+AT Awareness and Training
---+AT-01 Policy and Procedures
---+AT-02 Literacy Training and Awareness
------+AT-02(01) Practical Exercises
------+AT-02(02) Insider Threat
------+AT-02(03) Social Engineering and Mining
------+AT-02(04) Suspicious Communications and Anomalous System Behavior
------+AT-02(05) Advanced Persistent Threat
------+AT-02(06) Cyber Threat Environment
---+AT-03 Role-based Training
------+AT-03(01) Environmental Controls
------+AT-03(02) Physical Security Controls
------+AT-03(03) Practical Exercises
------+AT-03(05) Processing Personally Identifiable Information
---+AT-04 Training Records
---+AT-05 Contacts with Security Groups and Associations
---+AT-06 Training Feedback

AT Awareness and Training

Awareness and Training

1. Oversigt

AT-01 Policy and Procedures

Control

  1. Develop, document, and disseminate to [Assignement: organization-defined personnel or roles]:
    1. [Selection(one-or-more): organization-level; mission/business process-level; system-level] awareness and training policy that:
      1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
      2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
    2. Procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls;
  2. Designate an [Assignement: official] to manage the development, documentation, and dissemination of the awareness and training policy and procedures; and
  3. Review and update the current awareness and training:
    1. Policy [Assignement: frequency] and following [Assignement: events] ; and
    2. Procedures [Assignement: frequency] and following [Assignement: events].

Discussion

Awareness and training policy and procedures address the controls in the AT family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of awareness and training policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to awareness and training policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure.

Assessment Objective

    1. an awareness and training policy is developed and documented;
    2. the awareness and training policy is disseminated to [Assignement: personnel or roles];
    3. awareness and training procedures to facilitate the implementation of the awareness and training policy and associated access controls are developed and documented;
    4. the awareness and training procedures are disseminated to [Assignement: personnel or roles].
        1. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] awareness and training policy addresses purpose;
        2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] awareness and training policy addresses scope;
        3. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] awareness and training policy addresses roles;
        4. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] awareness and training policy addresses responsibilities;
        5. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] awareness and training policy addresses management commitment;
        6. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] awareness and training policy addresses coordination among organizational entities;
        7. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] awareness and training policy addresses compliance; and
      2. the [Selection(one-or-more): organization-level; mission/business process-level; system-level] awareness and training policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; and
  2. the [Assignement: official] is designated to manage the development, documentation, and dissemination of the awareness and training policy and procedures;
      1. the current awareness and training policy is reviewed and updated [Assignement: frequency];
      2. the current awareness and training policy is reviewed and updated following [Assignement: events];
      1. the current awareness and training procedures are reviewed and updated [Assignement: frequency];
      2. the current awareness and training procedures are reviewed and updated following [Assignement: events].

Assessment Method

Examine

System security plan privacy plan awareness and training policy and procedures other relevant documents or records

Interview

Organizational personnel with awareness and training responsibilities organizational personnel with information security and privacy responsibilities
AT-02 Literacy Training and Awareness

Control

  1. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors):
    1. As part of initial training for new users and [Assignement: organization-defined frequency] thereafter; and
    2. When required by system changes or following [Assignement: organization-defined events];
  2. Employ the following techniques to increase the security and privacy awareness of system users [Assignement: awareness techniques];
  3. Update literacy training and awareness content [Assignement: frequency] and following [Assignement: events] ; and
  4. Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.

Discussion

Organizations provide basic and advanced levels of literacy training to system users, including measures to test the knowledge level of users. Organizations determine the content of literacy training and awareness based on specific organizational requirements, the systems to which personnel have authorized access, and work environments (e.g., telework). The content includes an understanding of the need for security and privacy as well as actions by users to maintain security and personal privacy and to respond to suspected incidents. The content addresses the need for operations security and the handling of personally identifiable information. Awareness techniques include displaying posters, offering supplies inscribed with security and privacy reminders, displaying logon screen messages, generating email advisories or notices from organizational officials, and conducting awareness events. Literacy training after the initial training described in [AT-2a.1](#at-2_smt.a.1) is conducted at a minimum frequency consistent with applicable laws, directives, regulations, and policies. Subsequent literacy training may be satisfied by one or more short ad hoc sessions and include topical information on recent attack schemes, changes to organizational security and privacy policies, revised security and privacy expectations, or a subset of topics from the initial training. Updating literacy training and awareness content on a regular basis helps to ensure that the content remains relevant. Events that may precipitate an update to literacy training and awareness content include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

Assessment Objective

      1. security literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;
      2. privacy literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;
      3. security literacy training is provided to system users (including managers, senior executives, and contractors) [Assignement: frequency] thereafter;
      4. privacy literacy training is provided to system users (including managers, senior executives, and contractors) [Assignement: frequency] thereafter;
      1. security literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [Assignement: events];
      2. privacy literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [Assignement: events];
  2. [Assignement: awareness techniques] are employed to increase the security and privacy awareness of system users;
    1. literacy training and awareness content is updated [Assignement: frequency];
    2. literacy training and awareness content is updated following [Assignement: events];
  4. lessons learned from internal or external security incidents or breaches are incorporated into literacy training and awareness techniques.

