardrails and **Config Validator** in CI to pre-check Terraform plans against policy as code (Rego).

#### On-premises

Roll out role-based security awareness annually + phishing simulations quarterly. Track completion in your LMS and tie to performance review for repeat-fails.

### Evidence to collect

-   `infra_scan` — See the iCompaas Evidence library for the canonical source for this evidence type.

Infrastructure posture tooling (AWS Config, Azure Policy, Nessus) verifies platform hardening. Focus: Train Workforce on Data Handling Best Practices.

### Quick checklist

-   Securely — Network / Sensitive
-   Protect — Network / Sensitive
-   Train — Network / Sensitive

### Related articles on this site

-   [Microsoft Cloud Security Posture Management (CSPM)](https://support.icompaas.com/support/solutions/articles/62000234105-microsoft-cloud-security-posture-management-cspm-)
-   [2.10 Ensure that Microsoft Cloud App Security (MCAS) integration with Security Center is selected](https://support.icompaas.com/support/solutions/articles/62000219760-2-10-ensure-that-microsoft-cloud-app-security-mcas-integration-with-security-center-is-selected)
-   [Ensure that Activity Log Alert exists for Create or Update Network Security Group](https://support.icompaas.com/support/solutions/articles/62000219859-ensure-that-activity-log-alert-exists-for-create-or-update-network-security-group)
-   [5.2.4 Ensure that Activity Log Alert exists for Delete Network Security Group](https://support.icompaas.com/support/solutions/articles/62000219861-5-2-4-ensure-that-activity-log-alert-exists-for-delete-network-security-group)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.