Welcome to Security Awareness Essentials — the foundational security training for every CivicActions team member.
This course covers the core behaviors and responsibilities you need to protect CivicActions systems, data, and clients. Whether its keeping your laptop secure, handling data correctly, or reporting something suspicious — this training has you covered.
Who takes this? Everyone — full-time staff, contractors, interns, and any third party with access to CivicActions systems.
How long? About 30–40 minutes (plus an optional 1-2 minutes for feedback)
When? Within 30 days of onboarding, then annually, and whenever there's a major policy change.
Note on links: Links are sometimes provided for additional information. Following them is not required for the training.
Let's get started!
Your laptop and workspace are the front line of security. This module covers what you need to know about your CivicActions-managed laptop, the software you install, and how to stay secure — whether you're at home, at a coffee shop, or on the road.
CivicActions issues employees a managed laptop. This laptop comes pre-configured with:
- Full-disk encryption — so your data stays protected if the device is lost or stolen
- Scanning software that checks for any security issues or viruses
- Firewall enabled by default
- Auto-lock — your screen locks automatically after a short idle period
- Automatic patching — your OS and security software stay up to date
Important: You must use your CivicActions laptop for all work involving Internal, Confidential, or client data. Personal BYOD (Bring Your Own Device) mobile devices can only be used for approved communications and collaboration tools.
Example: Your CivicActions Laptop comes with the Iru Mobile Device Management (MDM) system that manages FileVault encryption, security scanning, firewall, and patching out of the box. You don't need to configure any of this yourself — IT handles it before your laptop ships to you.
Tip: It's smart to keep your personal devices protected with a strong password, an idle screen lock and attention to security updates. Also, use passkeys or multi-factor authentication (MFA) wherever possible and stay alert to avoid phishing scams. More tips here.
Not all software is safe to use. CivicActions maintains an Approved Software Catalog and a Prohibited Hardware and Software list.
- Only install software from the Approved Catalog
- If you need something new, submit a request through the access and authorization workflow
- Iru will block software that isn't approved
Think of it this way: if it's not on the approved list, don't install it.
What's approved? Tools like Google Drive, Slack, Zoom, 1Password, Docker and GitHub Desktop are all in the catalog. What's prohibited? Huawei/ZTE devices, TikTok, Kaspersky, consumer "free VPN" apps, and ad-ware — Iru will block these automatically if you try to install them.
Working from home? Here are the basics:
- Position your screen so others can't see it (especially during video calls)
- Don't print anything that is Confidential or Restricted unless you have a cross-cut shredder and shred it the same day
- Protect your laptop from spills, heat, pets, and other environmental hazards
- If possible, use a surge-protected outlet for your laptop and monitor
Example: You're on a Zoom call discussing a client's infrastructure when a friend stops by. Close your laptop lid or lock the screen before answering the door — and don't forget to close any admin consoles, CI/CD dashboards, or cloud management tabs you had open in the background.
Your network connection matters just as much as your laptop.
- Use WPA2 or WPA3 encrypted Wi-Fi, or a wired Ethernet connection
- If unsure about the security of available Wi-Fi, use your phone's personal hotspot
- No VPNs unless required by the company or a client
- Change the default admin password on your home router (many people skip this) and keep the firmware updated
- Never click through TLS/SSL warnings — they exist for a reason
Tip: Practically all remote connections (Gmail, Slack, web sites, etc.) - certainly the ones required for your work - are secured with strong end-to-end cryptography, creating a safe network path for your communications.
On the go? Extra caution is needed:
- Keep your laptop physically with you at all times
- Of course, leaving it lid-closed, in a locked hotel room to go out to dinner is fine
- Lock your screen every time you step away, even for a minute
- Avoid displaying sensitive info where others can see your screen
- When on public Wi-Fi, connect only to well-known secure sites; if unsure, use your personal hotspot.
- Avoid printing sensitive documents while traveling
Example: You're at an airport waiting for a flight and need to review a client proposal located outside the CivicActions Google Workspace. Find a seat where nobody can read over your shoulder and use your phone's hotspot instead of the airport Wi-Fi.
