Task 2 RMF_Security Awareness and Training Plan.docx

{COMMAND}

{SYSTEM NAME} {ACRONYM}

System Version: {VERSION} eMASS# {EMASS#}

Confidentiality: {CONFIDENTIALITY} Integrity: {INTEGRITY} Availability: {AVAILABILITY}

Department of the {SERVICE}

{LOGO}

Security Awareness and Training Plan Document Version: 1.0.0

{DATE}

Prepared by: {ORGANIZATION}

DISTRIBUTION IS LIMITED TO U.S. GOVERNMENT AGENCIES AND THEIR CONTRACTORS.

OTHER REQUESTS FOR THIS DOCUMENT MUST BE REFERRED TO: {ORGANIZATION}

Change Record

Amplifying Guidance

i. Department of Defense Directive Number 8140.01, "Cyberspace Workforce Management"

ii. NIST Special Publication 800-50, "Building an Information Technology Security Awareness and Training Program"

iii. NIST Special Publication 800-16, "Information Technology Security Training Requirements"

Table of Contents

Figure 1 - Cybersecurity Roles 3

FOR OFFICIAL USE ONLY

{ACRONYM}

SECURITY AWARENESS AND TRAINING PLAN {DATE}

Template developed by:

http://www.i-assure.com FOR OFFICIAL USE ONLY

1.0 OVERVIEW

Federal agencies and organizations cannot protect the confidentiality, integrity, and availability of information in today’s highly networked systems environment without ensuring that all people involved in using and managing IT:

1) Understand their roles and responsibilities related to the organizational mission;

2) Understand the organization’s IT security policy, procedures, and practices; and

3) Have at least adequate knowledge of the various management, operational, and technical controls required and available to protect the IT resources for which they are responsible.

As cited in audit reports, periodicals, and conference presentations, it is generally understood by the IT security professional community that people are one of the weakest links in attempts to secure systems and networks. The “people factor” - not technology - is key to providing an adequate and appropriate level of security. If people are the key, but are also a weak link, more and better attention must be paid to this “asset.”

This plan does not claim to cover all possible means of security awareness and training. Higher level guidance is contained within the Amplifying Guidance section of this document.

This document complies with the following requirements from NIST Special Publication 800-53 Revision 4, "Security and Privacy Controls for Federal Information Systems and Organizations". A detailed compliance matrix can be found in Appendix A, “Detailed Compliance Matrix”.

Table 1 - SP-800-53v4 Compliance Matrix

1.1 Applicability

This Security Awareness and Training Plan applies to {ACRONYM} and all of its users.

IT has enabled the Department of Defense to transmit, communicate, collect, process, and store unprecedented amounts of information. Increasing dependence on information systems has focused attention on the need to ensure that these assets, and the information they process, are protected from actions that would jeopardize the DoD’s ability to effectively function. Responsibility for securing the Department’s information and systems lies with the DoD Components. The trained and aware user is the first and most vital line of defense.

Cyber training must be current, engaging, and relevant to the target audience to enhance its effectiveness. Its primary purpose is to educate and influence behavior. The focus must be on education and awareness of threats and vulnerabilities so users do not perform actions that lead to or enable exploitations of the DoD ISs. Authorized users must understand that they are a critical link in their organization’s overall IA success.

DISA’s DoD Cyber Awareness Challenge is the DoD baseline standard. It meets all DoD level requirements for end user awareness training. DISA will ensure it provides distributive awareness content to address evolving requirements promulgated by Congress, the OMB under the ISS LoB for Tier I, or the Office of the Secretary of Defense.

The DoD Components are required to use the DoD SSC as their Cyber Awareness Provider. The DoD Cyber Awareness Challenge will be used to meet the initial and annual training mandated by DoD regulations.

To ensure understanding of the critical importance of Cyber, all individuals with access to DoD IT systems are required to receive and complete initial Cyber awareness training before being granted access to the system(s) and annual Cyber awareness training to retain access.

All training is tracked at the {COMMAND} level.

2.2 Privileged User Training

A privileged user is a user that is authorized (and, therefore, trusted) to have elevated rights to perform security-relevant functions that ordinary users are not authorized to perform. A number of high profile security incidents over the last year have proven, yet again, that privileged users -- administrators, contractors, and others with system-level access to IT infrastructure -- are a critical element of {ACRONYM}'s overall risk profile.

In addition to signing a Privileged Access Agreement for prior to account creation, individuals will take the Privileged User Training created by DISA.

All training is tracked at the {COMMAND} level.

2.3 Role-Based Training

DISA has gathered inputs from the USCYBERCOM, National Initiative for Cyberspace Education (NICE) and other partners to provide a catalog of training resources that are categorized by cyber work roles. The work roles used on this site were taken from USCYBERCOM's Joint Cyberspace Training & Certification Standard (JCT&CS) v1.2, 7 Feb 2012. As the cyber work role process matures it will be integrated into future policy and doctrine to better recruit, train, promote and retain a superior cyberspace workforce.

