Overview:
Provide security awareness training on recognizing and reporting potential indicators of insider threat.
Action Items:
3.2.3[a]
Determine if: potential indicators associated with insider threats are identified.
3.2.3[b]
Determine if: security awareness training on recognizing and reporting potential indicators of insider threat is provided to managers and employees.
POTENTIAL ASSESSMENT METHODS AND OBJECTS
1
Examine: Security awareness and training policy; procedures addressing security awareness training implementation; security awareness training curriculum; security awareness training materials; insider threat policy and procedures; system security plan; other relevant documents or records].
2
Interview: Personnel that participate in security awareness training; personnel with responsibilities for basic security awareness training; personnel with information security responsibilities].
3
Test: Mechanisms managing insider threat training].
Related Documents (document name and content will vary by organization):
1) Security awareness and training policy
2) procedures addressing security awareness training implementation
3) security awareness training curriculum
4) security awareness training materials
5) insider threat policy and procedures
6) system security plan
7) other relevant documents or records
Additional Guidance:
Potential indicators and possible precursors of insider threat include behaviors such as: inordinate, long-term job dissatisfaction; attempts to gain access to information that is not required for job performance; unexplained access to financial resources; bullying or sexual harassment of fellow employees; workplace violence; and other serious violations of organizational policies, procedures, directives, rules, or practices. Security awareness training includes how to communicate employee and management concerns regarding potential indicators of insider threat through appropriate organizational channels in accordance with established organizational policies and procedures. Organizations may consider tailoring insider threat awareness topics to the role (e.g., training for managers may be focused on specific changes in behavior of team members, while training for employees may be focused on more general observations).
Article ID: 130
Created: September 26, 2022
Last Updated: September 27, 2022
Author: Matthew Burdick
Online URL: http://www.compliancewiki.org/article/nist-800-171-insider-threat-training-3-2-3-130.html