NIST 800-171 3.2 Awareness and Training
Awareness and Training asks that people know the risks of their work and the rules that apply, that those with security duties are trained for them, and that everyone can recognize and report signs of insider threat. The evidence is training content and completion records.
3 requirementsup to 11 SPRS points1 can go on a CMMC POA&M
The 3 Awareness and Training requirements
- 3.2.1 Security AwarenessAT.L2-3.2.1Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
- 3.2.2 Role-Based TrainingAT.L2-3.2.2Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
- 3.2.3 Insider ThreatAT.L2-3.2.3Provide security awareness training on recognizing and reporting potential indicators of insider threat.
Awareness and Training: points and the CMMC POA&M
- Q-01
How many SPRS points can the Awareness and Training family cost?
Up to 11 of the 313 points a score can lose: 2 worth 5 points and 1 worth 1.
- Q-02
Which Awareness and Training requirements can go on a CMMC POA&M?
1 of the 3: 3.2.3, worth 1 point. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.
Know the family. Keep the evidence for every requirement in it.
- Published
- Last updated
- Unchanged since publication