+AT-02 [M] Literacy Training and Awareness
---+AT-02(02) [M] Insider Threat
---+AT-02(03) [M] Social Engineering and Mining
|
AT-02 [M] Literacy Training and Awareness
Control
- Provide security and privacy literacy training to system users (including managers, senior executives, and contractors):
- As part of initial training for new users and [Assignement: organization-defined frequency] thereafter; and
- When required by system changes or following [Assignement: organization-defined events];
- Employ the following techniques to increase the security and privacy awareness of system users [Assignement: awareness techniques];
- Update literacy training and awareness content [Assignement: frequency] and following [Assignement: events] ; and
- Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.
Discussion
Organizations provide basic and advanced levels of literacy training to system users, including measures to test the knowledge level of users. Organizations determine the content of literacy training and awareness based on specific organizational requirements, the systems to which personnel have authorized access, and work environments (e.g., telework). The content includes an understanding of the need for security and privacy as well as actions by users to maintain security and personal privacy and to respond to suspected incidents. The content addresses the need for operations security and the handling of personally identifiable information.
Awareness techniques include displaying posters, offering supplies inscribed with security and privacy reminders, displaying logon screen messages, generating email advisories or notices from organizational officials, and conducting awareness events. Literacy training after the initial training described in [AT-2a.1](#at-2_smt.a.1) is conducted at a minimum frequency consistent with applicable laws, directives, regulations, and policies. Subsequent literacy training may be satisfied by one or more short ad hoc sessions and include topical information on recent attack schemes, changes to organizational security and privacy policies, revised security and privacy expectations, or a subset of topics from the initial training. Updating literacy training and awareness content on a regular basis helps to ensure that the content remains relevant. Events that may precipitate an update to literacy training and awareness content include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.
Assessment Objective
- security literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;
- privacy literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;
- security literacy training is provided to system users (including managers, senior executives, and contractors) [Assignement: frequency] thereafter;
- privacy literacy training is provided to system users (including managers, senior executives, and contractors) [Assignement: frequency] thereafter;
- security literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [Assignement: events];
- privacy literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following [Assignement: events];
- [Assignement: awareness techniques] are employed to increase the security and privacy awareness of system users;
- literacy training and awareness content is updated [Assignement: frequency];
- literacy training and awareness content is updated following [Assignement: events];
- lessons learned from internal or external security incidents or breaches are incorporated into literacy training and awareness techniques.
Assessment Method
Examine
System security plan
privacy plan
literacy training and awareness policy
procedures addressing literacy training and awareness implementation
appropriate codes of federal regulations
security and privacy literacy training curriculum
security and privacy literacy training materials
training records
other relevant documents or records
Interview
Organizational personnel with responsibilities for literacy training and awareness
organizational personnel with information security and privacy responsibilities
organizational personnel comprising the general system user community
1. Ħarsa ġenerali
| Titlu |
Standard |
|
AT-02(02) [M] Insider Threat
|
Control
Provide literacy training on recognizing and reporting potential indicators of insider threat.
Discussion
Potential indicators and possible precursors of insider threat can include behaviors such as inordinate, long-term job dissatisfaction; attempts to gain access to information not required for job performance; unexplained access to financial resources; bullying or harassment of fellow employees; workplace violence; and other serious violations of policies, procedures, directives, regulations, rules, or practices. Literacy training includes how to communicate the concerns of employees and management regarding potential indicators of insider threat through channels established by the organization and in accordance with established policies and procedures. Organizations may consider tailoring insider threat awareness topics to the role. For example, training for managers may be focused on changes in the behavior of team members, while training for employees may be focused on more general observations.
Assessment Objective
- literacy training on recognizing potential indicators of insider threat is provided;
- literacy training on reporting potential indicators of insider threat is provided.
Assessment Method
Examine
System security plan
privacy plan
literacy training and awareness policy
procedures addressing literacy training and awareness implementation
literacy training and awareness curriculum
literacy training and awareness materials
other relevant documents or records
Interview
Organizational personnel who receive literacy training and awareness
organizational personnel with responsibilities for literacy training and awareness
organizational personnel with information security and privacy responsibilities
|
|
AT-02(03) [M] Social Engineering and Mining
|
Control
Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining.
Discussion
Social engineering is an attempt to trick an individual into revealing information or taking an action that can be used to breach, compromise, or otherwise adversely impact a system. Social engineering includes phishing, pretexting, impersonation, baiting, quid pro quo, thread-jacking, social media exploitation, and tailgating. Social mining is an attempt to gather information about the organization that may be used to support future attacks. Literacy training includes information on how to communicate the concerns of employees and management regarding potential and actual instances of social engineering and data mining through organizational channels based on established policies and procedures.
Assessment Objective
- literacy training on recognizing potential and actual instances of social engineering is provided;
- literacy training on reporting potential and actual instances of social engineering is provided;
- literacy training on recognizing potential and actual instances of social mining is provided;
- literacy training on reporting potential and actual instances of social mining is provided.
Assessment Method
Examine
System security plan
privacy plan
literacy training and awareness policy
procedures addressing literacy training and awareness implementation
literacy training and awareness curriculum
literacy training and awareness materials
other relevant documents or records
Interview
Organizational personnel who receive literacy training and awareness
organizational personnel with responsibilities for literacy training and awareness
organizational personnel with information security and privacy responsibilities
|
1.1 Referenzi
1.2 Rekwiżiti identifikati
1.3 Regolamenti relatati
2. Rekwiżiti identifikati
3. Regolamenti relatati
Regolamenti
| Sors |
Regolamentazzjoni |
Kwistjonijiet marbuta
|