CivicActions' Iru Mobile Device Management (MDM) system enforces minimum OS and patch levels. If your laptop falls behind you'll get a reminder to allow the update to occur. If you don't, your laptop may automatically update at a time that could be disruptive to your work.
Don't ignore update prompts — they keep you and the organization safe.
Example: Iru detects your laptop is two patch versions behind. You get a notification and if you don't update within the grace period, Iru can restrict your access to CivicActions systems until you're current. A quick restart is a lot easier than being locked out mid-sprint.
Your CivicActions laptop prompts you to install a system update. You're in the middle of a deadline. What should you do?
- [( )] Dismiss the update permanently to avoid interruption
- [(X)] Install the update at the next reasonable opportunity — don't postpone indefinitely
- [( )] Disable the Iru Mobile Device Management system so updates stop appearing
- [( )] Uninstall the update software
Correct! System updates patch security vulnerabilities. You don't need to drop everything, but you should install them as soon as reasonably possible. Never disable Iru or dismiss updates permanently — your laptop could be blocked for non-compliance.
Your digital identity is how CivicActions verifies that you are you. This module covers your CivicActions account, multi-factor authentication (MFA), passwords, and the rules around who gets access to what.
Links to the full Identification Policy and Access Control Policy
- Your @civicactions.com account is your primary identity for all work systems
- Never use personal accounts (like a personal Gmail) for CivicActions work
- CivicActions uses a
firstname.lastname@civicactions.comnaming convention — IT sets this up when you onboard. If your name matches someone else's, IT adds a middle initial or variation.
Example: When you join, PeopleOps verifies your identity through Rippling. IT then creates your Google Workspace account, assigns you to the right groups and Slack channels, issues your YubiKey and orders your CivicActions laptop — all before your first day.
Single Sign-On (SSO) lets you log in once and access multiple work systems. Use CivicActions SSO wherever it's available.
In practice: Your CivicActions Google Workspace login is the front door. When you sign in there, SSO automatically connects you to Slack, Zoom, Jira, Confluence, GitLab, and other CivicActions systems — no separate passwords needed.
Your YubiKey is a Passkey for quick and secure authentication to CivicActions Google Workspace
Why a hardware key? They are phishing resistant and are preferred over SMS codes or authenticator apps. Even if someone tricks you into entering your password on a fake site, they can't intercept a hardware key.
If you lose your YubiKey, report it immediately to security@civicactions.com - the Information Technology (IT) team will disable the lost key, verify your identity, and send you a replacement. If you are locked out of your laptop or Google Account, follow the procedure for Internal Technical Support in the Guidebook
Tip: Consider buying a second YubiKey and keep one on your keychain and store the backup in a secure spot at home.
To authenticate to sites that don't use CivicActions SSO, use Multi-Factor Authentication (MFA) to add a second layer of proof that you are who you say you are.
Tip: When you personally manage MFA, you must have a backup second factor for all your MFA accounts. Imagine that you lose the YubiKey used to unlock your password manager. Without a backup second factor, you would be effectively locked out of all of your accounts. So you need a backup.
Strong passwords are your first line of defense:
- Passwords must be a minimum of 16 characters long
Tip: Make your passwords long and unique - four or five words that only mean something to you is recommended for security and easy memorization.
There are two passwords that you will need to remember:
- Your Google Workspace SSO password for most CivicActions services
- The password to your password manager for everything else
Never reuse passwords across different services — if one gets compromised, they all do
Any site or service that doesn't use Google Workspace SSO should use Multi-Factor Authentication (MFA) - such as your YubiKey - for added security. This includes your password manager.
Tip: 1Password, LastPass and your managed Chrome browser store are some of the best known and recommended password managers.
Need access to a new system or project?
- Submit a request including the system name, your justification and how long you need it using a project ticket or via internal technical support
- Access is granted based on least privilege — you get only what you need
- If your role changes or you leave, notify IT promptly so access can be adjusted
Note: Access to client systems is managed separately by the client project managers and their security team.
