03.02: Awareness and Training
Controls
03.02.01: Literacy Training and Awareness
Provide security literacy training to system users: As part of initial training for new users and [Assignment: organization-defined frequency] thereafter, When required by system changes or following [Assignment: organization-defined events], and On recognizing and reporting indicators of insider threat, social engineering, and social mining. Update security literacy training content [Assignment: organization-defined frequency] and following [Assignment:…
03.02.02: Role-Based Training
Provide role-based security training to organizational personnel: Before authorizing access to the system or CUI, before performing assigned duties, and [Assignment: organization-defined frequency] thereafter When required by system changes or following [Assignment: organization-defined events]. Update role-based training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].