Navigate

IR-9(2)

IR-9(2): Training

Provide information spillage response training [frequency at which to provide information spillage response training is defined;].

Supplemental

Organizations establish requirements for responding to information spillage incidents in incident response plans. Incident response training on a regular basis helps to ensure that organizational personnel understand their individual responsibilities and what specific actions to take when spillage incidents occur.

CIA Levels
Confidentiality	low
Integrity	unknown
Availability	unknown

Overlays
Classified, Int-A, Int-B, Int-C

CSF Categories
None

Related Controls

The controls below (if any) were marked by NIST as being related to IR-9(2).

Control	Description
AT-2	a: Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): 1: As part of initial training for new users and [one of ] thereafter; and 2: When required by system changes or following [one of ]; b: Employ the following techniques to increase the security and privacy awareness of system users [techniques to be employed to increase the security and privacy awareness of system users are defined;]; c: Update literacy training and awareness content [the frequency at which to update literacy training and awareness content is defined;] and following [events that would require literacy training and awareness content to be updated are defined;] ; and d: Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.
AT-3	a: Provide role-based security and privacy training to personnel with the following roles and responsibilities: [one of ]: 1: Before authorizing access to the system, information, or performing assigned duties, and [the frequency at which to provide role-based security and privacy training to assigned personnel after initial training is defined;] thereafter; and 2: When required by system changes; b: Update role-based training content [the frequency at which to update role-based training content is defined;] and following [events that require role-based training content to be updated are defined;] ; and c: Incorporate lessons learned from internal or external security incidents or breaches into role-based training.
CP-3	a: Provide contingency training to system users consistent with assigned roles and responsibilities: 1: Within [the time period within which to provide contingency training after assuming a contingency role or responsibility is defined;] of assuming a contingency role or responsibility; 2: When required by system changes; and 3: [frequency at which to provide training to system users with a contingency role or responsibility is defined;] thereafter; and b: Review and update contingency training content [frequency at which to review and update contingency training content is defined;] and following [events necessitating review and update of contingency training are defined;].
IR-2	a: Provide incident response training to system users consistent with assigned roles and responsibilities: 1: Within [a time period within which incident response training is to be provided to system users assuming an incident response role or responsibility is defined;] of assuming an incident response role or responsibility or acquiring system access; 2: When required by system changes; and 3: [frequency at which to provide incident response training to users is defined;] thereafter; and b: Review and update incident response training content [frequency at which to review and update incident response training content is defined;] and following [events that initiate a review of the incident response training content are defined;].

Enhancements

The controls below (if any) add on to the requirements of IR-9(2).

Control	Description
No controls

Related CCIs

The CCIs below are tied to IR-9(2).

CCI	Definition
CCI-002816	Provide information spillage response training according to an organization-defined frequency.
CCI-002817	Defines the frequency with which to provide information spillage response training.