id: "AT-02(01)" title: "Practical Exercises" family: "AT" family_name: "Awareness and Training" sort_id: "at-02.01" priority: "P2" implementation_level: "organization" parent: "AT-02" enhancement: True
Statement
Provide practical exercises in literacy training that simulate events and incidents.
Guidance
Practical exercises include no-notice social engineering attempts to collect information, gain unauthorized access, or simulate the adverse impact of opening malicious email attachments or invoking, via spear phishing attacks, malicious web links.
Assessment Objective
practical exercises in literacy training that simulate events and incidents are provided.
System security plan
privacy plan
security awareness and training policy
procedures addressing security awareness training implementation
security awareness training curriculum
security awareness training materials
other relevant documents or records
Organizational personnel who receive literacy training and awareness
organizational personnel with responsibilities for security awareness training
organizational personnel with information security responsibilities
Mechanisms implementing cyber-attack simulations in practical exercises