NIST SP 800-171 & CMMC 2.0 Control 3.2.3 Requirement:
Provide security awareness training on recognizing and reporting potential indicators of insider threat.
NIST SP 800-171 & CMMC 2.0 3.2.3 Requirement Explanation:
A large number of security breaches result from insider threats. Insider threats can result from employee negligence or malicious behavior. Employees need to be trained to identify insider threats and report them to the appropriate persons.
Example NIST SP 800-171 & CMMC 2.0 3.2.3 Implementation:
As part of your annual security awareness training, teach employees how to identify insider threats. The Center for Development of Security Excellence (CDSE) has a free online course called "Insider Threat Awareness". Require all personnel to complete the course.
NIST SP 800-171 & CMMC 2.0 3.2.3 Scenario(s):
- Scenario 1:
To provide insider threat awareness training you require employees to complete an online course. At the end of this free online course your employees are awarded a certificate of completion. Employees are required to take the course annually.
- Scenario 2:
Your employees have all received insider threat awareness training. One employee notices another employee who always stays at the office late into the night. The employee reports this suspicious activity to management. An internal investigation determined that the employee was scanning paperwork containing CUI and saving it to a personal thumb drive. The employee is sanctioned for his actions.
Discover Our NIST SP 800-171 & CMMC 2.0 Solutions:
Power through compliance. Meet and maintain your NIST SP 800-171 & CMMC 2.0 compliance requirements.
Transform your business. Create new revenue streams and provide scalability for your NIST SP 800-171 and CMMC 2.0 services.
Supply Chain Verifier
Trust is everything. Verify, monitor, and support subcontactor compliance.