Your access is scoped to your assigned projects. This means:
- Don't access systems or data outside your current project
- When you transition between projects, your access is automatically reviewed
- If you think you need broader access, request it through the proper channel
Example: You finish a project for Client A and move to Client B. Your manager triggers a rights review — your Client A GitLab access and Shared Drive permissions are removed, and new access for Client B is set up through a fresh ticket. This keeps client data cleanly separated.
You're setting up MFA for your password manager. Which method is the preferred primary factor?
- [( )] SMS text message code
- [( )] Voice call one-time password
- [(X)] FIDO2/WebAuthn hardware security key (e.g., YubiKey)
- [( )] Email-based one-time password
That's right! FIDO2/WebAuthn hardware keys are phishing-resistant — they physically verify the site you're logging into, so attackers can't intercept them. SMS and email codes can be intercepted or phished, which is why hardware keys are the CivicActions standard.
Not all data is created equal. CivicActions classifies data into levels so everyone knows how to handle, store, and share it properly. This module teaches you the classification system and the rules that go with each level.
Here's a link to the full Data Security and Handling Policy
CivicActions uses four levels of data classification:
| Level | What it means | If mishandled |
|---|---|---|
| Public | Approved for release — website content, published marketing materials, open-source code. Anyone in the organization can access and share this data. | Minimal risk. |
| Internal | Non-sensitive internal procedures — meeting notes, project timelines, internal process documents. Should not be shared outside the organization. | Minor operational disruptions, but no severe compliance consequences. |
| Confidential | High-stakes data — client contracts, technical drawings, other Federal Contract Information (FCI), Controlled Unclassified Information (CUI). Access limited to those with a legitimate business need. | Could jeopardize contract eligibility or lead to regulatory penalties. |
| Restricted | The most sensitive data — payroll records, login credentials, Social Security Numbers, Personal Health Information (PHI). Access strictly controlled and monitored. | Severe harm, including legal action, significant financial loss, or compromise of personal data. |
Default rule: All data is treated as Internal until someone explicitly classifies it otherwise.
Each sensitivity classification level has specific rules for sharing, storage, and transmission:
- Public: No special handling needed
- Internal: Keep within CivicActions systems; don't post externally
- Confidential/Restricted:
- Access on a need-to-know basis only
- Employ data minimization. Do not copy to other tools or services.
- Must be encrypted in transit and at rest
- Note: Controlled Unclassified Information (CUI) has additional handling controls over other Confidential data
When in doubt, treat data as Confidential and ask your manager or IT.
Example: You're writing a blog post about a project approach. The blog content is Public, but the client name and contract details behind it are Confidential. Before publishing, make sure the post only references what the client has approved for public release.
Where you store data matters:
- Use only CivicActions-managed systems: Google Workspace, approved SaaS platforms, and managed endpoints
- Never store work data on personal cloud accounts (personal Google Drive, iCloud, Dropbox, etc.)
If it's work data, it belongs on work systems — period.
General rule: All work related information should be stored in the cloud in the appropriate CivicActions Google Shared Drive or in GitHub/GitLab.
Example: You're drafting a proposal and want to save it locally "just in case." Don’t save your draft proposal locally. Sync it to your CivicActions Google Drive instead. That way it's backed up, access-controlled, and covered by Data Loss Prevention (DLP) monitoring. If something happens to your laptop, the file is still safe in the cloud.
Tip: Learn to spot labeled files in Google Workspace — look for banners, filename tags (like
[CUI]or[Confidential]), or workspace labels on documents and folders. If a file contains sensitive information but doesn't have any of these markers, flag it to your manager or IT so it can be properly labeled before anyone shares it further.
Sharing data the wrong way is one of the most common security mistakes:
- Google Docs: Share by individual email address or approved group (e.g. CivicActions Team); not "Anyone with the link"
- Confidential files sent externally: Use a password-protected AES-256 archive with a 16+ character passphrase
- Send the passphrase through a separate channel (e.g., share the file by email, send the password via Slack)
- Never use email for Confidential or Restricted data that is not encrypted — use Google Drive sharing instead
- Slack is for Public, Internal and some Confidential information — never paste or upload CUI or Restricted data (including system vulnerability scans and login credentials) in Slack channels or DMs
Example: A partner organization needs a Confidential deliverable but doesn't have access to your Google Drive. Create a password-protected ZIP archive with a 16+ character passphrase, email the archive, and then send the passphrase via Slack DM — never in the same email.