While the cyber work roles may correlate to military specialties and civilian occupational classifications, they are not intended to be synonymous with discrete job positions. Each work role is listed with the associated tasks that an individual may be expected to perform the requisite skill sets needed to perform the work role tasks as related to conducting missions that span the three Lines of Operations (LOO): DoD DGO, DCO and OCO. As noted below in the diagram a cyberspace professional need to fill both a supporting and an operational warfighting role when operating in the Joint Information Environment (JIE).

The cyber role tasks and skill associated sets establish a proficiency baseline for a workforce capable of integrating, synchronizing, and executing sustained cyber space operations designed to achieve strategic, operational and tactical objectives. Future cyber training assessments will ensure development of necessary knowledge and skills required for increased competency in accomplishing DoD individual, staff and collective tasks. The following figure displays the USCYBERCOM cyberspace roles organized by Lines of Operations:

Server Administrator

CYBER Roles

CND Analyst

Systems Security Analyst

Systems Test & Eval Specialist Software Engineer

Intel Analyst

Network Operations Manager

CND Forensic Analyst

CND Incident Responder

Agent

Endpoint Exploit Analyst

Cyber Security/ IS Professional

Cryptographic Cyber Planner

CND Manager

Technical Support Specialist

Systems Developer

BDA Analyst

Forensic Analyst

Interactive Operator

CND Auditor

Test & Eval Engineer

Operational Target Dev Analyst

Production Operator

Assessment Analyst

Partner Ops Planner

Digital Network Exploit Analyst

Close Access Network Operator

Network Warfare Cyber Planner

R&D Engineer

Target Digital Network Analyst

Legal Advisor/ SJA

Cyber Policy & Strategy Planner

Target Analyst Reporter

Figure 1 - Cybersecurity Roles Lines of Operation Definitions:

1) Combat Element: Operational element of the Cyberspace organization

2) Combat Support: Operational assistance provided to combat elements. (Source: JP 4-0)

3) Defensive Cyberspace Operations: Passive and active cyberspace operations intended to preserve the ability to utilize friendly cyberspace capabilities and protect data, networks, net-centric capabilities, and other designated systems. Also called DCO. (Source: JP 3-12)

4) DoD Global Information Grid Operations: Employment of manual and automated methods to preserve and sustain the availability, confidentiality, integrity and non-repudiation of military information networks. The DoD GIG is the globally interconnected, end-to-end set of information capabilities, and associated processes for collecting, processing, storing, disseminating, and managing information on demand to warfighters, policy makers, and support personnel. The Global Information Grid includes owned and leased communications and computing systems and services, software (including applications), data, security services, other associated services and National Security Systems.

5) Offensive Cyberspace Operations: Cyberspace operations intended to project power by the application of force in or through cyberspace. Also called OCO. (Source: JP 3-12) The following table contains training resources based on assigned role:

Intermediate Advanced Tasks KSAs

Intermediate Advanced Tasks KSAs

Intermediate Advanced Tasks KSAs

Intermediate Advanced Tasks KSAs

Intermediate Advanced Tasks KSAs

Intermediate Advanced Tasks KSAs

Intermediate Advanced Tasks KSAs

Intermediate Advanced Tasks KSAs

Intermediate Advanced Tasks KSAs

Intermediate Advanced Tasks KSAs

Intermediate Advanced Tasks KSAs

Intermediate Advanced Tasks KSAs

Intermediate Advanced Tasks KSAs

Intermediate Advanced Tasks KSAs

Table 2 - Cybersecurity Roles

The following physical security controls have been documented as requiring training:

Implementing Effective Physical Security Countermeasures

Table 3 - Physical Security Control Training

3.2 Personnel and Roles

The following roles have been identified as requiring physical security training:

Security Manager

Choose an item.

Table 4 - Physical Security Roles and Personnel

4.0 MALICIOUS CODE TRAINING

A well-trained workforce provides another organizational safeguard that can be employed as part of a defense-in-depth strategy to protect {ACRONYM} against malicious code coming in to {ACRONYM} via email or the web applications. Personnel are trained to look for indications of potentially suspicious email (e.g., receiving an unexpected email, receiving an email containing strange or poor grammar, or receiving an email from an unfamiliar sender but who appears to be from a known sponsor or contractor). Personnel are also trained on how to respond to such suspicious email or web communications (e.g., not opening attachments, not clicking on embedded web links, and checking the source of email addresses). For this process to work effectively, all {ACRONYM} personnel are trained and made aware of what constitutes suspicious communications. Training personnel on how to recognize anomalous behaviors in {ACRONYM} information systems can potentially provide early warning for the presence of malicious code. Recognition of such anomalous behavior by {ACRONYM} personnel can supplement automated malicious code detection and protection tools and systems employed by {ACRONYM}.

DISA’s DoD Cyber Awareness Challenge contains the following modules that meet the DoD requirement for malicious code training.

