PR.AT-02: Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind

Previous Version:

Info icon.

Incorporates the following subcategorys from the previous version of the framework: PR.AT-2: Privileged users understand their roles and responsibilities, PR.AT-3: Third-party stakeholders (e.g., suppliers, customers, partners) understand their roles and responsibilities, PR.AT-4: Senior executives understand their roles and responsibilities, PR.AT-5: Physical and cybersecurity personnel understand their roles and responsibilities.

Description

[csf.tools Note: Subcategories do not have detailed descriptions. However NIST has provided the following implementation examples.]

Implementation Examples

1st: 1st Party Risk

3rd: 3rd Party Risk

Ex1: Identify the specialized roles within the organization that require additional cybersecurity training, such as physical and cybersecurity personnel, finance personnel, senior leadership, and anyone with access to business-critical data

Ex2: Provide role-based cybersecurity awareness and training to all those in specialized roles, including contractors, partners, suppliers, and other third parties

Ex3: Periodically assess or test users on their understanding of cybersecurity practices for their specialized roles

Ex4: Require annual refreshers to reinforce existing practices and introduce new practices

Related Controls

NIST Special Publication 800-53 Revision 5.2.0

AT-3: Role-based Training

Provide role-based security and privacy training to personnel with the following roles and responsibilities: [Assignment: organization-defined roles and responsibilities]: Before authorizing access to the system, information, or performing assigned duties, and [Assignment: organization-defined frequency] thereafter; and When required by system changes; Update role-based training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events] ; and…

NIST SP 800-171 Revision 3.0

03.02.02: Role-Based Training

Provide role-based security training to organizational personnel: Before authorizing access to the system or CUI, before performing assigned duties, and [Assignment: organization-defined frequency] thereafter When required by system changes or following [Assignment: organization-defined events]. Update role-based training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events].

Cloud Controls Matrix v4.0

HRS-12: Personal and Sensitive Data Awareness and Training

Provide all employees with access to sensitive organizational and personal data with appropriate security awareness training and regular updates in organizational procedures, processes, and policies relating to their professional function relative to the organization.

HRS-13: Compliance User Responsibility

Make employees aware of their roles and responsibilities for maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations.

SEF-03: Incident Response Plans

Establish, document, approve, communicate, apply, evaluate and maintain a security incident response plan, which includes but is not limited to: relevant internal departments, impacted CSCs, and other business critical relationships (such as supply-chain) that may be impacted.

UEM-14: Third-Party Endpoint Security Posture

Define, implement and evaluate processes, procedures and technical and/or contractual measures to maintain proper security of third-party endpoints with access to organizational assets.

Critical Security Controls Version 8.1

14.9: Conduct Role-Specific Security Awareness and Skills Training

Conduct role-specific security awareness and skills training. Example implementations include secure system administration courses for IT professionals, OWASP® Top 10 vulnerability awareness and prevention training for web application developers, and advanced social engineering awareness training for high-profile roles.