PR.AT-1: All users are informed and trained
PF v1.0 References:
Threats Addressed:
Next Version:
Description
[csf.tools Note: Subcategories do not have detailed descriptions.]
Related Controls
NIST Special Publication 800-53 Revision 5.2.0
AT-2: Literacy Training and Awareness
Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): As part of initial training for new users and [Assignment: organization-defined frequency] thereafter; and When required by system changes or following [Assignment: organization-defined events]; Employ the following techniques to increase the security and privacy awareness of system users [Assignment: organization-defined…
PM-13: Security and Privacy Workforce
Establish a security and privacy workforce development and improvement program.
PM-14: Testing, Training, and Monitoring
Implement a process for ensuring that organizational plans for conducting security and privacy testing, training, and monitoring activities associated with organizational systems: Are developed and maintained; and Continue to be executed; and Review testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.
NIST SP 800-171 Revision 3.0
03.02.01: Literacy Training and Awareness
Provide security literacy training to system users: As part of initial training for new users and [Assignment: organization-defined frequency] thereafter, When required by system changes or following [Assignment: organization-defined events], and On recognizing and reporting indicators of insider threat, social engineering, and social mining. Update security literacy training content [Assignment: organization-defined frequency] and following [Assignment:…
Cloud Controls Matrix v4.0
DCS-11: Unauthorized Access Response Training
Train datacenter personnel to respond to unauthorized ingress or egress attempts.
HRS-08: Employment Agreement Content
The organization includes within the employment agreements provisions and/or terms for adherence to established information governance and security policies.
HRS-09: Personnel Roles and Responsibilities
Document and communicate roles and responsibilities of employees, as they relate to information assets and security.
HRS-11: Security Awareness Training
Establish, document, approve, communicate, apply, evaluate and maintain a security awareness training program for all employees of the organization and provide regular training updates.
HRS-12: Personal and Sensitive Data Awareness and Training
Provide all employees with access to sensitive organizational and personal data with appropriate security awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization.
HRS-13: Compliance User Responsibility
Make employees aware of their roles and responsibilities for maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations.
Critical Security Controls Version 8.1
14: Security Awareness and Skills Training
Establish and maintain a security awareness program to influence behavior among the workforce to be security conscious and properly skilled to reduce cybersecurity risks to the enterprise.
14.1: Establish and Maintain a Security Awareness Program
Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise's workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard.
14.2: Train Workforce Members to Recognize Social Engineering Attacks
Train workforce members to recognize social engineering attacks, such as phishing, pre-texting, and tailgating.
14.3: Train Workforce Members on Authentication Best Practices
Train workforce members on authentication best practices. Example topics include MFA, password composition, and credential management.
14.4: Train Workforce on Data Handling Best Practices
Train workforce members on how to identify and properly store, transfer, archive, and destroy sensitive data. This also includes training workforce members on clear screen and desk best practices, such as locking their screen when they step away from their enterprise asset, erasing physical and virtual whiteboards at the end of meetings, and storing data and assets securely.
14.5: Train Workforce Members on Causes of Unintentional Data Exposure
Train workforce members to be aware of causes for unintentional data exposure. Example topics include mis-delivery of sensitive data, losing a portable end-user device, or publishing data to unintended audiences.
14.6: Train Workforce Members on Recognizing and Reporting Security Incidents
Train workforce members to be able to recognize a potential incident and be able to report such an incident.
14.7: Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates
Train workforce to understand how to verify and report out-of-date software patches or any failures in automated processes and tools. Part of this training should include notifying IT personnel of any failures in automated processes and tools.
14.8: Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks
Train workforce members on the dangers of connecting to, and transmitting data over, insecure networks for enterprise activities. If the enterprise has remote workers, training must include guidance to ensure that all users securely configure their home network infrastructure.
14.9: Conduct Role-Specific Security Awareness and Skills Training
Conduct role-specific security awareness and skills training. Example implementations include secure system administration courses for IT professionals, OWASP® Top 10 vulnerability awareness and prevention training for web application developers, and advanced social engineering awareness training for high-profile roles.
16: Application Software Security
Manage the security life cycle of in-house developed, hosted, or acquired software to prevent, detect, and remediate security weaknesses before they can impact the enterprise.
16.9: Train Developers in Application Security Concepts and Secure Coding
Ensure that all software development personnel receive training in writing secure code for their specific development environment and responsibilities. Training can include general security principles and application security standard practices. Conduct training at least annually and design in a way to promote security within the development team, and build a culture of security among the developers.
