CCI-003441

The organization implements a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures.

Implementation Guidance

If the organization being inspected/assessed identifies IAW AR-5, CCI 3440 that IASE provided PII training meets the needs of the organization then the organization is automatically compliant. Otherwise, the organization being inspected/assessed documents and implements a comprehensive training and awareness strategy aimed at ensuring that personnel understand privacy responsibilities and procedures.

Validation Procedures

The organization conducting the inspection/assessment obtains and examines the documented results of the review conducted IAW AR-5, CCI 3440. If the review indicates that IASE provided PII training meets the needs of the organization then the organization is automatically compliant. Otherwise, the organization conducting the inspection/assessment obtains and examines the documented training and awareness strategy to ensure that it implements training aimed at ensuring that personnel understand privacy responsibilities and procedures.

Compelling Evidence

Reference section of documentation that pertains to IAW AR-5, CCI 3340 and that IASE PII training meets the needs of the organization. Observe that If extra training is required the organization needs to define and document the unique privacy needs which must be addressed by training.

The controls below (if any) were marked by NIST as being related to CCI-003441.