The general rule: avoid both whenever possible.
- If you must print something, secure it and shred it the same day
- Do not use removable media - this includes USB drives - without express permission from CISO or CTO.
CivicActions uses Data Loss Prevention (DLP) tools that may flag unusual data transfers. Here's what to know:
- Monitoring exists to protect the organization, not to watch over individuals
- If a DLP tool flags something you did for a legitimate reason, just respond to the follow-up request — it's not a disciplinary action
Example: Google Workspace DLP rules scan for patterns like Social Security numbers and the keyword "CUI." If you share a Google Doc containing a SSN and the sharing settings are too broad, DLP may automatically block it and notify the security team. Just explain the context when asked — it's a safety net, not a gotcha.
You need to share a Google Doc with Internal project data with a colleague. Which sharing method is correct?
- [( )] Set the link to "anyone with the link can view"
- [(X)] Share directly with your colleague's CivicActions email address
- [( )] Email the document to your colleague's personal Gmail
- [( )] Post the link in a public Slack channel
Exactly! Always share Google Docs by individual CivicActions email address. "Anyone with the link" makes the document accessible to anyone who gets that link — intentionally or accidentally.
CivicActions systems are tools for getting work done. This module covers the rules around how you use those tools — including the rapidly evolving area of AI.
Links to the full Acceptable Use Policy and AI Usage Policy
- CivicActions systems are for authorized business use
- Limited personal use is OK — as long as it doesn't interfere with work, consume significant resources, or violate any policy
- When in doubt, ask
Example: Checking personal email or reading the news during a break is fine. Storing personal photos on your CivicActions Google Drive or running a side business from your managed laptop is not.
Some things are never OK:
- Circumventing security controls (disabling firewalls, VPN bypasses, etc.)
- Unauthorized data exfiltration — taking work data out of approved systems
- Using non-approved tools for work data
- Sharing your credentials with anyone, for any reason
Example: A colleague on a tight deadline asks for your GitLab credentials to push a fix while you're away. The answer is always no — even with good intentions. They should request their own access through the proper workflow.
AI can be a powerful productivity tool, but it comes with real risks. Here are the ground rules:
- Use only CivicActions-approved AI tools with IT-managed accounts
- Do not expose sensitive or confidential information to AI tools outside an approved system or client-approved environment
- Human oversight is required for all AI-generated output
- While it may have been generated by AI, you are responsible for shared output
- Clearly label AI-generated or AI-assisted content internally
- Peer-review AI content before sharing it externally
Think of it this way: Anything you type into an AI tool could end up in a training dataset. Would you be comfortable seeing your input in a news article? If not, don't enter it.
CivicActions has approved specific AI tools for different purposes:
- General purpose: Slack Chatbot, Gemini, ChatGPT for Teams
- Coding: GitHub Copilot
- Specialist: Grammarly, Paxton AI
- Service integrations: Zoom AI, Mural, Confluence/Jira, Greenhouse, Figma
Note: This list changes frequently, refer to the AI Usage Policy for the latest list.
Want to use an AI tool that isn't on the approved list?
- You need CTO approval before using it
- On client projects, you also need client approval
- Every new tool goes through a risk assessment based on the NIST AI Risk Management Framework
Example: You hear about a new AI transcription tool that could save time on meeting notes. Before signing up, check with the CTO — even a free trial counts. If it touches CivicActions data, it needs vetting first.
To keep track of multiple projects, you want to install a new AI scheduling assistant called "OpenClaw." You don't see it on the company's approved list. Is this a good idea?
- [( )] Yes, as long as it improves your productivity and efficiency
- [( )] Yes, but you should sign up using your personal email address to protect the company
- [(X)] No. You must only use approved software configurations and must submit a request before using any new AI tools
- [( )] No, because AI is strictly prohibited for project management purposes
Good call! Installing unapproved software - often referred to as Shadow IT - bypasses the organization's security controls. Even if a tool seems helpful or promises great productivity boosts, it has not been evaluated by the security team for vulnerabilities, malicious code or data leakage.
