NIST SP 800-171 & CMMC 2.0 3.2.3 Requirement:
Provide security awareness training on recognizing and reporting potential indicators of insider threat.
NIST SP 800-171 & CMMC 2.0 3.2.3 Requirement Explanation:
A large number of security breaches result from insider threats. Insider threats can result from employee negligence or malicious behavior. Employees need to be trained to identify insider threats and report them to the appropriate persons.
Example NIST SP 800-171 & CMMC 2.0 3.2.3 Implementation:
As part of your annual security awareness training, teach employees how to identify insider threats. The Center for Development of Security Excellence (CDSE) has a free online course called "Insider Threat Awareness". Require all personnel to complete the course.
NIST SP 800-171 & CMMC 2.0 3.2.3 Scenario(s):
- Scenario 1:
To provide insider threat awareness training you require employees to complete an online course. At the end of this free online course your employees are awarded a certificate of completion. Employees are required to take the course annually.
- Scenario 2:
Your employees have all received insider threat awareness training. One employee notices another employee who always stays at the office late into the night. The employee reports this suspicious activity to management. An internal investigation determined that the employee was scanning paperwork containing CUI and saving it to a personal thumb drive. The employee is sanctioned for his actions.
Quick & Simple
Discover Our Cybersecurity Compliance Solutions:
Whether you need to meet and maintain your compliance requirements, help your clients meet them, or verify supplier compliance we have the expertise and solution for you
NIST SP 800-171 & CMMC Compliance
Become compliant, provide compliance services, or verify partner compliance with NIST SP 800-171 and CMMC requirements.
HIPAA Compliance
Become compliant, provide compliance services, or verify partner compliance with HIPAA security rule requirements.
FAR 52.204-21 Compliance
Become compliant, provide compliance services, or verify partner compliance with FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems requirements.
ISO 27001 Compliance
Become compliant, provide compliance services, or verify partner compliance with ISO 27001 requirements.