Assessment Objective
Determine if:
- AT-03a.
- AT-03a.01
- AT-03a.01[01] role-based security training is provided to [Assignment: roles and responsibilities] before authorizing access to the system, information, or performing assigned duties;
- AT-03a.01[02] role-based privacy training is provided to [Assignment: roles and responsibilities] before authorizing access to the system, information, or performing assigned duties;
- AT-03a.01[03] role-based security training is provided to [Assignment: roles and responsibilities] [Assignment: frequency] thereafter;
- AT-03a.01[04] role-based privacy training is provided to [Assignment: roles and responsibilities] [Assignment: frequency] thereafter;
- AT-03a.02
- AT-03a.02[01] role-based security training is provided to personnel with assigned security roles and responsibilities when required by system changes;
- AT-03a.02[02] role-based privacy training is provided to personnel with assigned security roles and responsibilities when required by system changes;
- AT-03a.01
- AT-03b.
- AT-03b.[01] role-based training content is updated [Assignment: frequency];
- AT-03b.[02] role-based training content is updated following [Assignment: events];
- AT-03c. lessons learned from internal or external security incidents or breaches are incorporated into role-based training.
Assessment Methods
Examine
- System security plan
- privacy plan
- security and privacy awareness and training policy
- procedures addressing security and privacy training implementation
- codes of federal regulations
- security and privacy training curriculum
- security and privacy training materials
- training records
- other relevant documents or records
Interview
- Organizational personnel with responsibilities for role-based security and privacy training
- organizational personnel with assigned system security and privacy roles and responsibilities
Test
- Mechanisms managing role-based security and privacy training
Linked Issues
| Linktype | Issue |
|---|---|
| blocks | AT-03 [P] Role-based Training |