4.3.2.1
Cyber Security Training
Cyber Security Training – The organization shall train employees on basic security practices, including but not limited to the following practices:
A) Compliance with password policies (see Subsection 5.5).
B) Identification of malicious communications and phishing.
C) Keeping employee devices and software updated.
D) Principle of least privilege and basic access controls.
-
5.10 Acceptable Use of Information and Other Associated Assets: Define, document, and enforce rules for acceptable use and handling of information assets.
6.3 Information Security Awareness, Education, and Training: The organization’s personnel and relevant parties should undergo suitable information security awareness, education, and training. They should also receive regular updates on the organization’s policies and procedures relevant to their roles.
-
3.2.1 Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
3.2.2 Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
3.2.3 Provide security awareness training on recognizing and reporting potential indicators of insider threat.
-
3.2.1 Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
3.2.2 Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
3.2.3 Provide security awareness training on recognizing and reporting potential indicators of insider threat.