Nist 800 53 At
| Field | Value |
|---|---|
| Type | Skill Resource |
| Source | ~/.copilot/skills/security/references/ato/nist-800-53-at.json |
| Description | Not specified |
Source Content
{ "catalog_uuid": "ea7c7688-79c5-463b-a91b-0650f2d98623", "catalog_title": "Electronic (OSCAL) Version of NIST SP 800-53 Rev 5.2.0 Controls and SP 800-53A Rev 5.2.0 Assessment Procedures", "catalog_version": "5.2.0", "group": { "id": "at", "class": "family", "title": "Awareness and Training", "props": [ { "name": "label", "value": "AT" } ], "controls": [ { "id": "at-1", "class": "SP800-53", "title": "Policy and Procedures", "params": [ { "id": "at-1_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "at-01_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "at-01_odp.02" } ], "label": "organization-defined personnel or roles" }, { "id": "at-01_odp.01", "props": [ { "name": "label", "value": "AT-01_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the awareness and training policy is to be disseminated is/are defined;" } ] }, { "id": "at-01_odp.02", "props": [ { "name": "label", "value": "AT-01_ODP[02]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to whom the awareness and training procedures are to be disseminated is/are defined;" } ] }, { "id": "at-01_odp.03", "props": [ { "name": "alt-identifier", "value": "at-1_prm_2" }, { "name": "label", "value": "AT-01_ODP[03]", "class": "sp800-53a" } ], "select": { "how-many": "one-or-more", "choice": [ "organization-level", "mission/business process-level", "system-level" ] } }, { "id": "at-01_odp.04", "props": [ { "name": "alt-identifier", "value": "at-1_prm_3" }, { "name": "label", "value": "AT-01_ODP[04]", "class": "sp800-53a" } ], "label": "official", "guidelines": [ { "prose": "an official to manage the awareness and training policy and procedures is defined;" } ] }, { "id": "at-01_odp.05", "props": [ { "name": "alt-identifier", "value": "at-1_prm_4" }, { "name": "label", "value": "AT-01_ODP[05]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current awareness and training policy is reviewed and updated is defined;" } ] }, { "id": "at-01_odp.06", "props": [ { "name": "alt-identifier", "value": "at-1_prm_5" }, { "name": "label", "value": "AT-01_ODP[06]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require the current awareness and training policy to be reviewed and updated are defined;" } ] }, { "id": "at-01_odp.07", "props": [ { "name": "alt-identifier", "value": "at-1_prm_6" }, { "name": "label", "value": "AT-01_ODP[07]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which the current awareness and training procedures are reviewed and updated is defined;" } ] }, { "id": "at-01_odp.08", "props": [ { "name": "alt-identifier", "value": "at-1_prm_7" }, { "name": "label", "value": "AT-01_ODP[08]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require procedures to be reviewed and updated are defined;" } ] } ], "props": [ { "name": "label", "value": "AT-01", "class": "zero-padded" }, { "name": "label", "value": "AT-1" }, { "name": "label", "value": "AT-01", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#c7ac44e8-10db-4b64-b2b9-9e32ec1efed0", "rel": "reference" }, { "href": "#08b07465-dbdc-48d6-8a0b-37279602ac16", "rel": "reference" }, { "href": "#cec037f3-8aba-4c97-84b4-4082f9e515d2", "rel": "reference" }, { "href": "#511f6832-23ca-49a3-8c0f-ce493373cab8", "rel": "reference" }, { "href": "#4c0ec2ee-a0d6-428a-9043-4504bc3ade6f", "rel": "reference" }, { "href": "#pm-9", "rel": "related" }, { "href": "#ps-8", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "at-1_smt", "name": "statement", "parts": [ { "id": "at-1_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Develop, document, and disseminate to {{ insert: param, at-1_prm_1 }}:", "parts": [ { "id": "at-1_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "{{ insert: param, at-01_odp.03 }} awareness and training policy that:", "parts": [ { "id": "at-1_smt.a.1.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and" }, { "id": "at-1_smt.a.1.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and" } ] }, { "id": "at-1_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls;" } ] }, { "id": "at-1_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Designate an {{ insert: param, at-01_odp.04 }} to manage the development, documentation, and dissemination of the awareness and training policy and procedures; and" }, { "id": "at-1_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Review and update the current awareness and training:", "parts": [ { "id": "at-1_smt.c.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Policy {{ insert: param, at-01_odp.05 }} and following {{ insert: param, at-01_odp.06 }} ; and" }, { "id": "at-1_smt.c.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "Procedures {{ insert: param, at-01_odp.07 }} and following {{ insert: param, at-01_odp.08 }}." } ] } ] }, { "id": "at-1_gdn", "name": "guidance", "prose": "Awareness and training policy and procedures address the controls in the AT family that are implemented within systems and organizations. The risk management strategy is an important factor in establishing such policies and procedures. Policies and procedures contribute to security and privacy assurance. Therefore, it is important that security and privacy programs collaborate on the development of awareness and training policy and procedures. Security and privacy program policies and procedures at the organization level are preferable, in general, and may obviate the need for mission- or system-specific policies and procedures. The policy can be included as part of the general security and privacy policy or be represented by multiple policies that reflect the complex nature of organizations. Procedures can be established for security and privacy programs, for mission or business processes, and for systems, if needed. Procedures describe how the policies or controls are implemented and can be directed at the individual or role that is the object of the procedure. Procedures can be documented in system security and privacy plans or in one or more separate documents. Events that may precipitate an update to awareness and training policy and procedures include assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines. Simply restating controls does not constitute an organizational policy or procedure." }, { "id": "at-1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01", "class": "sp800-53a" } ], "parts": [ { "id": "at-1_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.", "class": "sp800-53a" } ], "parts": [ { "id": "at-1_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.[01]", "class": "sp800-53a" } ], "prose": "an awareness and training policy is developed and documented; ", "links": [ { "href": "#at-1_smt.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.[02]", "class": "sp800-53a" } ], "prose": "the awareness and training policy is disseminated to {{ insert: param, at-01_odp.01 }};", "links": [ { "href": "#at-1_smt.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.[03]", "class": "sp800-53a" } ], "prose": "awareness and training procedures to facilitate the implementation of the awareness and training policy and associated access controls are developed and documented;", "links": [ { "href": "#at-1_smt.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.[04]", "class": "sp800-53a" } ], "prose": "the awareness and training procedures are disseminated to {{ insert: param, at-01_odp.02 }}.", "links": [ { "href": "#at-1_smt.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01", "class": "sp800-53a" } ], "parts": [ { "id": "at-1_obj.a.1.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(a)", "class": "sp800-53a" } ], "parts": [ { "id": "at-1_obj.a.1.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(a)[01]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.03 }} awareness and training policy addresses purpose;", "links": [ { "href": "#at-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a.1.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(a)[02]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.03 }} awareness and training policy addresses scope;", "links": [ { "href": "#at-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a.1.a-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(a)[03]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.03 }} awareness and training policy addresses roles;", "links": [ { "href": "#at-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a.1.a-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(a)[04]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.03 }} awareness and training policy addresses responsibilities;", "links": [ { "href": "#at-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a.1.a-5", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(a)[05]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.03 }} awareness and training policy addresses management commitment;", "links": [ { "href": "#at-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a.1.a-6", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(a)[06]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.03 }} awareness and training policy addresses coordination among organizational entities;", "links": [ { "href": "#at-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a.1.a-7", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(a)[07]", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.03 }} awareness and training policy addresses compliance; and", "links": [ { "href": "#at-1_smt.a.1.