AT-2 (2) Security Awareness | Insider Threat (M) (H)

NIST 800-53 (r4) Control:

The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.

NIST 800-53 (r4) Supplemental Guidance:

Potential indicators and possible precursors of insider threat can include behaviors such as inordinate, long-term job dissatisfaction, attempts to gain access to information not required for job performance, unexplained access to financial resources, bullying or sexual harassment of fellow employees, workplace violence, and other serious violations of organizational policies, procedures, directives, rules, or practices. Security awareness training includes how to communicate employee and management concerns regarding potential indicators of insider threat through appropriate organizational channels in accordance with established organizational policies and procedures. Related controls: PL-4, PM-12, PS-3, PS-6.

References: C.F.R. Part 5 Subpart C (5 C.F.R 930.301); Executive Order 13587; NIST Special Publication 800-50.

NIST 800-53 (r5) Discussion:

Potential indicators and possible precursors of insider threat can include behaviors such as inordinate, long-term job dissatisfaction; attempts to gain access to information not required for job performance; unexplained access to financial resources; bullying or harassment of fellow employees; workplace violence; and other serious violations of policies, procedures, directives, regulations, rules, or practices. Literacy training includes how to communicate the concerns of employees and management regarding potential indicators of insider threat through channels established by the organization and in accordance with established policies and procedures. Organizations may consider tailoring insider threat awareness topics to the role. For example, training for managers may be focused on changes in the behavior of team members, while training for employees may be focused on more general observations.

38North Guidance:

Meets Minimum Requirement:

• Provides training on recognizing potential indicators of insider threat, such as inordinate, long-term job dissatisfaction; attempts to gain access to information not required for job performance; unexplained access to financial resources; bullying or harassment of fellow employees; workplace violence; and other serious violations of policies, procedures, directives, regulations, rules, or practices. The training includes how users should report indicators of insider threat.

• https://securityawareness.usalearning.gov/itawareness/index.htm# meets DoD Insider Threat Awareness Training Requirement.

Best Practice: None

Unofficial FedRAMP Guidance: None

Assessment Evidence:

• Security training curriculum which includes a section/module about indicators of insider threat and how to report them.

CSP Implementation Tips:

• Amazon Web Services (AWS): TBD

• Microsoft Azure: TBD

• Google Cloud Platform: TBD