Security incidents happen — even to careful people. What matters most is how quickly you respond. This module teaches you what to look for, how to report it, and what happens next.
Here are links to the full Incident Response Policy and Incident Response Plan.
But this link is more useful for general staff: What is an incident and how to report one.
If you observe anything that might be a security incident, outage, or suspicious activity — raise a flag immediately. Don't wait until you're sure.
Post what you observed and what systems may be affected in the Slack loving-security channel and mention the @security group.
You can also DM an IT team member or send an email to security@civicactitons.com.
If the issue may be critical or if you don't get a response within 15 minutes, (re-)post the above in #it-support. Include the word "Incident" to alert the Security Incident Response Team (SIRT).
Use whichever channel is fastest. Speed matters more than formality.
After reporting, follow the Responder's lead: they may ask you to preserve evidence, or provide more detail.
Examples of things to report: A phishing email, a lost laptop, an unfamiliar login alert, a SaaS app behaving strangely, a colleague who seems to have access they shouldn't, a physical security concern at a co-working space.
CivicActions has a blame-free reporting culture:
- Good-faith reporting will never result in retaliation
- Speed matters more than certainty — it's better to report something that turns out to be nothing than to stay silent about something real
- We learn more from honest reports than from silence
Example: You accidentally sent a Google Doc with Internal data to the wrong email address. Report it right away — DM an IT team member or email security@civicactions.com. This kind of honest report helps the team contain the issue quickly. Nobody gets in trouble for an honest mistake reported fast.
If a device is lost or stolen, report it immediately through the incident channels. Include:
- What device (laptop, phone, etc.)
- When it went missing
- Where you last had it
- What data might be exposed
This applies to both CivicActions laptops and personal devices that have authenticated to CivicActions systems (like a phone used for MFA).
Example: You left your CivicActions MacBook in a rideshare. DM an IT team member on Slack right away with: "Lost my laptop in a Lyft at 3 PM, last had it at the airport, had access to Client B's Shared Drive." IT can trigger a remote wipe through Iru immediately — FileVault encryption means the data is already protected, but the wipe makes sure.
When an incident is under investigation:
- Treat incident details on a need-to-know basis
- Don't share details outside the designated channels (Slack incident thread, email to security team, etc.)
Example: You hear that a Software as a Service (SaaS) vendor CivicActions uses had a breach (e.g., Slack, Unanet). Don't post about it in a public Slack channel or mention it to a client. Wait for the Incident Commander or Communications Officer to share approved updates through the proper channels.
After an incident is resolved, you may be asked to participate in a retrospective. These are learning sessions, not blame sessions:
- Share what you observed honestly
- Focus on what happened and how to prevent recurrence
- Lessons learned feed back into policy and operations improvements
You receive a suspicious email with an attachment claiming to be an invoice. What is the correct first step?
- [( )] Open the attachment to check if it looks legitimate
- [( )] Forward it to your personal email for safekeeping
- [(X)] Report (forward) it to security@civicactions.com
- [( )] Delete it and forget about it
Correct! Never open suspicious attachments. Report the email immediately so the security team can analyze it and warn others if needed. Deleting it silently means the team can't investigate — and others might fall for the same phishing attempt. Reporting suspicious email messages using the Report phishing option in Gmail is also encouraged.
You don't need to be a compliance expert, but it helps to understand the big picture. This module gives you a quick overview of how CivicActions policies are organized, what frameworks they align to, and what you can do to support them.
CivicActions has a layered policy structure:
- CivicActions Company-wide Policies is a Confluence page that contains all current policies
- Most of this training stems from the Information Security Policy which delegates specifics to subordinate policies: Acceptable Use, Access Control, Incident Response, Data Security, and more
- All policies are accessible to you — know where to find them if you need them
Example: Wondering what the rules are for using USB drives? You'd look at the Data Security and Handling Policy. Not sure about your MFA requirements? Check the Identification Policy. The Information Security Policy is the table of contents — it points you to the right place.
