Assessment Objective

Determine if:

• role-based security training is provided to organizational personnel before authorizing access to the system or CUI.
• role-based security training is provided to organizational personnel before performing assigned duties.
• role-based security training is provided to organizational personnel [Assignment: frequency] after initial training.
• role-based security training is provided to organizational personnel when required by system changes or following [Assignment: events].
• role-based security training content is updated [Assignment: frequency].
• role-based security training content is updated following [Assignment: events].

Assessment Methods

Examine

• security awareness and training policy and procedures
• procedures for security training implementation
• codes of federal regulations
• security training curriculum
• security training materials
• training records
• system security plan
• other relevant documents or records

Interview

• personnel with responsibilities for role-based security training
• personnel with assigned system security roles and responsibilities

Test

• mechanisms for managing role-based security training and awareness

Gekoppelde issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final