Assessment Objectives

In addition to relevant policies, standards and procedures, the assessor shall examine, interview, and/or test to determine if appropriately scoped evidence exists to support the claim that:

• SAT-04_A01 cybersecurity / data privacy literacy training is provided to system users (including managers, senior executives and contractors) as part of initial training for new users.
  Assessment rigor: 1
  Origin: 53A_R5_AT-02a.01[01] 53A_R5_AT-02a.01[02]
• SAT-04_A02 cybersecurity / data privacy literacy training is provided to system users (including managers, senior executives and contractors) organization-defined frequency thereafter.
  Defined parameters: at least annually
  Assessment rigor: 1
  Origin: 53A_R5_AT-02a.01[03] 53A_R5_AT-02a.01[04]
• SAT-04_A03 cybersecurity / data privacy literacy training is provided to system users (including managers, senior executives and contractors) when required by system changes or following organization-defined events.
  Assessment rigor: 2
  Origin: 53A_R5_AT-02a.02[01] 53A_R5_AT-02a.02[02]
• SAT-04_A04 security risks associated with organizational activities involving sensitive / regulated data are identified.
  Assessment rigor: 2
  Origin: 171A_3.2.1[a]
• SAT-04_A05 policies, standards and procedures related to the security of the system are identified.
  Assessment rigor: 2
  Origin: 171A_3.2.1[b]
• SAT-04_A06 managers, systems administrators and users of the system are made aware of the security risks associated with their activities.
  Assessment rigor: 2
  Origin: 171A_3.2.1[c]
• SAT-04_A07 managers, systems administrators and users of the system are made aware of the applicable policies, standards and procedures related to the security of the system.
  Assessment rigor: 2
  Origin: 171A_3.2.1[d]
• SAT-04_A08 the frequency at which to provide cybersecurity / data privacy literacy training to system users (including managers, senior executives and contractors) after initial training is defined.
  Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks
  Assessment rigor: 3
  Origin: 53A_R5_AT-02_ODP[01] 53A_R5_AT-02_ODP[02] AT-02_ODP[01]
• SAT-04_A09 events that require cybersecurity / data privacy literacy training for system users are defined.
  Assessment rigor: 3
  Origin: 53A_R5_AT-02_ODP[03] 53A_R5_AT-02_ODP[04]
• SAT-04_A10 techniques to be employed to increase the cybersecurity / data privacy awareness of system users are defined.
  Assessment rigor: 3
  Origin: 53A_R5_AT-02_ODP[05]
• SAT-04_A11 events that require security literacy training for system users are defined.
  Assessment rigor: 2
  Origin: 53A_R5_AT-02_ODP[06] 172A_3.2.1e_ODP[2] 171A_R3_A.03.02.01.ODP[03]
• SAT-04_A12 events that require security literacy training content updates are defined.
  Assessment rigor: 2
  Origin: 53A_R5_AT-02_ODP[07] 171A_R3_A.03.02.01.ODP[04]
• SAT-04_A13 awareness training is updated frequently or when there are significant changes to the threat.
  Defined parameters: at least annually
  Assessment rigor: 3
  Origin: 172A_3.2.1e[d]
• SAT-04_A14 organization-defined awareness techniques are employed to increase the cybersecurity / data privacy awareness of system users.
  Assessment rigor: 3
  Origin: 53A_R5_AT-02b.
• SAT-04_A15 literacy training and awareness content is updated organization-defined frequency.
  Defined parameters: at least every 12 months, or when there are significant incidents or significant changes to risks
  Assessment rigor: 3
  Origin: 53A_R5_AT-02c.[01]
• SAT-04_A16 literacy training and awareness content is updated following organization-defined events.
  Assessment rigor: 3
  Origin: 53A_R5_AT-02c.[02]
• SAT-04_A17 lessons learned from internal or external security incidents or breaches are incorporated into literacy training and awareness techniques.
  Assessment rigor: 3
  Origin: 53A_R5_AT-02d.

Povezane zadeve

• Secure Controls Framework -

  EN: GRCA includes the Secure Controls Framework® (SCF) content, © Secure Controls Framework Council, LLC, used under the Creative Commons Attribution-NoDerivatives 4.0 International Public License. SCF control numbers, names, descriptions and mappings appear exactly as published by the SCF Council – https://securecontrolsframework.com. GRCA may group or reorder SCF content for display, which does not change SCF content; the mappings are shown as links to the frameworks they name. Learn more at https://securecontrolsframework.com.

  DE: GRCA enthält Inhalte des Secure Controls Framework® (SCF), © Secure Controls Framework Council, LLC, genutzt unter der Creative Commons Attribution-NoDerivatives 4.0 International Public License. Nummern, Namen, Beschreibungen und Zuordnungen der SCF-Controls erscheinen genau so, wie der SCF Council sie veröffentlicht – https://securecontrolsframework.com. GRCA gruppiert oder sortiert SCF-Inhalte für die Anzeige, ohne sie zu verändern; die Zuordnungen erscheinen als Verknüpfungen zu den genannten Regelwerken. Mehr unter https://securecontrolsframework.com.