AT – Awareness and Training

NIST SP 800-53B – AT – Awareness and Training

1.Kravtext (engelskt original)#

AT-1 – Policy and Procedures#

• a. Develop, document, and disseminate to [organization-defined personnel or roles]:
  • 1. [organization-level or mission/business process-level or system-level] awareness and training policy that:
    • (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
    • (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
  • 2. Procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls;
• b. Designate an [organization-defined official] to manage the development, documentation, and dissemination of the awareness and training policy and procedures; and
• c. Review and update the current awareness and training:
  • 1. Policy [organization-defined frequency] and following [organization-defined events] ; and
  • 2. Procedures [organization-defined frequency] and following [organization-defined events].

AT-2 – Literacy Training and Awareness#

• a. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors):
  • 1. As part of initial training for new users and [organization-defined frequency] thereafter; and
  • 2. When required by system changes or following [organization-defined events];
• b. Employ the following techniques to increase the security and privacy awareness of system users [organization-defined awareness techniques];
• c. Update literacy training and awareness content [organization-defined frequency] and following [organization-defined events] ; and
• d. Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.

AT-2(2) – Insider Threat

Provide literacy training on recognizing and reporting potential indicators of insider threat.

AT-2(3) – Social Engineering and Mining

Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining.

AT-3 – Role-based Training#

• a. Provide role-based security and privacy training to personnel with the following roles and responsibilities: [organization-defined roles and responsibilities]:
  • 1. Before authorizing access to the system, information, or performing assigned duties, and [organization-defined frequency] thereafter; and
  • 2. When required by system changes;
• b. Update role-based training content [organization-defined frequency] and following [organization-defined events] ; and
• c. Incorporate lessons learned from internal or external security incidents or breaches into role-based training.

AT-4 – Training Records#

• a. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and
• b. Retain individual training records for [organization-defined time period].

National Institute of Standards and Technology, OSCAL release 5.2.0. Republished courtesy of the National Institute of Standards and Technology. CC0 1.0. Source.