Navigate

CCI-003767

CCI-003767 Definition

Employ organization-defined awareness techniques to increase the security awareness of system users.

Status
Type	CheckType.policy

Master Assessment Datasheet

Implementation Guidance

Determine if [AT-02_ODP[05]; techniques to be employed to increase the security and privacy awareness of system users are defined] are employed to increase the security and privacy awareness of system users.

Validation Procedures

Examine: [SELECT FROM: System security plan; privacy plan; awareness and training policy and procedures; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel with awareness and training responsibilities; organizational personnel with information security and privacy responsibilities].

Related Controls

The controls below (if any) were marked by NIST as being related to CCI-003767.

Control	Description
AT-2	a: Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): 1: As part of initial training for new users and [one of ] thereafter; and 2: When required by system changes or following [one of ]; b: Employ the following techniques to increase the security and privacy awareness of system users [techniques to be employed to increase the security and privacy awareness of system users are defined;]; c: Update literacy training and awareness content [the frequency at which to update literacy training and awareness content is defined;] and following [events that would require literacy training and awareness content to be updated are defined;] ; and d: Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.

Control

Description

AT-2

a: Provide security and privacy literacy training to system users (including managers, senior executives, and contractors):
- 1: As part of initial training for new users and [one of ] thereafter; and
- 2: When required by system changes or following [one of ];

b: Employ the following techniques to increase the security and privacy awareness of system users [techniques to be employed to increase the security and privacy awareness of system users are defined;];

c: Update literacy training and awareness content [the frequency at which to update literacy training and awareness content is defined;] and following [events that would require literacy training and awareness content to be updated are defined;] ; and

d: Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.