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-1_smt.a.1.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.a.1.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01a.01(b)", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.03 }} awareness and training policy is consistent with applicable laws, Executive Orders, directives, regulations, policies, standards, and guidelines; and", "links": [ { "href": "#at-1_smt.a.1.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-1_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-1_smt.a", "rel": "assessment-for" } ] }, { "id": "at-1_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01b.", "class": "sp800-53a" } ], "prose": "the {{ insert: param, at-01_odp.04 }} is designated to manage the development, documentation, and dissemination of the awareness and training policy and procedures;", "links": [ { "href": "#at-1_smt.b", "rel": "assessment-for" } ] }, { "id": "at-1_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01c.", "class": "sp800-53a" } ], "parts": [ { "id": "at-1_obj.c.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01c.01", "class": "sp800-53a" } ], "parts": [ { "id": "at-1_obj.c.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01c.01[01]", "class": "sp800-53a" } ], "prose": "the current awareness and training policy is reviewed and updated {{ insert: param, at-01_odp.05 }}; ", "links": [ { "href": "#at-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "at-1_obj.c.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01c.01[02]", "class": "sp800-53a" } ], "prose": "the current awareness and training policy is reviewed and updated following {{ insert: param, at-01_odp.06 }};", "links": [ { "href": "#at-1_smt.c.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-1_smt.c.1", "rel": "assessment-for" } ] }, { "id": "at-1_obj.c.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01c.02", "class": "sp800-53a" } ], "parts": [ { "id": "at-1_obj.c.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01c.02[01]", "class": "sp800-53a" } ], "prose": "the current awareness and training procedures are reviewed and updated {{ insert: param, at-01_odp.07 }};", "links": [ { "href": "#at-1_smt.c.2", "rel": "assessment-for" } ] }, { "id": "at-1_obj.c.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-01c.02[02]", "class": "sp800-53a" } ], "prose": "the current awareness and training procedures are reviewed and updated following {{ insert: param, at-01_odp.08 }}.", "links": [ { "href": "#at-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-1_smt.c.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-1_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-1_smt", "rel": "assessment-for" } ] }, { "id": "at-1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-01-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System security plan\n\nprivacy plan\n\nawareness and training policy and procedures\n\nother relevant documents or records" } ] }, { "id": "at-1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-01-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with awareness and training responsibilities\n\norganizational personnel with information security and privacy responsibilities" } ] } ] }, { "id": "at-2", "class": "SP800-53", "title": "Literacy Training and Awareness", "params": [ { "id": "at-2_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "at-02_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "at-02_odp.02" } ], "label": "organization-defined frequency" }, { "id": "at-2_prm_2", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "at-02_odp.03" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "at-02_odp.04" } ], "label": "organization-defined events" }, { "id": "at-02_odp.01", "props": [ { "name": "label", "value": "AT-02_ODP[01]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to provide security literacy training to system users (including managers, senior executives, and contractors) after initial training is defined;" } ] }, { "id": "at-02_odp.02", "props": [ { "name": "label", "value": "AT-02_ODP[02]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to provide privacy literacy training to system users (including managers, senior executives, and contractors) after initial training is defined;" } ] }, { "id": "at-02_odp.03", "props": [ { "name": "label", "value": "AT-02_ODP[03]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that require security literacy training for system users are defined;" } ] }, { "id": "at-02_odp.04", "props": [ { "name": "label", "value": "AT-02_ODP[04]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that require privacy literacy training for system users are defined;" } ] }, { "id": "at-02_odp.05", "props": [ { "name": "alt-identifier", "value": "at-2_prm_3" }, { "name": "label", "value": "AT-02_ODP[05]", "class": "sp800-53a" } ], "label": "awareness techniques", "guidelines": [ { "prose": "techniques to be employed to increase the security and privacy awareness of system users are defined;" } ] }, { "id": "at-02_odp.06", "props": [ { "name": "alt-identifier", "value": "at-2_prm_4" }, { "name": "label", "value": "AT-02_ODP[06]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to update literacy training and awareness content is defined;" } ] }, { "id": "at-02_odp.07", "props": [ { "name": "alt-identifier", "value": "at-2_prm_5" }, { "name": "label", "value": "AT-02_ODP[07]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that would require literacy training and awareness content to be updated are defined;" } ] } ], "props": [ { "name": "label", "value": "AT-02", "class": "zero-padded" }, { "name": "label", "value": "AT-2" }, { "name": "label", "value": "AT-02", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#511f6832-23ca-49a3-8c0f-ce493373cab8", "rel": "reference" }, { "href": "#61ccf0f4-d3e7-42db-9796-ce6cb1c85989", "rel": "reference" }, { "href": "#276bd50a-7e58-48e5-a405-8c8cb91d7a5f", "rel": "reference" }, { "href": "#89f2a08d-fc49-46d0-856e-bf974c9b1573", "rel": "reference" }, { "href": "#ac-3", "rel": "related" }, { "href": "#ac-17", "rel": "related" }, { "href": "#ac-22", "rel": "related" }, { "href": "#at-3", "rel": "related" }, { "href": "#at-4", "rel": "related" }, { "href": "#cp-3", "rel": "related" }, { "href": "#ia-4", "rel": "related" }, { "href": "#ir-2", "rel": "related" }, { "href": "#ir-7", "rel": "related" }, { "href": "#ir-9", "rel": "related" }, { "href": "#pl-4", "rel": "related" }, { "href": "#pm-13", "rel": "related" }, { "href": "#pm-21", "rel": "related" }, { "href": "#ps-7", "rel": "related" }, { "href": "#pt-2", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#sa-16", "rel": "related" } ], "parts": [ { "id": "at-2_smt", "name": "statement", "parts": [ { "id": "at-2_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Provide security and privacy literacy training to system users (including managers, senior executives, and contractors):", "parts": [ { "id": "at-2_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "As part of initial training for new users and {{ insert: param, at-2_prm_1 }} thereafter; and" }, { "id": "at-2_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "When required by system changes or following {{ insert: param, at-2_prm_2 }};" } ] }, { "id": "at-2_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Employ the following techniques to increase the security and privacy awareness of system users {{ insert: param, at-02_odp.05 }};" }, { "id": "at-2_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Update literacy training and awareness content {{ insert: param, at-02_odp.06 }} and following {{ insert: param, at-02_odp.07 }} ; and" }, { "id": "at-2_smt.d", "name": "item", "props": [ { "name": "label", "value": "d." } ], "prose": "Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques." } ] }, { "id": "at-2_gdn", "name": "guidance", "prose": "Organizations provide basic and advanced levels of literacy training to system users, including measures to test the knowledge level of users. Organizations determine the content of literacy training and awareness based on specific organizational requirements, the systems to which personnel have authorized access, and work environments (e.g., telework). The content includes an understanding of the need for security and privacy as well as actions by users to maintain security and personal privacy and to respond to suspected incidents. The content addresses the need for operations security and the handling of personally identifiable information.