PR.AT-01: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind

Threats Addressed:

Previous Version:

Info icon.

Incorporates the following subcategorys from the previous version of the framework: PR.AT-1: All users are informed and trained, PR.AT-3: Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities, RS.CO-1: Personnel know their roles and order of operations when a response is needed.

Description

[csf.tools Note: Subcategories do not have detailed descriptions. However NIST has provided the following implementation examples.]

Implementation Examples

1st: 1st Party Risk

Ex1: Provide basic cybersecurity awareness and training to employees, contractors, partners, suppliers, and all other users of the organization's non-public resources

Ex2: Train personnel to recognize social engineering attempts and other common attacks, report attacks and suspicious activity, comply with acceptable use policies, and perform basic cyber hygiene tasks (e.g., patching software, choosing passwords, protecting credentials)

Ex3: Explain the consequences of cybersecurity policy violations, both to individual users and the organization as a whole

Ex4: Periodically assess or test users on their understanding of basic cybersecurity practices

Ex5: Require annual refreshers to reinforce existing practices and introduce new practices

Related Controls

NIST Special Publication 800-53 Revision 5.2.0

AT-2: Literacy Training and Awareness

Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): As part of initial training for new users and [Assignment: organization-defined frequency] thereafter; and When required by system changes or following [Assignment: organization-defined events]; Employ the following techniques to increase the security and privacy awareness of system users [Assignment: organization-defined…

AT-3: Role-based Training

Provide role-based security and privacy training to personnel with the following roles and responsibilities: [Assignment: organization-defined roles and responsibilities]: Before authorizing access to the system, information, or performing assigned duties, and [Assignment: organization-defined frequency] thereafter; and When required by system changes; Update role-based training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events] ; and…

NIST SP 800-171 Revision 3.0

03.02.02: Role-Based Training

Provide role-based security training to organizational personnel: Before authorizing access to the system or CUI, before performing assigned duties, and [Assignment: organization-defined frequency] thereafter When required by system changes or following [Assignment: organization-defined events]. Update role-based training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].

Cloud Controls Matrix v4.0

HRS-11: Security Awareness Training

Establish, document, approve, communicate, apply, evaluate and maintain a security awareness training program for all employees of the organization and provide regular training updates.

HRS-12: Personal and Sensitive Data Awareness and Training

Provide all employees with access to sensitive organizational and personal data with appropriate security awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization.

HRS-13: Compliance User Responsibility

Make employees aware of their roles and responsibilities for maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations.

SEF-02: Service Management Policy and Procedures

Establish, document, approve, communicate, apply, evaluate and maintain policies and procedures for the timely management of security incidents. Review and update the policies and procedures at least annually.

SEF-03: Incident Response Plans

Establish, document, approve, communicate, apply, evaluate and maintain a security incident response plan, which includes but is not limited to: relevant internal departments, impacted CSCs, and other business critical relationships (such as supply-chain) that may be impacted.

UEM-14: Third-Party Endpoint Security Posture

Define, implement and evaluate processes, procedures and technical and/or contractual measures to maintain proper security of third-party endpoints with access to organizational assets.

Critical Security Controls Version 8.1

14.1: Establish and Maintain a Security Awareness Program

Establish and maintain a security awareness program. The purpose of a security awareness program is to educate the enterprise's workforce on how to interact with enterprise assets and data in a secure manner. Conduct training at hire and, at a minimum, annually. Review and update content annually, or when significant enterprise changes occur that could impact this Safeguard.