NIST SP 800-53A

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

FAMILY: AWARENESS AND TRAINING

CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

AT-1

SECURITY AWARENESS AND TRAINING POLICY AND PROCEDURES

AT-1.1

ASSESSMENT OBJECTIVE:

Determine if:

(i)

the organization develops and formally documents security awareness and training

policy;

(ii)

the organization security awareness and training policy addresses:

-

purpose;

-

scope;

-

roles and responsibilities;

-

management commitment; and

- coordination among organizational entities, and compliance;

(iii)

the organization disseminates formal documented security awareness and training

policy to elements within the organization having associated security awareness and

training roles and responsibilities;

(iv)

the organization develops and formally documents security awareness and training

procedures;

(v)

the organization security awareness and training procedures facilitate

implementation of the security awareness and training policy and associated

security awareness and training controls; and

(vi)

the organization disseminates formal documented security awareness and training

procedures to elements within the organization having associated security

awareness and training roles and responsibilities.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security awareness and training policy and procedures; other relevant

documents or records].

Interview: [SELECT FROM: Organizational personnel with security awareness and training

responsibilities].

AT-1.2

ASSESSMENT OBJECTIVE:

Determine if:

(i)

the organization defines the frequency of security awareness and training policy

reviews/updates;

(ii)

the organization reviews/updates security awareness and training policy in

accordance with organization-defined frequency;

(iii)

the organization defines the frequency of security awareness and training procedure

reviews/updates; and

(iv)

the organization reviews/updates security awareness and training procedures in

accordance with organization-defined frequency.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Security awareness and training policy and procedures; other relevant

documents or records].

Interview: [SELECT FROM: Organizational personnel with security awareness and training

responsibilities].

APPENDIX F-AT

PAGE F-51

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

FAMILY: AWARENESS AND TRAINING

CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

AT-2

SECURITY AWARENESS

AT-2.1

ASSESSMENT OBJECTIVE:

Determine if:

(i)

the organization provides basic security awareness training to all information

system users (including managers, senior executives, and contractors) as part of

initial training for new users and when required by system changes;

(ii)

the organization defines the frequency of refresher security awareness training;

(iii)

the organization provides refresher security awareness training in accordance with

the organization-defined frequency;

APPENDIX F-AT

PAGE F-52

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

FAMILY: AWARENESS AND TRAINING

CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

AT-3

SECURITY TRAINING

AT-3.1

ASSESSMENT OBJECTIVE:

Determine if:

(i)

the organization provides role-based security-related training before authorizing

access to the system or performing assigned duties, and when required by system

changes;

(ii)

the organization defines the frequency of refresher role-based security-related

training;

(iii)

the organization provides refresher role-based security-related training in

accordance with the organization-defined frequency.

APPENDIX F-AT

PAGE F-53

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

APPENDIX F-AT

PAGE F-54

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

FAMILY: AWARENESS AND TRAINING

CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

AT-4

SECURITY TRAINING RECORDS

AT-4.1

ASSESSMENT OBJECTIVE:

Determine if:

(i)

the organization documents and monitors individual information system security

training activities including basic security awareness training and specific

information system security training;

(ii)

the organization defines the time period for retaining individual training records;

and

(iii)

the organization retains individual training records in accordance with the

organization-defined time period.

APPENDIX F-AT

PAGE F-55

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

FAMILY: AWARENESS AND TRAINING

CLASS: OPERATIONAL

ASSESSMENT PROCEDURE

AT-5

CONTACTS WITH SECURITY GROUPS AND ASSOCIATION

AT-5.1

ASSESSMENT OBJECTIVE:

Determine if the organization establishes and institutionalizes contact with selected

groups and associations within the security community:

- to facilitate ongoing security education and training for organizational personnel;

- to stay up to date with the latest recommended security practices, techniques, and

technologies; and

- to share current security-related information including threats, vulnerabilities, and

incidents.

APPENDIX F-AT

PAGE F-56

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

FAMILY: AUDIT AND ACCOUNTABILITY

CLASS: TECHNICAL

ASSESSMENT PROCEDURE

AU-1

AUDIT AND ACCOUNTABILITY POLICY AND PROCEDURES

AU-1.1

ASSESSMENT OBJECTIVE:

Determine if:

(i)

the organization develops and formally documents audit and accountability policy;

(ii)

the organization audit and accountability policy addresses:

-

purpose;

-

scope;

-

roles and responsibilities;

-

management commitment;

- coordination among organizational entities; and

-

compliance;

(iii)

the organization disseminates formal documented audit and accountability policy to

elements within the organization having associated audit and accountability roles

and responsibilities;

(iv)

the organization develops and formally documents audit and accountability

procedures;

(v)

the organization audit and accountability procedures facilitate implementation of

the audit and accountability policy and associated audit and accountability controls;

and

(vi)

the organization disseminates formal documented audit and accountability

procedures to elements within the organization having associated audit and

accountability roles and responsibilities.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy and procedures; other relevant documents or

records].

Interview: [SELECT FROM: Organizational personnel with audit and accountability responsibilities].

AU-1.2

ASSESSMENT OBJECTIVE:

Determine if:

(i)

the organization defines the frequency of audit and accountability policy

reviews/updates;

(ii)

the organization reviews/updates audit and accountability policy in accordance with

organization-defined frequency;

(iii)

the organization defines the frequency of audit and accountability procedure

reviews/updates; and

(iv) the organization reviews/updates audit and accountability procedures in

accordance with organization-defined frequency.

POTENTIAL ASSESSMENT METHODS AND OBJECTS:

Examine: [SELECT FROM: Audit and accountability policy and procedures; other relevant documents or

records].

Interview: [SELECT FROM: Organizational personnel with audit and accountability responsibilities].

APPENDIX F-AU

PAGE F-57

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

FAMILY: AUDIT AND ACCOUNTABILITY

CLASS: TECHNICAL

ASSESSMENT PROCEDURE

AU-2

AUDITABLE EVENTS

AU-2.1

ASSESSMENT OBJECTIVE:

Determine if:

(i)

the organization defines the list of events the information system must be capable of

auditing based on a risk assessment and mission/business needs;

(ii)

the organization coordinates the security audit function with other organizational

entities requiring audit-related information to enhance mutual support and help

guide the selection of auditable events;

(iii)

the organization provides a rationale for why the list of auditable events are deemed

to be adequate to support after-the-fact investigations of security incidents;

(iv)

the organization defines the subset of auditable events defined in (i) that are to be

audited within the information system and the frequency of (or situation requiring)

auditing for each identified event; and

(v)

the organization determines, based on current threat information and ongoing

assessment of risk, the subset of

auditable events defined in (i) to be audited within

the information system, and the

frequency of (or situation requiring) auditing for

each identified event .

APPENDIX F-AU

PAGE F-58

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

APPENDIX F-AU

PAGE F-59

Special Publication 800-53A

Guide for Assessing the Security Controls in

Federal Information Systems and Organizations

FAMILY: AUDIT AND ACCOUNTABILITY

CLASS: TECHNICAL

ASSESSMENT PROCEDURE

AU-3

CONTENT OF AUDIT RECORDS

AU-3.1

ASSESSMENT OBJECTIVE:

Determine if the information system produces audit records that contain sufficient

information to, at a minimum, establish:

- what type of event occurred;

- when (date and time) the event occurred;

- where the event occurred;

- the source of the event;

- the outcome (success or failure) of the event; and

- the identity of any user/subject associated with the event.

APPENDIX F-AU

PAGE F-60