\n\nAwareness techniques include displaying posters, offering supplies inscribed with security and privacy reminders, displaying logon screen messages, generating email advisories or notices from organizational officials, and conducting awareness events. Literacy training after the initial training described in [AT-2a.1](#at-2_smt.a.1) is conducted at a minimum frequency consistent with applicable laws, directives, regulations, and policies. Subsequent literacy training may be satisfied by one or more short ad hoc sessions and include topical information on recent attack schemes, changes to organizational security and privacy policies, revised security and privacy expectations, or a subset of topics from the initial training. Updating literacy training and awareness content on a regular basis helps to ensure that the content remains relevant. Events that may precipitate an update to literacy training and awareness content include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines." }, { "id": "at-2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02", "class": "sp800-53a" } ], "parts": [ { "id": "at-2_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.", "class": "sp800-53a" } ], "parts": [ { "id": "at-2_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.01", "class": "sp800-53a" } ], "parts": [ { "id": "at-2_obj.a.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.01[01]", "class": "sp800-53a" } ], "prose": "security literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;", "links": [ { "href": "#at-2_smt.a.1", "rel": "assessment-for" } ] }, { "id": "at-2_obj.a.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.01[02]", "class": "sp800-53a" } ], "prose": "privacy literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;", "links": [ { "href": "#at-2_smt.a.1", "rel": "assessment-for" } ] }, { "id": "at-2_obj.a.1-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.01[03]", "class": "sp800-53a" } ], "prose": "security literacy training is provided to system users (including managers, senior executives, and contractors) {{ insert: param, at-02_odp.01 }} thereafter;", "links": [ { "href": "#at-2_smt.a.1", "rel": "assessment-for" } ] }, { "id": "at-2_obj.a.1-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.01[04]", "class": "sp800-53a" } ], "prose": "privacy literacy training is provided to system users (including managers, senior executives, and contractors) {{ insert: param, at-02_odp.02 }} thereafter;", "links": [ { "href": "#at-2_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-2_smt.a.1", "rel": "assessment-for" } ] }, { "id": "at-2_obj.a.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.02", "class": "sp800-53a" } ], "parts": [ { "id": "at-2_obj.a.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.02[01]", "class": "sp800-53a" } ], "prose": "security literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following {{ insert: param, at-02_odp.03 }};", "links": [ { "href": "#at-2_smt.a.2", "rel": "assessment-for" } ] }, { "id": "at-2_obj.a.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02a.02[02]", "class": "sp800-53a" } ], "prose": "privacy literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following {{ insert: param, at-02_odp.04 }};", "links": [ { "href": "#at-2_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-2_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-2_smt.a", "rel": "assessment-for" } ] }, { "id": "at-2_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02b.", "class": "sp800-53a" } ], "prose": "{{ insert: param, at-02_odp.05 }} are employed to increase the security and privacy awareness of system users;", "links": [ { "href": "#at-2_smt.b", "rel": "assessment-for" } ] }, { "id": "at-2_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02c.", "class": "sp800-53a" } ], "parts": [ { "id": "at-2_obj.c-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02c.[01]", "class": "sp800-53a" } ], "prose": "literacy training and awareness content is updated {{ insert: param, at-02_odp.06 }};", "links": [ { "href": "#at-2_smt.c", "rel": "assessment-for" } ] }, { "id": "at-2_obj.c-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02c.[02]", "class": "sp800-53a" } ], "prose": "literacy training and awareness content is updated following {{ insert: param, at-02_odp.07 }};", "links": [ { "href": "#at-2_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-2_smt.c", "rel": "assessment-for" } ] }, { "id": "at-2_obj.d", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02d.", "class": "sp800-53a" } ], "prose": "lessons learned from internal or external security incidents or breaches are incorporated into literacy training and awareness techniques.", "links": [ { "href": "#at-2_smt.d", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-2_smt", "rel": "assessment-for" } ] }, { "id": "at-2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-02-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System security plan\n\nprivacy plan\n\nliteracy training and awareness policy\n\nprocedures addressing literacy training and awareness implementation\n\nappropriate codes of federal regulations\n\nsecurity and privacy literacy training curriculum\n\nsecurity and privacy literacy training materials\n\ntraining records\n\nother relevant documents or records" } ] }, { "id": "at-2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-02-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with responsibilities for literacy training and awareness\n\norganizational personnel with information security and privacy responsibilities\n\norganizational personnel comprising the general system user community" } ] }, { "id": "at-2_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "AT-02-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Mechanisms managing information security and privacy literacy training" } ] } ], "controls": [ { "id": "at-2.1", "class": "SP800-53-enhancement", "title": "Practical Exercises", "props": [ { "name": "label", "value": "AT-02(01)", "class": "zero-padded" }, { "name": "label", "value": "AT-2(1)" }, { "name": "label", "value": "AT-02(01)", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-02.01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#at-2", "rel": "required" }, { "href": "#ca-2", "rel": "related" }, { "href": "#ca-7", "rel": "related" }, { "href": "#cp-4", "rel": "related" }, { "href": "#ir-3", "rel": "related" } ], "parts": [ { "id": "at-2.1_smt", "name": "statement", "prose": "Provide practical exercises in literacy training that simulate events and incidents." }, { "id": "at-2.1_gdn", "name": "guidance", "prose": "Practical exercises include no-notice social engineering attempts to collect information, gain unauthorized access, or simulate the adverse impact of opening malicious email attachments or invoking, via spear phishing attacks, malicious web links." }, { "id": "at-2.1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02(01)", "class": "sp800-53a" } ], "prose": "practical exercises in literacy training that simulate events and incidents are provided.", "links": [ { "href": "#at-2.1_smt", "rel": "assessment-for" } ] }, { "id": "at-2.1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-02(01)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System security plan\n\nprivacy plan\n\nsecurity awareness and training policy\n\nprocedures addressing security awareness training implementation\n\nsecurity awareness training curriculum\n\nsecurity awareness training materials\n\nother relevant documents or records" } ] }, { "id": "at-2.1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-02(01)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel who receive literacy training and awareness\n\norganizational personnel with responsibilities for security awareness training\n\norganizational personnel with information security responsibilities" } ] }, { "id": "at-2.1_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "AT-02(01)-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Mechanisms implementing cyber-attack simulations in practical exercises" } ] } ] }, { "id": "at-2.2", "class": "SP800-53-enhancement", "title": "Insider Threat", "props": [ { "name": "label", "value": "AT-02(02)", "class": "zero-padded" }, { "name": "label", "value": "AT-2(2)" }, { "name": "label", "value": "AT-02(02)", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-02.02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#at-2", "rel": "required" }, { "href": "#pm-12", "rel": "related" } ], "parts": [ { "id": "at-2.2_smt", "name": "statement", "prose": "Provide literacy training on recognizing and reporting potential indicators of insider threat." }, { "id": "at-2.2_gdn", "name": "guidance", "prose": "Potential indicators and possible precursors of insider threat can include behaviors such as inordinate, long-term job dissatisfaction; attempts to gain access to information not required for job performance; unexplained access to financial resources; bullying or harassment of fellow employees; workplace violence; and other serious violations of policies, procedures, directives, regulations, rules, or practices. Literacy training includes how to communicate the concerns of employees and management regarding potential indicators of insider threat through channels established by the organization and in accordance with established policies and procedures. Organizations may consider tailoring insider threat awareness topics to the role. For example, training for managers may be focused on changes in the behavior of team members, while training for employees may be focused on more general observations." }, { "id": "at-2.2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02(02)", "class": "sp800-53a" } ], "parts": [ { "id": "at-2.2_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02(02)[01]", "class": "sp800-53a" } ], "prose": "literacy training on recognizing potential indicators of insider threat is provided;", "links": [ { "href": "#at-2.2_smt", "rel": "assessment-for" } ] }, { "id": "at-2.2_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02(02)[02]", "class": "sp800-53a" } ], "prose": "literacy training on reporting potential indicators of insider threat is provided.", "links": [ { "href": "#at-2.2_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-2.2_smt", "rel": "assessment-for" } ] }, { "id": "at-2.2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-02(02)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System security plan\n\nprivacy plan\n\nliteracy training and awareness policy\n\nprocedures addressing literacy training and awareness implementation\n\nliteracy training and awareness curriculum\n\nliteracy training and awareness materials\n\nother relevant documents or records" } ] }, { "id": "at-2.2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-02(02)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel who receive literacy training and awareness\n\norganizational personnel with responsibilities for literacy training and awareness\n\norganizational personnel with information security and privacy responsibilities" } ] } ] }, { "id": "at-2.3", "class": "SP800-53-enhancement", "title": "Social Engineering and Mining", "props": [ { "name": "label", "value": "AT-02(03)", "class": "zero-padded" }, { "name": "label", "value": "AT-2(3)" }, { "name": "label", "value": "AT-02(03)", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-02.03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#at-2", "rel": "required" } ], "parts": [ { "id": "at-2.3_smt", "name": "statement", "prose": "Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining." }, { "id": "at-2.3_gdn", "name": "guidance", "prose": "Social engineering is an attempt to trick an individual into revealing information or taking an action that can be used to breach, compromise, or otherwise adversely impact a system. Social engineering includes phishing, pretexting, impersonation, baiting, quid pro quo, thread-jacking, social media exploitation, and tailgating. Social mining is an attempt to gather information about the organization that may be used to support future attacks. Literacy training includes information on how to communicate the concerns of employees and management regarding potential and actual instances of social engineering and data mining through organizational channels based on established policies and procedures." }, { "id": "at-2.3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02(03)", "class": "sp800-53a" } ], "parts": [ { "id": "at-2.3_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02(03)[01]", "class": "sp800-53a" } ], "prose": "literacy training on recognizing potential and actual instances of social engineering is provided;", "links": [ { "href": "#at-2.3_smt", "rel": "assessment-for" } ] }, { "id": "at-2.3_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02(03)[02]", "class": "sp800-53a" } ], "prose": "literacy training on reporting potential and actual instances of social engineering is provided;", "links": [ { "href": "#at-2.3_smt", "rel": "assessment-for" } ] }, { "id": "at-2.3_obj-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02(03)[03]", "class": "sp800-53a" } ], "prose": "literacy training on recognizing potential and actual instances of social mining is provided;", "links": [ { "href": "#at-2.3_smt", "rel": "assessment-for" } ] }, { "id": "at-2.3_obj-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02(03)[04]", "class": "sp800-53a" } ], "prose": "literacy training on reporting potential and actual instances of social mining is provided.", "links": [ { "href": "#at-2.3_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-2.3_smt", "rel": "assessment-for" } ] }, { "id": "at-2.3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-02(03)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System security plan\n\nprivacy plan\n\nliteracy training and awareness policy\n\nprocedures addressing literacy training and awareness implementation\n\nliteracy training and awareness curriculum\n\nliteracy training and awareness materials\n\nother relevant documents or records" } ] }, { "id": "at-2.3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-02(03)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel who receive literacy training and awareness\n\norganizational personnel with responsibilities for literacy training and awareness\n\norganizational personnel with information security and privacy responsibilities" } ] } ] }, { "id": "at-2.4", "class": "SP800-53-enhancement", "title": "Suspicious Communications and Anomalous System Behavior", "params": [ { "id": "at-02.04_odp", "props": [ { "name": "alt-identifier", "value": "at-2.4_prm_1" }, { "name": "label", "value": "AT-02(04)_ODP", "class": "sp800-53a" } ], "label": "indicators of malicious code", "guidelines": [ { "prose": "indicators of malicious code are defined;" } ] } ], "props": [ { "name": "label", "value": "AT-02(04)", "class": "zero-padded" }, { "name": "label", "value": "AT-2(4)" }, { "name": "label", "value": "AT-02(04)", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-02.04" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#at-2", "rel": "required" } ], "parts": [ { "id": "at-2.4_smt", "name": "statement", "prose": "Provide literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using {{ insert: param, at-02.04_odp }}." }, { "id": "at-2.4_gdn", "name": "guidance", "prose": "A well-trained workforce provides another organizational control that can be employed as part of a defense-in-depth strategy to protect against malicious code coming into organizations via email or the web applications. Personnel are trained to look for indications of potentially suspicious email (e.g., receiving an unexpected email, receiving an email containing strange or poor grammar, or receiving an email from an unfamiliar sender that appears to be from a known sponsor or contractor). Personnel are also trained on how to respond to suspicious email or web communications. For this process to work effectively, personnel are trained and made aware of what constitutes suspicious communications. Training personnel on how to recognize anomalous behaviors in systems can provide organizations with early warning for the presence of malicious code. Recognition of anomalous behavior by organizational personnel can supplement malicious code detection and protection tools and systems employed by organizations." }, { "id": "at-2.4_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02(04)", "class": "sp800-53a" } ], "prose": "literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using {{ insert: param, at-02.04_odp }} is provided.", "links": [ { "href": "#at-2.4_smt", "rel": "assessment-for" } ] }, { "id": "at-2.4_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-02(04)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System security plan\n\nprivacy plan\n\nliteracy training and awareness policy\n\nprocedures addressing literacy training and awareness implementation\n\nliteracy training and awareness curriculum\n\nliteracy training and awareness materials\n\nother relevant documents or records" } ] }, { "id": "at-2.4_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-02(04)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel who receive literacy training and awareness\n\norganizational personnel with responsibilities for basic literacy training and