AT-02(04) Suspicious Communications and Anomalous System Behavior
All changes in this version
Title
Suspicious Communications and Anomalous System Behavior
Control
Provide literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using [Assignment: indicators of malicious code].
Discussion
A well-trained workforce provides another organizational control that can be employed as part of a defense-in-depth strategy to protect against malicious code coming into organizations via email or the web applications. Personnel are trained to look for indications of potentially suspicious email (e.g., receiving an unexpected email, receiving an email containing strange or poor grammar, or receiving an email from an unfamiliar sender that appears to be from a known sponsor or contractor). Personnel are also trained on how to respond to suspicious email or web communications. For this process to work effectively, personnel are trained and made aware of what constitutes suspicious communications. Training personnel on how to recognize anomalous behaviors in systems can provide organizations with early warning for the presence of malicious code. Recognition of anomalous behavior by organizational personnel can supplement malicious code detection and protection tools and systems employed by organizations.
Parameters
at-02.04_odp: indicators of malicious code
Assessment objective
AT-02(04) literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using [Assignment: indicators of malicious code] is provided.
STIG rules that implement this control 0
No followed STIG rule cites a CCI indexed to this control (CCI list 2026-07-14).