BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

03.02.02 Role-Based Training

NIST SP 800-171 Rev 3 (CUI; CMMC Level 2) OSCAL 1.1.0 against OSCAL 1.1.0
All changes in this version
unchanged 03.02 Awareness and Training

Title

Role-Based Training

Control

a. Provide role-based security training to organizational personnel:
a.01. Before authorizing access to the system or CUI, before performing assigned duties, and [Assignment: frequency] thereafter
a.02. When required by system changes or following [Assignment: events].
b. Update role-based training content [Assignment: frequency] and following [Assignment: events].

Discussion

Organizations determine the content and frequency of security training based on the assigned duties, roles, and responsibilities of individuals and the security requirements of the systems to which personnel have authorized access. In addition, organizations provide system developers, enterprise architects, security architects, software developers, systems integrators, acquisition/procurement officials, system and network administrators, personnel conducting configuration management and auditing activities, personnel performing independent verification and validation, security assessors, and personnel with access to system-level software with security-related technical training specifically tailored for their assigned duties. Comprehensive role-based training addresses management, operational, and technical roles and responsibilities that cover physical, personnel, and technical controls. Such training can include policies, procedures, tools, and artifacts for the security roles defined. Organizations also provide the training necessary for individuals to carry out their responsibilities related to operations and supply chain security within the context of organizational information security programs.

Parameters

A.03.02.02.ODP.01: frequency
A.03.02.02.ODP.02: events
A.03.02.02.ODP.03: frequency
A.03.02.02.ODP.04: events

Assessment objective

role-based security training is provided to organizational personnel before authorizing access to the system or CUI.