CivicActions aligns to several compliance frameworks:
| Framework | What it covers |
|---|---|
| CMMC L1/L2 | Federal contractor cybersecurity requirements (FAR/NIST 800-171) |
| ISO 27001 | International information security management standard |
| ISO 9001 | Quality management |
| ITIL | IT service management best practices |
This training satisfies security awareness requirements for CMMC and ISO 27001.
Understanding risk doesn't have to be complicated:
- CIA triad: Confidentiality, Integrity, Availability — these are the three things we protect
- 3×3 risk scale: Likelihood (Low/Medium/High) × Impact (Low/Medium/High)
- Risk acceptance must be explicit and approved by the right people — you can't just decide to accept a risk on your own
Example: You notice that a tool your team uses doesn't support SSO. You can't just decide "that's fine" and keep using it with a local password. A risk like that needs to be formally documented in the Jira Risk Register and approved by the appropriate authority — the CISO or CTO for higher risks, or an IT team member for lower ones.
During a major outage, normal communication tools might be down. Here's the backup plan:
- Primary: Slack chat, Slack huddle, Zoom video
- Secondary: Google Chat, Google Meet, telephone
Clients and partners are notified only if the outage impacts deliverables.
Want to suggest a change to a policy or controlled document?
- Contact the Document Owner, or add a ticket to the appropriate Jira board.
- Controlled Documents are reviewed annually
- Access to documents is managed via security groups
Example: You spot an outdated link in the Acceptable Use Policy. Create a ticket on the Compliance Jira board describing the change. The Document Controller reviews it, and if approved, a new minor version (e.g., 2.1 → 2.2) is published. You don't need to edit the document yourself.
You don't need to manage these programs — but you should know they exist:
- CivicActions IT manages configuration management, change enablement, vulnerability and patch management
- Think of these as guardrails, not gates — they run in the background to keep everything secure
- Your part: install updates when prompted and report anything that seems off
CivicActions works with outside vendors and partners. Here's what you should know:
- No supplier may be procured or granted system access until due diligence is complete
- If you have concerns about a vendor's security practices, report them to IT
Example: A project lead wants to try a new design collaboration tool. Before signing up, it needs to go through supplier intake and Confidentiality, Integrity, Availability, and eXpense (CIAX) scoring for SaaS, SSO/MFA validation, data residency review. Even a free-tier tool that touches CivicActions data must be vetted first.
During a major SaaS outage, Slack is unavailable. What is the next communication channel to use per the Disaster Recovery Plan?
- [( )] Personal text messages
- [(X)] Zoom or Google Chat
- [( )] Twitter/X direct messages
- [( )] Wait until Slack comes back
Right! The DR communication hierarchy is: Primary (Slack/Zoom), Secondary (Google Chat/Meet or telephone). Knowing these backups means you can stay connected and coordinated even when the primary tools are down.
You've completed all six modules — nice work! Here's one final question that covers an important topic from the course.
What is the default classification level for all CivicActions data that hasn't been explicitly classified?
- [( )] Public
- [(X)] Internal
- [( )] Confidential
- [( )] Restricted
Correct! All data is treated as Internal by default until it is explicitly classified otherwise. This means you should handle any unclassified data as Internal — keep it within CivicActions systems and share it only with CivicActions team members. If you think data should be treated at a higher (or lower) level, work with your manager to get it properly classified.
Congratulations — you've finished Security Awareness Essentials!
Here's what you covered:
- Devices and workspace — managed laptops, approved software, home and travel security
- Identity and access — SSO, MFA with hardware keys, passwords, least-privilege access
- Data handling — classification levels, approved storage, safe sharing
- Acceptable use and AI — approved tools, data restrictions, human oversight of AI
- Incident reporting — see something say something, blame-free culture, lost devices
- Governance and compliance — policy structure, frameworks, risk and third-party awareness
Remember the basics:
- Use your CivicActions laptop with approved software
- Protect your identity with passkeys, hardware MFA keys and strong passwords
- Handle data according to its classification level
- Never put sensitive data into any unapproved tool
- Report anything suspicious — fast
Questions? Reach out to security@civicactions.com or post in Slack #loving-security.
Please take 2 minutes to fill out our Policy Training Feedback Form
Tip: Close this window to record your completion of this training in Rippling.