14.9
IG2 IG3

Conduct Role>Specific Security Awareness and Skills Training

Asset Type: N/A
Security Function: Protect

Description

Conduct role-specific security awareness and skills training. Example implementations include secure system administration courses for IT professionals, OWASP® Top 10 vulnerability awareness and prevention training for web application developers, and advanced social engineering awareness training for high-profile roles.

Implementation Checklist

1
Assess current protection controls in place
2
Configure and deploy required security controls
3
Test control effectiveness in non-production environment
4
Deploy to production and verify functionality
5
Document configuration and operational procedures
6
Select and configure vulnerability scanning tool
7
Define scan scope, frequency, and credentials
8
Establish vulnerability remediation SLAs by severity
9
Create exception/waiver process for unremediated findings
10
Develop or procure training content
11
Define training audience and completion requirements
12
Deploy training and track completion rates
13
Measure training effectiveness through testing/simulation
14
Establish security awareness training program
15
Track training completion and measure effectiveness
16
Conduct phishing simulations

Threats & Vulnerabilities (CIS RAM)

Threat Scenarios

System Administrator Misconfigures Critical Security Control

Confidentiality

An IT administrator inadvertently opens a firewall rule too broadly or misconfigures a security group because they never received role-specific training on secure system administration practices.

Developer Introduces OWASP Top 10 Vulnerability into Production

Integrity

A web developer deploys code containing an injection vulnerability because they were never provided role-specific training on secure coding practices and common web application flaws.

Executive Targeted by Advanced Whaling Attack

Confidentiality

A C-level executive falls victim to a highly targeted whaling attack because they never received the advanced social engineering awareness training appropriate for their high-profile role.

Vulnerabilities (When Safeguard Absent)

No Role-Specific Security Skills Training

Without role-specific training, personnel in specialized positions such as developers, system administrators, and executives lack the targeted security knowledge required to protect against threats specific to their functions.

Generic Training Insufficient for Technical Roles

General awareness training alone does not equip developers with secure coding knowledge or administrators with hardening expertise, leaving critical technical security gaps in high-impact roles.

Evidence Requirements

Type Evidence Item Collection Frequency
Technical Configuration screenshots or exports showing protection controls enabled Captured quarterly
Document Procedure documentation for protection measures Reviewed annually
Technical Vulnerability scan reports showing scope and findings Per scan cycle
Record Vulnerability remediation tracking with SLA compliance metrics Monthly
Record Training completion records and compliance rates Tracked continuously, reported quarterly
Document Training content and curriculum documentation Reviewed annually
Document Governing policy document (current, approved, communicated) Reviewed annually