Malicious code can do damage by corrupting files, erasing your hard drive, and/or allowing hackers access. Malicious code includes viruses, Trojan horses, worms, macros, and scripts and can be spread by e-mail attachments, downloading files, and visiting infected Websites. To prevent viruses and the download of malicious code:

a) Turn off automatic downloading

b) Scan all external files before uploading to your computer

c) Don’t e-mail infected files to anyone

d) Don’t access Websites in e-mail or popups Mobile Code Tips - Mobile code can be malicious code. To prevent damage from malicious mobile code:

a) Require confirmation before enabling ActiveX or other mobile code technology

b) Only allow mobile code to run from your organization or your organization’s trusted sites

c) Contact your security POC or help desk for assistance, especially with e-mails requesting personal information

APPENDIX A – DETAILED COMPLIANCE MATRIX

The following table provides traceability between this document and the Assessment Procedures contained within NIST Special Publication 800-53A Revision 4, "Assessing Security and Privacy Controls in Federal Information Systems and Organizations".

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the roles as organizational personnel with security awareness and training responsibilities.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the roles as organizational personnel with security awareness and training responsibilities.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.

Comment:

The organization's use of their higher command policy/procedures meets this requirement if more stringent.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.

DoD has defined the roles as organizational personnel with security awareness and training responsibilities.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as reviewed annually - updated as appropritate but at least within 10 years of date of issuance.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.

DoD has defined the frequency as annually.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as reviewed annually - updated as appropriate.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level (DoDD 8570.01).

DoD has defined the frequency as annually.

Automatically compliant with this CCI because they are covered at the DoD level

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The IA Awareness CBT, "Cyber Awareness Challenge," and Virtual Training Environment (VTE) Courses: "Introduction to Insider Threat" and "Monitoring for Insider Threat" available on the IASE website meet the DoD requirement to include security awareness training on recognizing and reporting potential indicators of insider threat.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level training available on the IASE website.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures. DISA's DoD IA awareness CBT is the DoD baseline standard.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures. DISA's DoD IA awareness CBT is the DoD baseline standard.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures. DISA's DoD IA awareness CBT is the DoD baseline standard.

DoD Components are automatically compliant with this CCI because they are covered by the DoD level policy, DoDD 8570.01.

Automatically compliant with this CCI because they are covered at the DoD level

1. Documentation of environmental controls that require training.

2. Documented list of personnel defined in AT-3 (1), CCI 2050

3. Ensures identified personnel have received the initial training.

NIST has not allocated this AP. Therefore, this AP is not applicable.

2. Documented list of personnel defined in AT-3 (1), CCI 2050

3. Ensures identified personnel have received training annually.

DoD has defined the frequency as annually.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.

NIST has not allocated this AP. Therefore, this AP is not applicable.

DoD has defined the frequency as annual.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines:

1. Documentation of physical security controls that require training.

2. Documented list of personnel defined in AT-3 (2), CCI 2051

3. Ensures identified personnel have received the initial training.

Section 3.1 Section 3.2

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines:

1. Documentation of physical security controls that require training.

2. Documented list of personnel defined in AT-3 (2), CCI 2051

3. Ensures identified personnel have received training annually.

DoD has defined the frequency as annual.

Section 3.1 Section 3.2

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented personnel or roles to ensure the organization being inspected/assessed defines the personnel or roles to whom initial and refresher training in the employment and operation of physical security controls is to be provided.

DoD has determined the personnel or roles are not appropriate to define at the Enterprise level.

Section 3.2

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as annual.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines the documented indicators to ensure the organization being inspected/assessed defines indicators of malicious code to recognize suspicious communications and anomalous behavior in organizational information systems.

DoD has determined the indicators are not appropriate to define at the Enterprise level.

Section 4

Moderate Low High Moderate Low High Moderate Low DoDD 8570.01 meets the DoD requirement for IA awareness training policy and procedures. DISA's DoD IA awareness CBT for privileged users is the DoD baseline standard.

DoD Components are automatically compliant with this control because they are covered by the DoD level policy, DoDD 8570.01.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines documented records (IAW AT-4) of their privileged users training.

Section 2.2

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as annually.

Automatically compliant with this CCI because they are covered at the DoD level

Moderate Low High Moderate Low High Moderate Low

Section 2.3

Moderate Low High Moderate Low High Moderate Low

Moderate Low High Moderate Low High Moderate Low The organization conducting the inspection/assessment obtains and examines training records to ensure records have been maintained for at least 5 years or 5 years after completion of a specific training program.

DoD has defined the frequency as at least 5 years or 5 years after completion of a specific training program.

Externally available

Moderate Low High Moderate Low High Moderate Low The organization being inspected/assessed is automatically compliant with this CCI because they are covered at the DoD level.

DoD has defined the frequency as at least 5 years or 5 years after completion of a specific training program.

Automatically compliant with this CCI because they are covered at the DoD level

APPENDIX B – TRAINING RESOURCES

The below resources have been compiled to assist with Security Awareness Training requirements. Additional, commercial-based training, may be used to supplement in-house DoD provided training.

· Federal Virtual Training Environment

· Center for Development of Security Excellence

· DISA Cybersecurity Online Training

· DISA Cybersecurity Classroom Training

· DISA Cybersecurity Role-based Training

· Cyber Awareness Presentations

· National Security Agency Guidance for Addressing Malicious Code Risk

FOR OFFICIAL USE ONLY 6

image1.gif image2.png