AT – Awareness and Training

NIST SP 800-53 Rev. 5 – AT – Awareness and Training

1.Kravtext (engelskt original)#

AT-1 – Policy and Procedures#

• a. Develop, document, and disseminate to [organization-defined personnel or roles]:
  • 1. [organization-level or mission/business process-level or system-level] awareness and training policy that:
    • (a) Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
    • (b) Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and
  • 2. Procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls;
• b. Designate an [organization-defined official] to manage the development, documentation, and dissemination of the awareness and training policy and procedures; and
• c. Review and update the current awareness and training:
  • 1. Policy [organization-defined frequency] and following [organization-defined events] ; and
  • 2. Procedures [organization-defined frequency] and following [organization-defined events].

AT-2 – Literacy Training and Awareness#

• a. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors):
  • 1. As part of initial training for new users and [organization-defined frequency] thereafter; and
  • 2. When required by system changes or following [organization-defined events];
• b. Employ the following techniques to increase the security and privacy awareness of system users [organization-defined awareness techniques];
• c. Update literacy training and awareness content [organization-defined frequency] and following [organization-defined events] ; and
• d. Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.

AT-2(1) – Practical Exercises

Provide practical exercises in literacy training that simulate events and incidents.

AT-2(2) – Insider Threat

Provide literacy training on recognizing and reporting potential indicators of insider threat.

AT-2(3) – Social Engineering and Mining

Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining.

AT-2(4) – Suspicious Communications and Anomalous System Behavior

Provide literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using [organization-defined indicators of malicious code].

AT-2(5) – Advanced Persistent Threat

Provide literacy training on the advanced persistent threat.

AT-2(6) – Cyber Threat Environment

• (a) Provide literacy training on the cyber threat environment; and
• (b) Reflect current cyber threat information in system operations.

AT-3 – Role-based Training#

• a. Provide role-based security and privacy training to personnel with the following roles and responsibilities: [organization-defined roles and responsibilities]:
  • 1. Before authorizing access to the system, information, or performing assigned duties, and [organization-defined frequency] thereafter; and
  • 2. When required by system changes;
• b. Update role-based training content [organization-defined frequency] and following [organization-defined events] ; and
• c. Incorporate lessons learned from internal or external security incidents or breaches into role-based training.

AT-3(1) – Environmental Controls

Provide [organization-defined personnel or roles] with initial and [organization-defined frequency] training in the employment and operation of environmental controls.

AT-3(2) – Physical Security Controls

Provide [organization-defined personnel or roles] with initial and [organization-defined frequency] training in the employment and operation of physical security controls.

AT-3(3) – Practical Exercises

Provide practical exercises in security and privacy training that reinforce training objectives.

AT-3(4) – Suspicious Communications and Anomalous System Behavior

AT-3(5) – Processing Personally Identifiable Information

Provide [organization-defined personnel or roles] with initial and [organization-defined frequency] training in the employment and operation of personally identifiable information processing and transparency controls.

AT-4 – Training Records#

• a. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and
• b. Retain individual training records for [organization-defined time period].

AT-5 – Contacts with Security Groups and Associations#

AT-6 – Training Feedback#

Provide feedback on organizational training results to the following personnel [organization-defined frequency]: [organization-defined personnel].

National Institute of Standards and Technology, OSCAL release 5.2.0. Republished courtesy of the National Institute of Standards and Technology. CC0 1.0. Source.