3.2.2e

Include practical exercises in awareness training for [Assignment: organization-defined roles] that are aligned with current threat scenarios and provide feedback to individuals involved in the training and their supervisors.

DISCUSSION

Awareness training is most effective when it is complemented by practical exercises tailored to the tactics, techniques, and procedures (TTP) of the threat. Examples of practical exercises include unannounced social engineering attempts to gain unauthorized access, collect information, or simulate the adverse impact of opening malicious email attachments or invoking, via spear phishing attacks, malicious web links. Rapid feedback is essential to reinforce desired user behavior. Training results, especially failures of personnel in critical roles, can be indicative of a potentially serious problem. It is important that senior management are made aware of such situations so that they can take appropriate remediating actions.

[SP 800-181] provides guidance on role-based security training, including a lexicon and taxonomy that describes cybersecurity work via work roles.

PROTECTION STRATEGY

Damage-Limiting Operations.

ADVERSARY EFFECTS

See [SP 800-160-2]: [Impede (Exert); Expose (Detect)].

ASSESSMENT OBJECTIVE

Determine if:

3.2.2e_ODP[1] Roles to be included in awareness training practical exercises are defined.

3.2.2e[a] Practical exercises are identified.

3.2.2e[b] Current threat scenarios are identified.

3.2.2e[c] Individuals involved in training and their supervisors are identified.

3.2.2e[d] Practical exercises that are aligned with current threat scenarios are included in awareness training for <3.2.2e_ODP[1]: roles>.

3.2.2e[e] Feedback is provided to individuals involved in the training and their supervisors.

POTENTIAL ASSESSMENT METHODS AND OBJECTS

Examine: [SELECT FROM: Awareness training policy; procedures addressing awareness training implementation; appropriate codes of federal regulations; awareness training curriculum; awareness training materials; security plan; training records; threat information on social engineering, advanced persistent threat actors, suspicious behaviors, breaches, or other relevant adversary tactics, techniques, or procedures; feedback on practical exercises and awareness training; other relevant documents or records].

Interview: [SELECT FROM: Organizational personnel responsible for awareness training; organizational personnel responsible for information security; organizational personnel with roles identified for practical exercises; supervisors of personnel with roles identified for practical exercises].

Test: [SELECT FROM: Mechanisms managing awareness training; mechanisms managing threat information].