Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• SAT-05_A01 roles and responsibilities for role-based cybersecurity / data privacy training are defined.
  Assessment rigor: 1
  Origin: 53A_R5_AT-03_ODP[01] 53A_R5_AT-03_ODP[02] 171A_3.2.2[a] 171A_3.2.2[b]
• SAT-05_A02 events that require role-based security training content updates are defined.
  Assessment rigor: 1
  Origin: 53A_R5_AT-03_ODP[05] 171A_R3_A.03.02.02.ODP[04]
• SAT-05_A03 role-based cybersecurity / data privacy training is provided to organizational personnel before authorizing access to the system or sensitive / regulated data.
  Assessment rigor: 1
  Origin: 53A_R5_AT-03a.01[01] 171A_3.2.2[c]
• SAT-05_A04 role-based security training is provided to organizational personnel before performing assigned duties.
  Assessment rigor: 1
  Origin: 53A_R5_AT-03a.01[02] 171A_R3_A.03.02.02.a.01[02]
• SAT-05_A05 role-based cybersecurity / data privacy training is provided to organizational personnel per an organization-defined frequency after initial training.
  Defined parameters: at least annually
  Assessment rigor: 1
  Origin: 53A_R5_AT-03a.01[03] 53A_R5_AT-03a.01[04] 171A_3.2.2[c]
• SAT-05_A06 role-based cybersecurity / data privacy training is provided to organizational personnel when required by system changes or following organization-defined events.
  Assessment rigor: 1
  Origin: 53A_R5_AT-03a.02[01] 53A_R5_AT-03a.02[02] 171A_3.2.2[c]
• SAT-05_A07 the frequency at which to provide role-based security training to assigned personnel after initial training is defined.
  Defined parameters: at least annually
  Assessment rigor: 2
  Origin: 53A_R5_AT-03_ODP[03] 171A_R3_A.03.02.02.ODP[01]
• SAT-05_A08 the frequency at which to update role-based security training content is defined.
  Defined parameters: at least annually
  Assessment rigor: 2
  Origin: 53A_R5_AT-03_ODP[04] 171A_R3_A.03.02.02.ODP[03]
• SAT-05_A09 role-based security training content is updated per an organization-defined frequency.
  Defined parameters: at least annually
  Assessment rigor: 3
  Origin: 53A_R5_AT-03b.[01]
• SAT-05_A10 role-based security training content is updated following organization-defined events.
  Assessment rigor: 3
  Origin: 53A_R5_AT-03b.[02]
• SAT-05_A11 lessons learned from internal or external security incidents or breaches are incorporated into role-based training.
  Assessment rigor: 3
  Origin: 53A_R5_AT-03c.
• SAT-05_A12 events that require role-based security training are defined.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.02.02.ODP[02]
• SAT-05_A13 incident response training for system users consistent with assigned roles and responsibilities is provided within an organization-defined time period of assuming an incident response role or responsibility or acquiring system access.
  Defined parameters: no more than 30 days
  Assessment rigor: 3
  Origin: SCF Created
• SAT-05_A14 incident response training for system users consistent with assigned roles and responsibilities is provided when required by system changes.
  Assessment rigor: 2
  Origin: 171A_R3_A.03.06.04.a.02
• SAT-05_A15 incident response training for system users consistent with assigned roles and responsibilities is provided per an organization-defined frequency thereafter.
  Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks
  Assessment rigor: 3
  Origin: SCF Created
• SAT-05_A16 role-based security training is provided to organizational personnel before authorizing access to the system or CUI.
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.02.02.a.01[01]
• SAT-05_A17 role-based security training is provided to organizational personnel <A.03.02.02.ODP[01]: frequency> after initial training.
  Defined parameters: at least every 12 months
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.02.02.a.01[03]
• SAT-05_A18 role-based security training is provided to organizational personnel when required by system changes or following <A.03.02.02.ODP[02]: events>.
  Defined parameters: significant, novel incidents, or significant changes to risks
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.02.02.a.02
• SAT-05_A19 role-based security training content is updated <A.03.02.02.ODP[03]: frequency>.
  Defined parameters: at least every 12 months
  Assessment rigor: NIST 800-171
  Origin: A.03.02.02.b[01]
• SAT-05_A20 role-based security training content is updated following <A.03.02.02.ODP[04]: events>.
  Defined parameters: significant, novel incidents, or significant changes to risks
  Assessment rigor: NIST 800-171
  Origin: A.03.02.02.b[02]
• SAT-05_A21 incident response training for system users consistent with assigned roles and responsibilities is provided within <A.03.06.04.ODP[01]: time period> of assuming an incident response role or responsibility or acquiring system access.
  Defined parameters: ten (10) days for privileged users, thirty (30) days for all other roles
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.06.04.a.01
• SAT-05_A22 incident response training for system users consistent with assigned roles and responsibilities is provided <A.03.06.04.ODP[02]: frequency> thereafter.
  Defined parameters: at least every 12 months
  Assessment rigor: NIST 800-171
  Origin: 171A_R3_A.03.06.04.a.03

Συνδεδεμένα ζητήματα

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.