awareness\n\norganizational personnel with information security and privacy responsibilities" } ] } ] }, { "id": "at-2.5", "class": "SP800-53-enhancement", "title": "Advanced Persistent Threat", "props": [ { "name": "label", "value": "AT-02(05)", "class": "zero-padded" }, { "name": "label", "value": "AT-2(5)" }, { "name": "label", "value": "AT-02(05)", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-02.05" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#at-2", "rel": "required" } ], "parts": [ { "id": "at-2.5_smt", "name": "statement", "prose": "Provide literacy training on the advanced persistent threat." }, { "id": "at-2.5_gdn", "name": "guidance", "prose": "An effective way to detect advanced persistent threats (APT) and to preclude successful attacks is to provide specific literacy training for individuals. Threat literacy training includes educating individuals on the various ways that APTs can infiltrate the organization (e.g., through websites, emails, advertisement pop-ups, articles, and social engineering). Effective training includes techniques for recognizing suspicious emails, use of removable systems in non-secure settings, and the potential targeting of individuals at home." }, { "id": "at-2.5_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02(05)", "class": "sp800-53a" } ], "prose": "literacy training on the advanced persistent threat is provided.", "links": [ { "href": "#at-2.5_smt", "rel": "assessment-for" } ] }, { "id": "at-2.5_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-02(05)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System security plan\n\nprivacy plan\n\nliteracy training and awareness policy\n\nprocedures addressing literacy training and awareness implementation\n\nliteracy training and awareness curriculum\n\nliteracy training and awareness materials\n\nother relevant documents or records" } ] }, { "id": "at-2.5_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-02(05)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel who receive literacy training and awareness\n\norganizational personnel with responsibilities for basic literacy training and awareness\n\norganizational personnel with information security and privacy responsibilities" } ] } ] }, { "id": "at-2.6", "class": "SP800-53-enhancement", "title": "Cyber Threat Environment", "props": [ { "name": "label", "value": "AT-02(06)", "class": "zero-padded" }, { "name": "label", "value": "AT-2(6)" }, { "name": "label", "value": "AT-02(06)", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-02.06" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#at-2", "rel": "required" }, { "href": "#ra-3", "rel": "related" } ], "parts": [ { "id": "at-2.6_smt", "name": "statement", "parts": [ { "id": "at-2.6_smt.a", "name": "item", "props": [ { "name": "label", "value": "(a)" } ], "prose": "Provide literacy training on the cyber threat environment; and" }, { "id": "at-2.6_smt.b", "name": "item", "props": [ { "name": "label", "value": "(b)" } ], "prose": "Reflect current cyber threat information in system operations." } ] }, { "id": "at-2.6_gdn", "name": "guidance", "prose": "Since threats continue to change over time, threat literacy training by the organization is dynamic. Moreover, threat literacy training is not performed in isolation from the system operations that support organizational mission and business functions." }, { "id": "at-2.6_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02(06)", "class": "sp800-53a" } ], "parts": [ { "id": "at-2.6_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02(06)(a)", "class": "sp800-53a" } ], "prose": "literacy training on the cyber threat environment is provided;", "links": [ { "href": "#at-2.6_smt.a", "rel": "assessment-for" } ] }, { "id": "at-2.6_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-02(06)(b)", "class": "sp800-53a" } ], "prose": "system operations reflects current cyber threat information.", "links": [ { "href": "#at-2.6_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-2.6_smt", "rel": "assessment-for" } ] }, { "id": "at-2.6_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-02(06)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System security plan\n\nprivacy plan\n\nliteracy training and awareness policy\n\nprocedures addressing literacy training and awareness training implementation\n\nliteracy training and awareness curriculum\n\nliteracy training and awareness materials\n\nother relevant documents or records" } ] }, { "id": "at-2.6_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-02(06)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel who receive literacy training and awareness\n\norganizational personnel with responsibilities for basic literacy training and awareness\n\norganizational personnel with information security and privacy responsibilities" } ] } ] } ] }, { "id": "at-3", "class": "SP800-53", "title": "Role-based Training", "params": [ { "id": "at-3_prm_1", "props": [ { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "at-03_odp.01" }, { "name": "aggregates", "ns": "http://csrc.nist.gov/ns/rmf", "value": "at-03_odp.02" } ], "label": "organization-defined roles and responsibilities" }, { "id": "at-03_odp.01", "props": [ { "name": "label", "value": "AT-03_ODP[01]", "class": "sp800-53a" } ], "label": "roles and responsibilities", "guidelines": [ { "prose": "roles and responsibilities for role-based security training are defined;" } ] }, { "id": "at-03_odp.02", "props": [ { "name": "label", "value": "AT-03_ODP[02]", "class": "sp800-53a" } ], "label": "roles and responsibilities", "guidelines": [ { "prose": "roles and responsibilities for role-based privacy training are defined;" } ] }, { "id": "at-03_odp.03", "props": [ { "name": "alt-identifier", "value": "at-3_prm_2" }, { "name": "label", "value": "AT-03_ODP[03]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to provide role-based security and privacy training to assigned personnel after initial training is defined;" } ] }, { "id": "at-03_odp.04", "props": [ { "name": "alt-identifier", "value": "at-3_prm_3" }, { "name": "label", "value": "AT-03_ODP[04]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to update role-based training content is defined;" } ] }, { "id": "at-03_odp.05", "props": [ { "name": "alt-identifier", "value": "at-3_prm_4" }, { "name": "label", "value": "AT-03_ODP[05]", "class": "sp800-53a" } ], "label": "events", "guidelines": [ { "prose": "events that require role-based training content to be updated are defined;" } ] } ], "props": [ { "name": "label", "value": "AT-03", "class": "zero-padded" }, { "name": "label", "value": "AT-3" }, { "name": "label", "value": "AT-03", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#511f6832-23ca-49a3-8c0f-ce493373cab8", "rel": "reference" }, { "href": "#276bd50a-7e58-48e5-a405-8c8cb91d7a5f", "rel": "reference" }, { "href": "#ac-3", "rel": "related" }, { "href": "#ac-17", "rel": "related" }, { "href": "#ac-22", "rel": "related" }, { "href": "#at-2", "rel": "related" }, { "href": "#at-4", "rel": "related" }, { "href": "#cp-3", "rel": "related" }, { "href": "#ir-2", "rel": "related" }, { "href": "#ir-4", "rel": "related" }, { "href": "#ir-7", "rel": "related" }, { "href": "#ir-9", "rel": "related" }, { "href": "#pl-4", "rel": "related" }, { "href": "#pm-13", "rel": "related" }, { "href": "#pm-23", "rel": "related" }, { "href": "#ps-7", "rel": "related" }, { "href": "#ps-9", "rel": "related" }, { "href": "#sa-3", "rel": "related" }, { "href": "#sa-8", "rel": "related" }, { "href": "#sa-11", "rel": "related" }, { "href": "#sa-16", "rel": "related" }, { "href": "#sr-5", "rel": "related" }, { "href": "#sr-6", "rel": "related" }, { "href": "#sr-11", "rel": "related" } ], "parts": [ { "id": "at-3_smt", "name": "statement", "parts": [ { "id": "at-3_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Provide role-based security and privacy training to personnel with the following roles and responsibilities: {{ insert: param, at-3_prm_1 }}:", "parts": [ { "id": "at-3_smt.a.1", "name": "item", "props": [ { "name": "label", "value": "1." } ], "prose": "Before authorizing access to the system, information, or performing assigned duties, and {{ insert: param, at-03_odp.03 }} thereafter; and" }, { "id": "at-3_smt.a.2", "name": "item", "props": [ { "name": "label", "value": "2." } ], "prose": "When required by system changes;" } ] }, { "id": "at-3_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Update role-based training content {{ insert: param, at-03_odp.04 }} and following {{ insert: param, at-03_odp.05 }} ; and" }, { "id": "at-3_smt.c", "name": "item", "props": [ { "name": "label", "value": "c." } ], "prose": "Incorporate lessons learned from internal or external security incidents or breaches into role-based training." } ] }, { "id": "at-3_gdn", "name": "guidance", "prose": "Organizations determine the content of training based on the assigned roles and responsibilities of individuals as well as the security and privacy requirements of organizations and the systems to which personnel have authorized access, including technical training specifically tailored for assigned duties. Roles that may require role-based training include senior leaders or management officials (e.g., head of agency/chief executive officer, chief information officer, senior accountable official for risk management, senior agency information security officer, senior agency official for privacy), system owners; authorizing officials; system security officers; privacy officers; acquisition and procurement officials; enterprise architects; systems engineers; software developers; systems security engineers; privacy engineers; system, network, and database administrators; auditors; personnel conducting configuration management activities; personnel performing verification and validation activities; personnel with access to system-level software; control assessors; personnel with contingency planning and incident response duties; personnel with privacy management responsibilities; and personnel with access to personally identifiable information.