The organization: a. Develops, documents, and disseminates to {{ insert: param, at-1_prm_1 }}: 1. A security awareness and training policy that addresses purpose, scope, roles, responsibiliti...

The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors): a. As part of initial training for new users; b...

The organization includes practical exercises in security awareness training that simulate actual cyber attacks.

The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.

The organization provides role-based security training to personnel with assigned security roles and responsibilities: a. Before authorizing access to the information system or performing assigne...

The organization provides {{ insert: param, at-3.1_prm_1 }} with initial and {{ insert: param, at-3.1_prm_2 }} training in the employment and operation of environmental controls.

The organization provides {{ insert: param, at-3.2_prm_1 }} with initial and {{ insert: param, at-3.2_prm_2 }} training in the employment and operation of physical security controls.

The organization includes practical exercises in security training that reinforce training objectives.

The organization provides training to its personnel on {{ insert: param, at-3.4_prm_1 }} to recognize suspicious communications and anomalous behavior in organizational information systems.

The organization: a. Documents and monitors individual information system security training activities including basic security awareness training and specific information system security trainin...