CMMC Practice Number: AT.L2-3.2.1
CMMC Level: 2 CMMC Domain: Awareness and Training (AT)
Practice Summary:
Ensure that managers, system administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
Contents:
CMMC Practice Implementation |
Assessment Objectives
Determine if:
[a] security risks associated with organizational activities involving CUI are identified;
[b] policies, standards, and procedures related to the security of the system are identified;
[c] managers, systems administrators, and users of the system are made aware of the security risks associated with their activities; and
[d] managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system.
Practice Clarification (DOD, CMU)
Awareness training focuses user attention on security. Several techniques can be used, such as:
• instructor or online training;
• simulations (e.g., simulated phishing emails);
• security awareness campaigns (posters, reminders, group discussions); and
• communicating regular email advisories and notices to employees.
Awareness training and role-based training are different. This practice, AT.L2-3.2.1, covers awareness training, which provides general security training to influence user behavior. This training can apply broadly or be tailored to a specific role. Role-based training focuses on the knowledge, skills, and abilities needed to complete a specific job and is covered by AT.L2-3.2.2.
Example
You want to provide information to employees so they can identify phishing emails. To do this, you prepare a presentation that highlights basic traits, including:
• suspicious-looking email address or domain name,
• a message that contains an attachment or URL, and
• a message that is poorly written and often contains obvious misspelled words.
You encourage everyone to not click on attachments or links in a suspicious email [c]. You tell employees to forward such a message immediately to IT security [d]. You download free security awareness posters to hang in the office [c,d]. You send regular emails and tips to all employees to ensure your message is not forgotten over time [c,d].
Potential Assessment Considerations
• Do all users, managers, and system administrators receive initial and refresher training commensurate with their roles and responsibilities [c,d]?19
• Do training materials identify the organizationally defined security requirements that must be met by users while interacting with the system as described in written policies, standards, and procedures [d]?
Where To Look
- Security awareness and training policy;
- procedures addressing security awareness training implementation;
- relevant codes of federal regulations;
- security awareness training curriculum;
- security awareness training materials;
- system security plan;
- training records;
- other relevant documents or records.
Who To Talk To
- Personnel with responsibilities for security awareness training;
- personnel with information security responsibilities;
- personnel composing the general system user community;
- personnel with responsibilities for role-based awareness training.
Perform Test On
- Mechanisms managing security awareness training;
- mechanisms managing role-based security training.
Additional Information
Companies determine the appropriate content of security awareness training and security awareness techniques based on the specific company requirements and the information systems to which employees have authorized access. The content includes a basic understanding of the need for information security and user actions to maintain security and to respond to suspected security incidents. The content also addresses awareness of the need for operations security. Security awareness techniques can include, for example, displaying posters, offering supplies inscribed with security reminders, generating email advisories/notices from senior company officials, displaying logon screen messages, and conducting information security awareness events.
CMMC Practice Background and References (DOD, CMU) |
Practice Discussion:
DISCUSSION FROM SOURCE: DRAFT NIST SP 800-171 R2
Organizations determine the content and frequency of security awareness training and security awareness techniques based on the specific organizational requirements and the systems to which personnel have authorized access. The content includes a basic understanding of the need for information security and user actions to maintain security and to respond to suspected security incidents. The content also addresses awareness of the need for operations security. Security awareness techniques include: formal training; offering supplies inscribed with security reminders; generating email advisories or notices from organizational officials; displaying logon screen messages; displaying security awareness posters; and conducting information security awareness events.
NIST SP 800-50 provides guidance on security awareness and training programs
CMMC References:
· NIST SP 800-171 Rev 1 3.2.1
· CIS Controls v7.1 17.3
· NIST CSF v1.1 PR.AT-1, PR.AT-2, PR.AT-3, PR.AT-4, PR.AT-5
· CERT RMM v1.2 OTA:SG1.SP1
· NIST SP 800-53 Rev 4 AT-2, AT-3