regelverk.org

03.02 – Awareness and Training

NIST SP 800-171 Rev. 3 – 03.02 – Awareness and Training

1.Kravtext (engelskt original)#

03.02.01 – Literacy Training and Awareness#

  • SR-03.02.01.a Provide security literacy training to system users:
    • SR-03.02.01.a.01 As part of initial training for new users and [organization-defined frequency] thereafter,
    • SR-03.02.01.a.02 When required by system changes or following [organization-defined events], and
    • SR-03.02.01.a.03 On recognizing and reporting indicators of insider threat, social engineering, and social mining.
  • SR-03.02.01.b Update security literacy training content [organization-defined frequency] and following [organization-defined events].

03.02.02 – Role-Based Training#

  • SR-03.02.02.a Provide role-based security training to organizational personnel:
    • SR-03.02.02.a.01 Before authorizing access to the system or CUI, before performing assigned duties, and [organization-defined frequency] thereafter
    • SR-03.02.02.a.02 When required by system changes or following [organization-defined events].
  • SR-03.02.02.b Update role-based training content [organization-defined frequency] and following [organization-defined events].

SP_800_171_03.02.03 – 03.02.03#

National Institute of Standards and Technology, OSCAL release 1.1.0. Republished courtesy of the National Institute of Standards and Technology. CC0 1.0. Source.