Control: Security Awareness and Training Policy and Procedures
The organization:
(a) Develops, documents, and disseminates to [Assignment: organization-defined personnel or roles]:
(1) A security awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
(2) Procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls; and
(b) Reviews and updates the current:
(1) Security awareness and training policy [Assignment: organization-defined frequency]; and
(2) Security awareness and training procedures [Assignment: organization-defined frequency].
Supplemental Guidance
This control addresses the establishment of policy and procedures for the effective implementation of selected security controls and control enhancements in the AT family. Policy and procedures reflect applicable federal laws, Executive Orders, directives, regulations, policies, standards, and guidance. Security program policies and procedures at the organization level may make the need for system-specific policies and procedures unnecessary. The policy can be included as part of the general information security policy for organizations or conversely, can be represented by multiple policies reflecting the complex nature of certain organizations. The procedures can be established for the security program in general and for particular information systems, if needed. The organizational risk management strategy is a key factor in establishing policy and procedures.
Related control: PM-9.
References: NIST Special Publications 800-12, 800-16, 800-50, 800-100.
The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors):
(a) As part of initial training for new users;
(b) When required by information system changes; and
(c) [Assignment: organization-defined frequency] thereafter.
Supplemental Guidance
Organizations determine the appropriate content of security awareness training and security awareness techniques based on the specific organizational requirements and the information systems to which personnel have authorized access. The content includes a basic understanding of the need for information security and user actions to maintain security and to respond to suspected security incidents. The content also addresses awareness of the need for operations security. Security awareness techniques can include, for example, displaying posters, offering supplies inscribed with security reminders, generating email advisories/notices from senior organizational officials, displaying logon screen messages, and conducting information security awareness events.
Related controls: AT-3, AT-4, PL-4.
References: C.F.R. Part 5 Subpart C (5 C.F.R 930.301); Executive Order 13587; NIST Special Publication 800-50.
Status:
Implementation: Not Provided
Responsible Entitles:
3.47
Security Awareness Training
AT-2 (2)
Control: Security Awareness
The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.
Supplemental Guidance
Potential indicators and possible precursors of insider threat can include behaviors such as inordinate, long-term job dissatisfaction, attempts to gain access to information not required for job performance, unexplained access to financial resources, bullying or sexual harassment of fellow employees, workplace violence, and other serious violations of organizational policies, procedures, directives, rules, or practices. Security awareness training includes how to communicate employee and management concerns regarding potential indicators of insider threat through appropriate organizational channels in accordance with established organizational policies and procedures.
Related control: PL-4, PM-12, PS-3, PS-6.
References: C.F.R. Part 5 Subpart C (5 C.F.R 930.301); Executive Order 13587; NIST Special Publication 800-50.
Status:
Implementation: Not Provided
Responsible Entitles:
3.47
Role-Based Security Training
AT-3
Control: Security Training
The organization provides role-based security-related training:
(i) before authorizing access to the system or performing assigned duties;
(ii) when required by system changes; and
(iii) [Assignment: organization-defined frequency] thereafter.
Supplemental Guidance
The organization determines the appropriate content of security training based on assigned roles and responsibilities and the specific requirements of the organization and the information systems to which personnel have authorized access. In addition, the organization provides information system managers, system and network administrators, personnel performing independent verification and validation activities, security control assessors, and other personnel having access to system-level software, adequate security-related technical training to perform their assigned duties. Organizational security training addresses management, operational, and technical roles and responsibilities covering physical, personnel, and technical safeguards and countermeasures. The organization also provides the training necessary for these individuals to carry out their responsibilities related to operations security within the context of the organization's information security program.
Related controls: AT-2, AT-4, PL-4, PS-7, SA-3, SA-12, SA-16.
References: C.F.R. Part 5 Subpart C (5 C.F.R. 930.301); NIST Special Publications 800-16, 800-50.
Status:
Implementation: Not Provided
Responsible Entitles:
3.47
Security Training Records
AT-4
Control: Security Training Records
The organization:
(a) Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and,
(b) Retains individual training records for [Assignment: organization-defined time period].
Supplemental Guidance
Documentation for specialized training may be maintained by individual supervisors at the option of the organization.
