CMMC 1.0 Practice AT.3.058 Requirement:
Provide security awareness training on recognizing and reporting potential indicators of insider threat.
CMMC 1.0 AT.3.058 Requirement Explanation:
A large number of security breaches result from insider threats. Insider threats can result from employee negligence or malicious behavior. Employees need to be trained to identify insider threats and report them to the appropriate persons.
Example CMMC 1.0 AT.3.058 Implementation:
As part of your annual security awareness training, teach employees how to identify insider threats. This can be a few slides in your security awareness slide deck or separate online course. The U.S. has a free course online called "Insider Threat Awareness".
CMMC 1.0 AT.3.058 Scenario(s):
- Scenario 1:
To provide insider threat awareness training you require employees to complete an online course. At the end of this free government provided course your employees are awarded a certificate of completion. Employees are required to take the course annually.
- Scenario 2:
Your employees have all received insider threat awareness training. One employee notices another employee who always stays at the office late into the night. The employee reports this suspicious activity to management. An internal investigation determined that the employee was scanning paperwork containing CUI and saving it to a personal thumb drive. The employee is sanctioned for his actions.
Quick & Simple
Discover Our Cybersecurity Compliance Solutions:
Whether you need to meet and maintain your compliance requirements, help your clients meet them, or verify supplier compliance we have the expertise and solution for you