Policy 7230A - Department of Administration

3. Awareness & Operations Training
These Awareness and Operations Training Mandatory Baselines support the Enterprise
Security Policy (ITEC 7230 Rev 1), the Security Awareness Training Policy (ITEC 7400), and
the Security Awareness Requirements (ITEC 7400A).
Mandatory
Non-Mandatory
Procedures Baselines Procedures Baselines
3. Awareness & Training
3.1. Security Awareness Training
3.1.1. Design and Develop an Awareness Training Program (2 sets) (1 set)
3.1.2. Provide Awareness Training (2 sets) (1 set)
3.2. Security Operations Training
3.2.1. Design and Develop an Operations Training Program (2 sets) (1 set)
3.2.2. Provide Operations Training (3 sets) (2 sets)
3.3. Maintain Records
3.1. Security Awareness Training
The following are the Mandatory Baselines that support the Security Awareness
Training section of the Default Security Requirements:
3.1.1. Design and Develop an Awareness Training Program
Create a program and supporting materials that are appropriate to the needs
of the agency:
3.1.1.a Awareness Training Requirements
• At a minimum, security awareness training will address the
following:
o The creation and maintenance of passwords, including
the need to maintain password confidentiality.
o Detecting, avoiding and responding to Social
Engineering.
o Detecting, avoiding and responding to Identity Theft.
o Detecting, avoiding and responding to viruses and
other malware.
o Appropriate handling of sensitive information to ensure
confidentiality and integrity.
o Appropriate usage of the Internet, e-mail and other
organization resources.
o Appropriate usage of software, including copyright
infringement and file sharing.
o Appropriate usage of portable devices, including
external storage devices and portable computing
devices.
o Appropriate usage of encryption devices.
Mandatory Baselines
Page 4 of 25