Assessment Objective

Determine if:

• AT-03a.
  • AT-03a.01
    • AT-03a.01[01] role-based security training is provided to [Assignment: roles and responsibilities] before authorizing access to the system, information, or performing assigned duties;
    • AT-03a.01[02] role-based privacy training is provided to [Assignment: roles and responsibilities] before authorizing access to the system, information, or performing assigned duties;
    • AT-03a.01[03] role-based security training is provided to [Assignment: roles and responsibilities] [Assignment: frequency] thereafter;
    • AT-03a.01[04] role-based privacy training is provided to [Assignment: roles and responsibilities] [Assignment: frequency] thereafter;
  • AT-03a.02
    • AT-03a.02[01] role-based security training is provided to personnel with assigned security roles and responsibilities when required by system changes;
    • AT-03a.02[02] role-based privacy training is provided to personnel with assigned security roles and responsibilities when required by system changes;
• AT-03b.
  • AT-03b.[01] role-based training content is updated [Assignment: frequency];
  • AT-03b.[02] role-based training content is updated following [Assignment: events];
• AT-03c. lessons learned from internal or external security incidents or breaches are incorporated into role-based training.

Assessment Methods

Examine

• System security plan
• privacy plan
• security and privacy awareness and training policy
• procedures addressing security and privacy training implementation
• codes of federal regulations
• security and privacy training curriculum
• security and privacy training materials
• training records
• other relevant documents or records

Interview

• Organizational personnel with responsibilities for role-based security and privacy training
• organizational personnel with assigned system security and privacy roles and responsibilities

Test

• Mechanisms managing role-based security and privacy training

Gekoppelde issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final