\n\nComprehensive role-based training addresses management, operational, and technical roles and responsibilities covering physical, personnel, and technical controls. Role-based training also includes policies, procedures, tools, methods, and artifacts for the security and privacy roles defined. Organizations provide the training necessary for individuals to fulfill their responsibilities related to operations and supply chain risk management within the context of organizational security and privacy programs. Role-based training also applies to contractors who provide services to federal agencies. Types of training include web-based and computer-based training, classroom-style training, and hands-on training (including micro-training). Updating role-based training on a regular basis helps to ensure that the content remains relevant and effective. Events that may precipitate an update to role-based training content include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines." }, { "id": "at-3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03", "class": "sp800-53a" } ], "parts": [ { "id": "at-3_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.", "class": "sp800-53a" } ], "parts": [ { "id": "at-3_obj.a.1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.01", "class": "sp800-53a" } ], "parts": [ { "id": "at-3_obj.a.1-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.01[01]", "class": "sp800-53a" } ], "prose": "role-based security training is provided to {{ insert: param, at-03_odp.01 }} before authorizing access to the system, information, or performing assigned duties;", "links": [ { "href": "#at-3_smt.a.1", "rel": "assessment-for" } ] }, { "id": "at-3_obj.a.1-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.01[02]", "class": "sp800-53a" } ], "prose": "role-based privacy training is provided to {{ insert: param, at-03_odp.02 }} before authorizing access to the system, information, or performing assigned duties;", "links": [ { "href": "#at-3_smt.a.1", "rel": "assessment-for" } ] }, { "id": "at-3_obj.a.1-3", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.01[03]", "class": "sp800-53a" } ], "prose": "role-based security training is provided to {{ insert: param, at-03_odp.01 }} {{ insert: param, at-03_odp.03 }} thereafter;", "links": [ { "href": "#at-3_smt.a.1", "rel": "assessment-for" } ] }, { "id": "at-3_obj.a.1-4", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.01[04]", "class": "sp800-53a" } ], "prose": "role-based privacy training is provided to {{ insert: param, at-03_odp.02 }} {{ insert: param, at-03_odp.03 }} thereafter;", "links": [ { "href": "#at-3_smt.a.1", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-3_smt.a.1", "rel": "assessment-for" } ] }, { "id": "at-3_obj.a.2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.02", "class": "sp800-53a" } ], "parts": [ { "id": "at-3_obj.a.2-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.02[01]", "class": "sp800-53a" } ], "prose": "role-based security training is provided to personnel with assigned security roles and responsibilities when required by system changes;", "links": [ { "href": "#at-3_smt.a.2", "rel": "assessment-for" } ] }, { "id": "at-3_obj.a.2-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03a.02[02]", "class": "sp800-53a" } ], "prose": "role-based privacy training is provided to personnel with assigned security roles and responsibilities when required by system changes;", "links": [ { "href": "#at-3_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-3_smt.a.2", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-3_smt.a", "rel": "assessment-for" } ] }, { "id": "at-3_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03b.", "class": "sp800-53a" } ], "parts": [ { "id": "at-3_obj.b-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03b.[01]", "class": "sp800-53a" } ], "prose": "role-based training content is updated {{ insert: param, at-03_odp.04 }};", "links": [ { "href": "#at-3_smt.b", "rel": "assessment-for" } ] }, { "id": "at-3_obj.b-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03b.[02]", "class": "sp800-53a" } ], "prose": "role-based training content is updated following {{ insert: param, at-03_odp.05 }};", "links": [ { "href": "#at-3_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-3_smt.b", "rel": "assessment-for" } ] }, { "id": "at-3_obj.c", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03c.", "class": "sp800-53a" } ], "prose": "lessons learned from internal or external security incidents or breaches are incorporated into role-based training.", "links": [ { "href": "#at-3_smt.c", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-3_smt", "rel": "assessment-for" } ] }, { "id": "at-3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-03-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "System security plan\n\nprivacy plan\n\nsecurity and privacy awareness and training policy\n\nprocedures addressing security and privacy training implementation\n\ncodes of federal regulations\n\nsecurity and privacy training curriculum\n\nsecurity and privacy training materials\n\ntraining records\n\nother relevant documents or records" } ] }, { "id": "at-3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-03-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with responsibilities for role-based security and privacy training\n\norganizational personnel with assigned system security and privacy roles and responsibilities" } ] }, { "id": "at-3_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "AT-03-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Mechanisms managing role-based security and privacy training" } ] } ], "controls": [ { "id": "at-3.1", "class": "SP800-53-enhancement", "title": "Environmental Controls", "params": [ { "id": "at-03.01_odp.01", "props": [ { "name": "alt-identifier", "value": "at-3.1_prm_1" }, { "name": "label", "value": "AT-03(01)_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to be provided with initial and refresher training in the employment and operation of environmental controls are defined;" } ] }, { "id": "at-03.01_odp.02", "props": [ { "name": "alt-identifier", "value": "at-3.1_prm_2" }, { "name": "label", "value": "AT-03(01)_ODP[02]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to provide refresher training in the employment and operation of environmental controls is defined;" } ] } ], "props": [ { "name": "label", "value": "AT-03(01)", "class": "zero-padded" }, { "name": "label", "value": "AT-3(1)" }, { "name": "label", "value": "AT-03(01)", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-03.01" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#at-3", "rel": "required" }, { "href": "#pe-1", "rel": "related" }, { "href": "#pe-11", "rel": "related" }, { "href": "#pe-13", "rel": "related" }, { "href": "#pe-14", "rel": "related" }, { "href": "#pe-15", "rel": "related" } ], "parts": [ { "id": "at-3.1_smt", "name": "statement", "prose": "Provide {{ insert: param, at-03.01_odp.01 }} with initial and {{ insert: param, at-03.01_odp.02 }} training in the employment and operation of environmental controls." }, { "id": "at-3.1_gdn", "name": "guidance", "prose": "Environmental controls include fire suppression and detection devices or systems, sprinkler systems, handheld fire extinguishers, fixed fire hoses, smoke detectors, temperature or humidity, heating, ventilation, air conditioning, and power within the facility." }, { "id": "at-3.1_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03(01)", "class": "sp800-53a" } ], "prose": "{{ insert: param, at-03.01_odp.01 }} are provided with initial and refresher training {{ insert: param, at-03.01_odp.02 }} in the