Assessment Objective
Determine if:
- security literacy training is provided to system users as part of initial training for new users.
- security literacy training is provided to system users [Assignment: frequency] after initial training.
- security literacy training is provided to system users when required by system changes or following [Assignment: events].
- security literacy training is provided to system users on recognizing indicators of insider threat.
- security literacy training is provided to system users on reporting indicators of insider threat.
- security literacy training is provided to system users on recognizing indicators of social engineering.
- security literacy training is provided to system users on reporting indicators of social engineering.
- security literacy training is provided to system users on recognizing indicators of social mining.
- security literacy training is provided to system users on reporting indicators of social mining.
- security literacy training content is updated [Assignment: frequency].
- security literacy training content is updated following [Assignment: events].
Assessment Methods
Examine
- security literacy training and awareness policy and procedures
- procedures for security literacy training and awareness implementation
- codes of federal regulations
- security literacy and awareness training curriculum
- security literacy and awareness training materials
- training records
- system security plan
- other relevant documents or records
Interview
- personnel with responsibilities for security literacy training and awareness
- personnel comprising the general system user community
- personnel with information security responsibilities
Test
- mechanisms for managing information security literacy training and awareness
Gekoppelde issues
| Koppelingstype | Issue |
|---|---|
| blocks | 03.02.01 Literacy Training and Awareness |