id: "AT-02(04)" title: "Suspicious Communications and Anomalous System Behavior" family: "AT" family_name: "Awareness and Training" sort_id: "at-02.04" priority: "P2" implementation_level: "organization" parent: "AT-02" enhancement: True
Statement
Provide literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using {{ insert: param, at-02.04_odp }}.
Guidance
A well-trained workforce provides another organizational control that can be employed as part of a defense-in-depth strategy to protect against malicious code coming into organizations via email or the web applications. Personnel are trained to look for indications of potentially suspicious email (e.g., receiving an unexpected email, receiving an email containing strange or poor grammar, or receiving an email from an unfamiliar sender that appears to be from a known sponsor or contractor). Personnel are also trained on how to respond to suspicious email or web communications. For this process to work effectively, personnel are trained and made aware of what constitutes suspicious communications. Training personnel on how to recognize anomalous behaviors in systems can provide organizations with early warning for the presence of malicious code. Recognition of anomalous behavior by organizational personnel can supplement malicious code detection and protection tools and systems employed by organizations.
Assessment Objective
literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using {{ insert: param, at-02.04_odp }} is provided.
System security plan
privacy plan
literacy training and awareness policy
procedures addressing literacy training and awareness implementation
literacy training and awareness curriculum
literacy training and awareness materials
other relevant documents or records
Organizational personnel who receive literacy training and awareness
organizational personnel with responsibilities for basic literacy training and awareness
organizational personnel with information security and privacy responsibilities