employment and operation of environmental controls.", "links": [ { "href": "#at-3.1_smt", "rel": "assessment-for" } ] }, { "id": "at-3.1_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-03(01)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Security and privacy awareness and training policy\n\nprocedures addressing security and privacy training implementation\n\nsecurity and privacy training curriculum\n\nsecurity and privacy training materials\n\nsystem security plan\n\nprivacy plan\n\ntraining records\n\nother relevant documents or records" } ] }, { "id": "at-3.1_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-03(01)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with responsibilities for role-based security and privacy training\n\norganizational personnel with responsibilities for employing and operating environmental controls" } ] } ] }, { "id": "at-3.2", "class": "SP800-53-enhancement", "title": "Physical Security Controls", "params": [ { "id": "at-03.02_odp.01", "props": [ { "name": "alt-identifier", "value": "at-3.2_prm_1" }, { "name": "label", "value": "AT-03(02)_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to be provided with initial and refresher training in the employment and operation of physical security controls is/are defined;" } ] }, { "id": "at-03.02_odp.02", "props": [ { "name": "alt-identifier", "value": "at-3.2_prm_2" }, { "name": "label", "value": "AT-03(02)_ODP[02]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to provide refresher training in the employment and operation of physical security controls is defined;" } ] } ], "props": [ { "name": "label", "value": "AT-03(02)", "class": "zero-padded" }, { "name": "label", "value": "AT-3(2)" }, { "name": "label", "value": "AT-03(02)", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-03.02" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#at-3", "rel": "required" }, { "href": "#pe-2", "rel": "related" }, { "href": "#pe-3", "rel": "related" }, { "href": "#pe-4", "rel": "related" } ], "parts": [ { "id": "at-3.2_smt", "name": "statement", "prose": "Provide {{ insert: param, at-03.02_odp.01 }} with initial and {{ insert: param, at-03.02_odp.02 }} training in the employment and operation of physical security controls." }, { "id": "at-3.2_gdn", "name": "guidance", "prose": "Physical security controls include physical access control devices, physical intrusion and detection alarms, operating procedures for facility security guards, and monitoring or surveillance equipment." }, { "id": "at-3.2_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03(02)", "class": "sp800-53a" } ], "prose": "{{ insert: param, at-03.02_odp.01 }} is/are provided with initial and refresher training {{ insert: param, at-03.02_odp.02 }} in the employment and operation of physical security controls.", "links": [ { "href": "#at-3.2_smt", "rel": "assessment-for" } ] }, { "id": "at-3.2_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-03(02)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Security and privacy awareness and training policy\n\nprocedures addressing security and privacy training implementation\n\nsecurity and privacy training curriculum\n\nsecurity and privacy training materials\n\nsystem security plan\n\nprivacy plan\n\ntraining records\n\nother relevant documents or records" } ] }, { "id": "at-3.2_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-03(02)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with responsibilities for role-based security and privacy training\n\norganizational personnel with responsibilities for employing and operating physical security controls" } ] } ] }, { "id": "at-3.3", "class": "SP800-53-enhancement", "title": "Practical Exercises", "props": [ { "name": "label", "value": "AT-03(03)", "class": "zero-padded" }, { "name": "label", "value": "AT-3(3)" }, { "name": "label", "value": "AT-03(03)", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-03.03" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#at-3", "rel": "required" } ], "parts": [ { "id": "at-3.3_smt", "name": "statement", "prose": "Provide practical exercises in security and privacy training that reinforce training objectives." }, { "id": "at-3.3_gdn", "name": "guidance", "prose": "Practical exercises for security include training for software developers that addresses simulated attacks that exploit common software vulnerabilities or spear or whale phishing attacks targeted at senior leaders or executives. Practical exercises for privacy include modules with quizzes on identifying and processing personally identifiable information in various scenarios or scenarios on conducting privacy impact assessments." }, { "id": "at-3.3_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03(03)", "class": "sp800-53a" } ], "parts": [ { "id": "at-3.3_obj-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03(03)[01]", "class": "sp800-53a" } ], "prose": "practical exercises in security training that reinforce training objectives are provided;", "links": [ { "href": "#at-3.3_smt", "rel": "assessment-for" } ] }, { "id": "at-3.3_obj-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03(03)[02]", "class": "sp800-53a" } ], "prose": "practical exercises in privacy training that reinforce training objectives are provided.", "links": [ { "href": "#at-3.3_smt", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-3.3_smt", "rel": "assessment-for" } ] }, { "id": "at-3.3_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-03(03)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Security and privacy awareness and training policy\n\nprocedures addressing security and privacy awareness training implementation\n\nsecurity and privacy awareness training curriculum\n\nsecurity and privacy awareness training materials\n\nsecurity and privacy awareness training reports and results\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "at-3.3_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-03(03)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with responsibilities for role-based security and privacy training\n\norganizational personnel who participate in security and privacy awareness training" } ] } ] }, { "id": "at-3.4", "class": "SP800-53-enhancement", "title": "Suspicious Communications and Anomalous System Behavior", "props": [ { "name": "label", "value": "AT-03(04)", "class": "zero-padded" }, { "name": "label", "value": "AT-3(4)" }, { "name": "label", "value": "AT-03(04)", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-03.04" }, { "name": "status", "value": "withdrawn" } ], "links": [ { "href": "#at-2.4", "rel": "moved-to" } ] }, { "id": "at-3.5", "class": "SP800-53-enhancement", "title": "Processing Personally Identifiable Information", "params": [ { "id": "at-03.05_odp.01", "props": [ { "name": "alt-identifier", "value": "at-3.5_prm_1" }, { "name": "label", "value": "AT-03(05)_ODP[01]", "class": "sp800-53a" } ], "label": "personnel or roles", "guidelines": [ { "prose": "personnel or roles to be provided with initial and refresher training in the employment and operation of personally identifiable information processing and transparency controls is/are defined;" } ] }, { "id": "at-03.05_odp.02", "props": [ { "name": "alt-identifier", "value": "at-3.5_prm_2" }, { "name": "label", "value": "AT-03(05)_ODP[02]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "the frequency at which to provide refresher training in the employment and operation of personally identifiable information processing and transparency controls is defined;" } ] } ], "props": [ { "name": "label", "value": "AT-03(05)", "class": "zero-padded" }, { "name": "label", "value": "AT-3(5)" }, { "name": "label", "value": "AT-03(05)", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-03.05" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#at-3", "rel": "required" }, { "href": "#pt-2", "rel": "related" }, { "href": "#pt-3", "rel": "related" }, { "href": "#pt-5", "rel": "related" }, { "href": "#pt-6", "rel": "related" } ], "parts": [ { "id": "at-3.5_smt", "name": "statement", "prose": "Provide {{ insert: param, at-03.05_odp.01 }} with initial and {{ insert: param, at-03.05_odp.02 }} training in the employment and operation of personally identifiable information processing and transparency controls." }, { "id": "at-3.5_gdn", "name": "guidance", "prose": "Personally identifiable information processing and transparency controls include the organization\u2019s authority to process personally identifiable information and personally identifiable information processing purposes. Role-based training for federal agencies addresses the types of information that may constitute personally identifiable information and the risks, considerations, and obligations associated with its processing. Such training also considers the authority to process personally identifiable information documented in privacy