Assessment Method

Examine

System security plan privacy plan literacy training and awareness policy procedures addressing literacy training and awareness implementation appropriate codes of federal regulations security and privacy literacy training curriculum security and privacy literacy training materials training records other relevant documents or records

Interview

Organizational personnel with responsibilities for literacy training and awareness organizational personnel with information security and privacy responsibilities organizational personnel comprising the general system user community
AT-03 Role-based Training

Control

  1. Provide role-based security and privacy training to personnel with the following roles and responsibilities: [Assignement: organization-defined roles and responsibilities]:
    1. Before authorizing access to the system, information, or performing assigned duties, and [Assignement: frequency] thereafter; and
    2. When required by system changes;
  2. Update role-based training content [Assignement: frequency] and following [Assignement: events] ; and
  3. Incorporate lessons learned from internal or external security incidents or breaches into role-based training.

Discussion

Organizations determine the content of training based on the assigned roles and responsibilities of individuals as well as the security and privacy requirements of organizations and the systems to which personnel have authorized access, including technical training specifically tailored for assigned duties. Roles that may require role-based training include senior leaders or management officials (e.g., head of agency/chief executive officer, chief information officer, senior accountable official for risk management, senior agency information security officer, senior agency official for privacy), system owners; authorizing officials; system security officers; privacy officers; acquisition and procurement officials; enterprise architects; systems engineers; software developers; systems security engineers; privacy engineers; system, network, and database administrators; auditors; personnel conducting configuration management activities; personnel performing verification and validation activities; personnel with access to system-level software; control assessors; personnel with contingency planning and incident response duties; personnel with privacy management responsibilities; and personnel with access to personally identifiable information. Comprehensive role-based training addresses management, operational, and technical roles and responsibilities covering physical, personnel, and technical controls. Role-based training also includes policies, procedures, tools, methods, and artifacts for the security and privacy roles defined. Organizations provide the training necessary for individuals to fulfill their responsibilities related to operations and supply chain risk management within the context of organizational security and privacy programs. Role-based training also applies to contractors who provide services to federal agencies. Types of training include web-based and computer-based training, classroom-style training, and hands-on training (including micro-training). Updating role-based training on a regular basis helps to ensure that the content remains relevant and effective. Events that may precipitate an update to role-based training content include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

Assessment Objective

      1. role-based security training is provided to [Assignement: roles and responsibilities] before authorizing access to the system, information, or performing assigned duties;
      2. role-based privacy training is provided to [Assignement: roles and responsibilities] before authorizing access to the system, information, or performing assigned duties;
      3. role-based security training is provided to [Assignement: roles and responsibilities] [Assignement: frequency] thereafter;
      4. role-based privacy training is provided to [Assignement: roles and responsibilities] [Assignement: frequency] thereafter;
      1. role-based security training is provided to personnel with assigned security roles and responsibilities when required by system changes;
      2. role-based privacy training is provided to personnel with assigned security roles and responsibilities when required by system changes;
    1. role-based training content is updated [Assignement: frequency];
    2. role-based training content is updated following [Assignement: events];
  3. lessons learned from internal or external security incidents or breaches are incorporated into role-based training.

Assessment Method

Examine

System security plan privacy plan security and privacy awareness and training policy procedures addressing security and privacy training implementation codes of federal regulations security and privacy training curriculum security and privacy training materials training records other relevant documents or records

Interview

Organizational personnel with responsibilities for role-based security and privacy training organizational personnel with assigned system security and privacy roles and responsibilities
AT-04 Training Records

Control

  1. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and
  2. Retain individual training records for [Assignement: time period].

Discussion

Documentation for specialized training may be maintained by individual supervisors at the discretion of the organization. The National Archives and Records Administration provides guidance on records retention for federal agencies.

Assessment Objective

    1. information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are documented;
    2. information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are monitored;
  2. individual training records are retained for [Assignement: time period].

Assessment Method

Examine

Security and privacy awareness and training policy procedures addressing security and privacy training records security and privacy awareness and training records system security plan privacy plan other relevant documents or records

Interview

Organizational personnel with information security and privacy training record retention responsibilities
AT-05 Contacts with Security Groups and Associations

Control

Discussion

Assessment Objective

Assessment Method

Examine

Interview
AT-06 Training Feedback

Control

Provide feedback on organizational training results to the following personnel [Assignement: frequency]: [Assignement: personnel].

Discussion

Training feedback includes awareness training results and role-based training results. Training results, especially failures of personnel in critical roles, can be indicative of a potentially serious problem. Therefore, it is important that senior managers are made aware of such situations so that they can take appropriate response actions. Training feedback supports the evaluation and update of organizational training described in [AT-2b](#at-2_smt.b) and [AT-3b](#at-3_smt.b).

Assessment Objective

feedback on organizational training results is provided [Assignement: frequency] to [Assignement: personnel].

Assessment Method

Examine

Security awareness and training policy procedures addressing security training records security awareness and training records security plan other relevant documents or records

Interview

Organizational personnel with information security training record retention responsibilities

1.1 Referencer

1.2 Identificerede krav

1.3 Relaterede reguleringer

2. Identificerede krav

Krav

3. Relaterede reguleringer

Reguleringer