+AT-03 [L] Role-based Training

AT-03 [L] Role-based Training

Control

Provide role-based security and privacy training to personnel with the following roles and responsibilities: [Assignement: organization-defined roles and responsibilities]:
1. Before authorizing access to the system, information, or performing assigned duties, and [Assignement: frequency] thereafter; and
2. When required by system changes;
Update role-based training content [Assignement: frequency] and following [Assignement: events] ; and
Incorporate lessons learned from internal or external security incidents or breaches into role-based training.

Discussion

Organizations determine the content of training based on the assigned roles and responsibilities of individuals as well as the security and privacy requirements of organizations and the systems to which personnel have authorized access, including technical training specifically tailored for assigned duties. Roles that may require role-based training include senior leaders or management officials (e.g., head of agency/chief executive officer, chief information officer, senior accountable official for risk management, senior agency information security officer, senior agency official for privacy), system owners; authorizing officials; system security officers; privacy officers; acquisition and procurement officials; enterprise architects; systems engineers; software developers; systems security engineers; privacy engineers; system, network, and database administrators; auditors; personnel conducting configuration management activities; personnel performing verification and validation activities; personnel with access to system-level software; control assessors; personnel with contingency planning and incident response duties; personnel with privacy management responsibilities; and personnel with access to personally identifiable information. Comprehensive role-based training addresses management, operational, and technical roles and responsibilities covering physical, personnel, and technical controls. Role-based training also includes policies, procedures, tools, methods, and artifacts for the security and privacy roles defined. Organizations provide the training necessary for individuals to fulfill their responsibilities related to operations and supply chain risk management within the context of organizational security and privacy programs. Role-based training also applies to contractors who provide services to federal agencies. Types of training include web-based and computer-based training, classroom-style training, and hands-on training (including micro-training). Updating role-based training on a regular basis helps to ensure that the content remains relevant and effective. Events that may precipitate an update to role-based training content include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

Assessment Objective

1. 1. role-based security training is provided to [Assignement: roles and responsibilities] before authorizing access to the system, information, or performing assigned duties;
  2. role-based privacy training is provided to [Assignement: roles and responsibilities] before authorizing access to the system, information, or performing assigned duties;
  3. role-based security training is provided to [Assignement: roles and responsibilities] [Assignement: frequency] thereafter;
  4. role-based privacy training is provided to [Assignement: roles and responsibilities] [Assignement: frequency] thereafter;
2. 1. role-based security training is provided to personnel with assigned security roles and responsibilities when required by system changes;
  2. role-based privacy training is provided to personnel with assigned security roles and responsibilities when required by system changes;
1. role-based training content is updated [Assignement: frequency];
2. role-based training content is updated following [Assignement: events];
lessons learned from internal or external security incidents or breaches are incorporated into role-based training.

Assessment Method

Examine

System security plan privacy plan security and privacy awareness and training policy procedures addressing security and privacy training implementation codes of federal regulations security and privacy training curriculum security and privacy training materials training records other relevant documents or records

Interview

Organizational personnel with responsibilities for role-based security and privacy training organizational personnel with assigned system security and privacy roles and responsibilities

1. Επισκόπηση

Τίτλος	Πρότυπο

1.1 Παραπομπές

1.2 Εντοπισμένες απαιτήσεις

1.3 Σχετικοί κανονισμοί

2. Εντοπισμένες απαιτήσεις

Απαιτήσεις
Πηγή	Απαίτηση

3. Σχετικοί κανονισμοί

Κανονισμοί
Πηγή	Κανονισμός

Συνδεδεμένα ζητήματα

Συνδέσεις
Τύπος σύνδεσης	Ζήτημα
is blocked by	AT-03 [L] Role-based Training – Assessment Procedure
is blocked by	Role-Based Security, Compliance & Resilience Training

NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.