Security Awareness Training Purpose The purpose of security and awareness training is to define the information security training requirements for [Agency] employees, contractors and third party users. Policy Security Awareness Training (AT 2) and Information Security Workforce (PM 13) [Agency] management shall require employees, contractors and third party users to apply security in accordance with established policies and procedures of the organization. Role-Based Security Training (AT 3) [Agency] shall impart appropriate awareness training and regular updates in organizational policies and procedures to all employees of the organization and to, contractors and third party users, as relevant for their job function. Training must be accompanied by an assessment procedure based on the cyber security training content presented in order to determine comprehension of key cyber security concepts and procedures. User access to [Agency] information assets and systems will only be authorized for those users whose cyber security awareness training is current (e.g., having passed the most recent required training stage). Testing, Training, and Monitoring (PM 14) [Agency] will appoint a cyber-security awareness training coordinator to manage training content, schedules and user training completion status. The [Agency] cyber security training coordinator, along with the agency CISO or security manager will review training content on an annual basis to ensure that it aligns with State of South Carolina policies. Policy Supplement A policy supplement has not been identified. Guidance NIST SP 800-53 Revision 4: AT 2 Security Awareness Training NIST SP 800-53 Revision 4: AT 3 Role-Based Security Training NIST SP 800-53 Revision 4: PM 13 Information Security Workforce NIST SP 800-53 Revision 4: PM 14 Testing, Training, and Monitoring Authentication: The process of establishing confidence in user identities through a well specified message exchange process that verifies possession of a password, token to remotely authenticate a claimant.
Security Awareness Training Purpose The purpose of security and awareness training is to define the information security training requirements for [Agency] employees, contractors and third party users. Policy Security Awareness Training (AT 2) and Information Security Workforce (PM 13) [Agency] management shall require employees, contractors and third party users to apply security in accordance with established policies and procedures of the organization. Role-Based Security Training (AT 3) [Agency] shall impart appropriate awareness training and regular updates in organizational policies and procedures to all employees of the organization and to, contractors and third party users, as relevant for their job function. Training must be accompanied by an assessment procedure based on the cyber security training content presented in order to determine comprehension of key cyber security concepts and procedures. User access to [Agency] information assets and systems will only be authorized for those users whose cyber security awareness training is current (e.g., having passed the most recent required training stage). Testing, Training, and Monitoring (PM 14) [Agency] will appoint a cyber-security awareness training coordinator to manage training content, schedules and user training completion status. The [Agency] cyber security training coordinator, along with the agency CISO or security manager will review training content on an annual basis to ensure that it aligns with State of South Carolina policies. Policy Supplement A policy supplement has not been identified. Guidance NIST SP 800-53 Revision 4: AT 2 Security Awareness Training NIST SP 800-53 Revision 4: AT 3 Role-Based Security Training NIST SP 800-53 Revision 4: PM 13 Information Security Workforce NIST SP 800-53 Revision 4: PM 14 Testing, Training, and Monitoring Authentication: The process of establishing confidence in user identities through a well specified message exchange process that verifies possession of a password, token to remotely authenticate a claimant.
Information%20Security%20Policy%20-%20HR%20and%20Security%20Awareness%209-25-2013.docx