Assessment Objective

Determine if:

• security literacy training is provided to system users as part of initial training for new users.
• security literacy training is provided to system users [Assignment: frequency] after initial training.
• security literacy training is provided to system users when required by system changes or following [Assignment: events].
• security literacy training is provided to system users on recognizing indicators of insider threat.
• security literacy training is provided to system users on reporting indicators of insider threat.
• security literacy training is provided to system users on recognizing indicators of social engineering.
• security literacy training is provided to system users on reporting indicators of social engineering.
• security literacy training is provided to system users on recognizing indicators of social mining.
• security literacy training is provided to system users on reporting indicators of social mining.
• security literacy training content is updated [Assignment: frequency].
• security literacy training content is updated following [Assignment: events].

Assessment Methods

Examine

• security literacy training and awareness policy and procedures
• procedures for security literacy training and awareness implementation
• codes of federal regulations
• security literacy and awareness training curriculum
• security literacy and awareness training materials
• training records
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for security literacy training and awareness
• personnel comprising the general system user community
• personnel with information security responsibilities

Test

• mechanisms for managing information security literacy training and awareness

Propojené úkoly

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final