policies and notices, system of records notices, computer matching agreements and notices, privacy impact assessments, [PRIVACT](#18e71fec-c6fd-475a-925a-5d8495cf8455) statements, contracts, information sharing agreements, memoranda of understanding, and/or other documentation." }, { "id": "at-3.5_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-03(05)", "class": "sp800-53a" } ], "prose": "{{ insert: param, at-03.05_odp.01 }} are provided with initial and refresher training {{ insert: param, at-03.05_odp.02 }} in the employment and operation of personally identifiable information processing and transparency controls.", "links": [ { "href": "#at-3.5_smt", "rel": "assessment-for" } ] }, { "id": "at-3.5_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-03(05)-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Security and privacy awareness and training policy\n\nprocedures addressing security and privacy awareness training implementation\n\nsecurity and privacy awareness training curriculum\n\nsecurity and privacy awareness training materials\n\nsystem security plan\n\nprivacy plan\n\norganizational privacy notices\n\norganizational policies\n\nsystem of records notices\n\nPrivacy Act statements\n\ncomputer matching agreements and notices\n\nprivacy impact assessments\n\ninformation sharing agreements\n\nother relevant documents or records" } ] }, { "id": "at-3.5_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-03(05)-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with responsibilities for role-based security and privacy training\n\norganizational personnel who participate in security and privacy awareness training" } ] } ] } ] }, { "id": "at-4", "class": "SP800-53", "title": "Training Records", "params": [ { "id": "at-04_odp", "props": [ { "name": "alt-identifier", "value": "at-4_prm_1" }, { "name": "label", "value": "AT-04_ODP", "class": "sp800-53a" } ], "label": "time period", "guidelines": [ { "prose": "time period for retaining individual training records is defined;" } ] } ], "props": [ { "name": "label", "value": "AT-04", "class": "zero-padded" }, { "name": "label", "value": "AT-4" }, { "name": "label", "value": "AT-04", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-04" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "links": [ { "href": "#27847491-5ce1-4f6a-a1e4-9e483782f0ef", "rel": "reference" }, { "href": "#at-2", "rel": "related" }, { "href": "#at-3", "rel": "related" }, { "href": "#cp-3", "rel": "related" }, { "href": "#ir-2", "rel": "related" }, { "href": "#pm-14", "rel": "related" }, { "href": "#si-12", "rel": "related" } ], "parts": [ { "id": "at-4_smt", "name": "statement", "parts": [ { "id": "at-4_smt.a", "name": "item", "props": [ { "name": "label", "value": "a." } ], "prose": "Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and" }, { "id": "at-4_smt.b", "name": "item", "props": [ { "name": "label", "value": "b." } ], "prose": "Retain individual training records for {{ insert: param, at-04_odp }}." } ] }, { "id": "at-4_gdn", "name": "guidance", "prose": "Documentation for specialized training may be maintained by individual supervisors at the discretion of the organization. The National Archives and Records Administration provides guidance on records retention for federal agencies." }, { "id": "at-4_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-04", "class": "sp800-53a" } ], "parts": [ { "id": "at-4_obj.a", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-04a.", "class": "sp800-53a" } ], "parts": [ { "id": "at-4_obj.a-1", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-04a.[01]", "class": "sp800-53a" } ], "prose": "information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are documented;", "links": [ { "href": "#at-4_smt.a", "rel": "assessment-for" } ] }, { "id": "at-4_obj.a-2", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-04a.[02]", "class": "sp800-53a" } ], "prose": "information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are monitored;", "links": [ { "href": "#at-4_smt.a", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-4_smt.a", "rel": "assessment-for" } ] }, { "id": "at-4_obj.b", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-04b.", "class": "sp800-53a" } ], "prose": "individual training records are retained for {{ insert: param, at-04_odp }}.", "links": [ { "href": "#at-4_smt.b", "rel": "assessment-for" } ] } ], "links": [ { "href": "#at-4_smt", "rel": "assessment-for" } ] }, { "id": "at-4_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-04-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Security and privacy awareness and training policy\n\nprocedures addressing security and privacy training records\n\nsecurity and privacy awareness and training records\n\nsystem security plan\n\nprivacy plan\n\nother relevant documents or records" } ] }, { "id": "at-4_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-04-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information security and privacy training record retention responsibilities" } ] }, { "id": "at-4_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "AT-04-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Mechanisms supporting the management of security and privacy training records" } ] } ] }, { "id": "at-5", "class": "SP800-53", "title": "Contacts with Security Groups and Associations", "props": [ { "name": "label", "value": "AT-05", "class": "zero-padded" }, { "name": "label", "value": "AT-5" }, { "name": "label", "value": "AT-05", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-05" }, { "name": "status", "value": "withdrawn" } ], "links": [ { "href": "#pm-15", "rel": "incorporated-into" } ] }, { "id": "at-6", "class": "SP800-53", "title": "Training Feedback", "params": [ { "id": "at-06_odp.01", "props": [ { "name": "alt-identifier", "value": "at-6_prm_1" }, { "name": "label", "value": "AT-06_ODP[01]", "class": "sp800-53a" } ], "label": "frequency", "guidelines": [ { "prose": "frequency at which to provide feedback on organizational training results is defined;" } ] }, { "id": "at-06_odp.02", "props": [ { "name": "alt-identifier", "value": "at-6_prm_2" }, { "name": "label", "value": "AT-06_ODP[02]", "class": "sp800-53a" } ], "label": "personnel", "guidelines": [ { "prose": "personnel to whom feedback on organizational training results will be provided is/are assigned;" } ] } ], "props": [ { "name": "label", "value": "AT-06", "class": "zero-padded" }, { "name": "label", "value": "AT-6" }, { "name": "label", "value": "AT-06", "class": "sp800-53a" }, { "name": "sort-id", "value": "at-06" }, { "name": "implementation-level", "ns": "http://csrc.nist.gov/ns/rmf", "value": "organization" }, { "name": "contributes-to-assurance", "ns": "http://csrc.nist.gov/ns/rmf", "value": "true" } ], "parts": [ { "id": "at-6_smt", "name": "statement", "prose": "Provide feedback on organizational training results to the following personnel {{ insert: param, at-06_odp.01 }}: {{ insert: param, at-06_odp.02 }}." }, { "id": "at-6_gdn", "name": "guidance", "prose": "Training feedback includes awareness training results and role-based training results. Training results, especially failures of personnel in critical roles, can be indicative of a potentially serious problem. Therefore, it is important that senior managers are made aware of such situations so that they can take appropriate response actions. Training feedback supports the evaluation and update of organizational training described in [AT-2b](#at-2_smt.b) and [AT-3b](#at-3_smt.b)." }, { "id": "at-6_obj", "name": "assessment-objective", "props": [ { "name": "label", "value": "AT-06", "class": "sp800-53a" } ], "prose": "feedback on organizational training results is provided {{ insert: param, at-06_odp.01 }} to {{ insert: param, at-06_odp.02 }}.", "links": [ { "href": "#at-6_smt", "rel": "assessment-for" } ] }, { "id": "at-6_asm-examine", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "EXAMINE" }, { "name": "label", "value": "AT-06-Examine", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Security awareness and training policy\n\nprocedures addressing security training records\n\nsecurity awareness and training records\n\nsecurity plan\n\nother relevant documents or records" } ] }, { "id": "at-6_asm-interview", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "INTERVIEW" }, { "name": "label", "value": "AT-06-Interview", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Organizational personnel with information security training record retention responsibilities" } ] }, { "id": "at-6_asm-test", "name": "assessment-method", "props": [ { "name": "method", "ns": "http://csrc.nist.gov/ns/rmf", "value": "TEST" }, { "name": "label", "value": "AT-06-Test", "class": "sp800-53a" } ], "parts": [ { "name": "assessment-objects", "prose": "Mechanisms supporting the management of security training records" } ] } ] } ] }}