Assessment Objective
Determine if:
- AT-03(05) [Assignment: personnel or roles] are provided with initial and refresher training [Assignment: frequency] in the employment and operation of personally identifiable information processing and transparency controls.
Assessment Methods
Examine
- Security and privacy awareness and training policy
- procedures addressing security and privacy awareness training implementation
- security and privacy awareness training curriculum
- security and privacy awareness training materials
- system security plan
- privacy plan
- organizational privacy notices
- organizational policies
- system of records notices
- Privacy Act statements
- computer matching agreements and notices
- privacy impact assessments
- information sharing agreements
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for role-based security and privacy training
- organizational personnel who participate in security and privacy awareness training
Συνδεδεμένα ζητήματα
| Τύπος σύνδεσης | Ζήτημα |
|---|---|
| blocks | AT-03(05) [P] Processing Personally Identifiable Information |