Security Awareness Baseline

A set of controls required for human-layer defense: mandatory and onboarding security awareness training, regular phishing simulations and an easy reporting culture, role-based and privileged-user training, social engineering/vishing/deepfake awareness, and program measurement. Framework is SANS CIS Controls v8 Control 14; the employee is both the largest attack surface and the most effective sensor.