Navigate

CCI-000103

CCI-000103 Definition

Develop and document procedures to facilitate the implementation of the awareness and training policy and associated awareness and training controls.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if: - awareness and training procedures to facilitate the implementation of the awareness and training policy and associated access controls are developed and documented. - the awareness and training procedures are disseminated to [AT-01_ODP[02]; personnel or roles to whom the awareness and training procedures are to be disseminated is/are defined].

Validation Procedures

Examine: [SELECT FROM: System security plan; privacy plan; awareness and training policy and procedures; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with awareness and training responsibilities; organizational personnel with information security and privacy responsibilities].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-000103.

Control	Description
AT-1	a: Develop, document, and disseminate to [one of ]: 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] awareness and training policy that: (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and 2: Procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls; b: Designate an [an official to manage the awareness and training policy and procedures is defined;] to manage the development, documentation, and dissemination of the awareness and training policy and procedures; and c: Review and update the current awareness and training: 1: Policy [the frequency at which the current awareness and training policy is reviewed and updated is defined;] and following [events that would require the current awareness and training policy to be reviewed and updated are defined;] ; and 2: Procedures [the frequency at which the current awareness and training procedures are reviewed and updated is defined;] and following [events that would require procedures to be reviewed and updated are defined;].

Control

Description

AT-1

a: Develop, document, and disseminate to [one of ]:
- 1: [one or more of "organization-level"/"mission/business process-level"/"system-level"] awareness and training policy that:
  - (a): Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
  - (b): Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
- 2: Procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls;

b: Designate an [an official to manage the awareness and training policy and procedures is defined;] to manage the development, documentation, and dissemination of the awareness and training policy and procedures; and

c: Review and update the current awareness and training:
- 1: Policy [the frequency at which the current awareness and training policy is reviewed and updated is defined;] and following [events that would require the current awareness and training policy to be reviewed and updated are defined;] ; and
- 2: Procedures [the frequency at which the current awareness and training procedures are reviewed and updated is defined;] and following [events that would require procedures to be reviewed and updated are defined;].