AT-2(3): Social Engineering and Mining

Control Family:

Awareness and Training

CSF v1.1 References:


  • Moderate
  • High
Info icon.

Control is new to this version of the control set.

Control Statement

Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining.

Supplemental Guidance

Social engineering is an attempt to trick an individual into revealing information or taking an action that can be used to breach, compromise, or otherwise adversely impact a system. Social engineering includes phishing, pretexting, impersonation, baiting, quid pro quo, thread-jacking, social media exploitation, and tailgating. Social mining is an attempt to gather information about the organization that may be used to support future attacks. Literacy training includes information on how to communicate the concerns of employees and management regarding potential and actual instances of social engineering and data mining through organizational channels based on established policies and procedures.