17: Incident Response Management
Establish a program to develop and maintain an incident response capability (e.g., policies, plans, procedures, defined roles, training, and communications) to prepare, detect, and quickly respond to an attack.
17.3: Establish and Maintain an Enterprise Process for Reporting Incidents
Establish and maintain an enterprise process for the workforce to report security incidents. The process includes reporting timeframe, personnel to report to, mechanism for reporting, and the minimum information to be reported. Ensure the process is publicly available to all of the workforce. Review annually, or when significant enterprise changes occur that could impact this Safeguard.
NIST Special Publication 800-53 Revision 4
AT-2: Security Awareness Training
The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors): As part of initial training for new users; When required by information system changes; and [Assignment: organization-defined frequency] thereafter.
PM-13: Information Security Workforce
The organization establishes an information security workforce development and improvement program.
NIST Special Publication 800-171 Revision 2
3.2.1: Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems
Organizations determine the content and frequency of security awareness training and security awareness techniques based on the specific organizational requirements and the systems to which personnel have authorized access. The content includes a basic understanding of the need for information security and user actions to maintain security and to respond to suspected security incidents. The…
3.2.2: Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities
Organizations determine the content and frequency of security training based on the assigned duties, roles, and responsibilities of individuals and the security requirements of organizations and the systems to which personnel have authorized access. In addition, organizations provide system developers, enterprise architects, security architects, acquisition/procurement officials, software developers, system developers, systems integrators, system/network administrators, personnel…
3.2.3: Provide security awareness training on recognizing and reporting potential indicators of insider threat
Potential indicators and possible precursors of insider threat include behaviors such as: inordinate, long-term job dissatisfaction; attempts to gain access to information that is not required for job performance; unexplained access to financial resources; bullying or sexual harassment of fellow employees; workplace violence; and other serious violations of the policies, procedures, directives, rules, or practices…
Cloud Controls Matrix v3.0.1
HRS-09: Training / Awareness
A security awareness training program shall be established for all contractors, third-party users, and employees of the organization and mandated when appropriate. All individuals with access to organizational data shall receive appropriate awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization.
HRS-10: User Responsibility
All personnel shall be made aware of their roles and responsibilities for: Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations. Maintaining a safe and secure working environment
MOS-01: Anti-Malware
Anti-malware awareness training, specific to mobile devices, shall be included in the provider’s information security awareness training.
MOS-05: Awareness and Training
The provider shall have a documented mobile device policy that includes a documented definition for mobile devices and the acceptable usage and requirements for all mobile devices. The provider shall post and communicate the policy and requirements through the company’s security awareness and training program.
Critical Security Controls Version 7.1
17: Implement a Security Awareness and Training Program
For all functional roles in the organization (prioritizing those mission-critical to the business and its security), identify the specific knowledge, skills, and abilities needed to support defense of the enterprise; develop and execute an integrated plan to assess, identify gaps, and remediate through policy, organizational planning, training, and awareness programs.
17.2: Deliver Training to Fill the Skills Gap
Deliver training to address the skills gap identified to positively impact workforce members' security behavior.
17.3: Implement a Security Awareness Program
Create a security awareness program for all workforce members to complete on a regular basis to ensure they understand and exhibit the necessary behaviors and skills to help ensure the security of the organization. The organization's security awareness program should be communicated in a continuous and engaging manner.
17.4: Update Awareness Content Frequently
Ensure that the organization's security awareness program is updated frequently (at least annually) to address new technologies, threats, standards, and business requirements.
17.5: Train Workforce on Secure Authentication
Train workforce members on the importance of enabling and utilizing secure authentication.
17.6: Train Workforce on Identifying Social Engineering Attacks
Train the workforce on how to identify different forms of social engineering attacks, such as phishing, phone scams, and impersonation calls.
17.7: Train Workforce on Sensitive Data Handling
Train workforce members on how to identify and properly store, transfer, archive, and destroy sensitive information.
17.8: Train Workforce on Causes of Unintentional Data Exposure
Train workforce members to be aware of causes for unintentional data exposures, such as losing their mobile devices or emailing the wrong person due to autocomplete in email.
17.9: Train Workforce Members on Identifying and Reporting Incidents
Train workforce members to be able to identify the most common indicators of an incident and be able to report such an incident.
18: Application Software Security
Manage the security life cycle of all in-house developed and acquired software in order to prevent, detect, and correct security weaknesses.
18.6: Ensure Software Development Personnel are Trained in Secure Coding
Ensure that all software development personnel receive training in writing secure code for their specific development environment and responsibilities.