AT-3(3)

Requirement

Provide practical exercises in security and privacy training that reinforce training objectives.

Discussion

Practical exercises for security include training for software developers that addresses simulated attacks that exploit common software vulnerabilities or spear or whale phishing attacks targeted at senior leaders or executives. Practical exercises for privacy include modules with quizzes on identifying and processing personally identifiable information in various scenarios or scenarios on conducting privacy impact assessments.

NIST 800-53A Assessment Guidance

Examine

[SELECT FROM: Security and privacy awareness and training policy; procedures addressing security and privacy awareness training implementation; security and privacy awareness training curriculum; security and privacy awareness training materials; security and privacy awareness training reports and results; system security plan; privacy plan; other relevant documents or records].

Interview

[SELECT FROM: Organizational personnel with responsibilities for role-based security and privacy training; organizational personnel who participate in security and privacy awareness training].

ID	Assessment Objectives
AT-03(03)[01]	practical exercises in security training that reinforce training objectives are provided;
AT-03(03)[02]	practical exercises in privacy training that reinforce training objectives are provided.

Our CMMC Overview Course simplifies CMMC. Enroll so you can make informed decisions!