Awareness and Training (AT)
Level 2
Provide security awareness training on recognizing and reporting potential indicators of insider threat.
Awareness and Training (AT)
Level 3
Provide awareness training upon initial hire, following a significant cyber event, and at least annually, focused on recognizing and responding to threats from social engineering, advanced persistent threat actors, breaches, and suspicious behaviors; update the training at least annually or when there are significant changes to the threat.
Awareness and Training (AT)
Level 3
Include practical exercises in awareness training for all users, tailored by roles, to include general users, users with specialized roles, and privileged users, that are aligned with current threat scenarios and provide feedback to individuals involved in the training and their supervisors.
Audit and Accountability (AU)
Level 2
Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
Audit and Accountability (AU)
Level 2
Ensure that the actions of individual system users, can be uniquely traced to those users so they can be held accountable for their actions.
Audit and Accountability (AU)
Level 2
Review and update logged events.
Audit and Accountability (AU)
Level 2
Alert in the event of an audit logging process failure.
Audit and Accountability (AU)
Level 2
Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.
Audit and Accountability (AU)
Level 2
Provide audit record reduction and report generation to support on-demand analysis and reporting.
Audit and Accountability (AU)
Level 2
Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.
