Assessment Objective

Determine if:

• AT-02(03)[01] literacy training on recognizing potential and actual instances of social engineering is provided;
• AT-02(03)[02] literacy training on reporting potential and actual instances of social engineering is provided;
• AT-02(03)[03] literacy training on recognizing potential and actual instances of social mining is provided;
• AT-02(03)[04] literacy training on reporting potential and actual instances of social mining is provided.

Assessment Methods

Examine

• System security plan
• privacy plan
• literacy training and awareness policy
• procedures addressing literacy training and awareness implementation
• literacy training and awareness curriculum
• literacy training and awareness materials
• other relevant documents or records

Interview

• Organizational personnel who receive literacy training and awareness
• organizational personnel with responsibilities for literacy training and awareness
• organizational personnel with information security and privacy responsibilities

Powiązane zgłoszenia

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final