Requirements 3.2
3.2 Awareness and Training: the NIST SP 800-171 requirements
The 3 requirements of family 3.2, Awareness and Training, in NIST SP 800-171 Rev 2, worth 11 points of a SPRS score under 32 CFR 170.24. For each: NIST's text, what it costs when not met, the objectives an assessor determines under NIST SP 800-171A, and how to meet it. To mark each one and work out your score, use the free calculator.
3.2.1 Security Awareness
Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
Points: 5 points.
Assessment objectives (NIST SP 800-171A)
- [a]Security risks associated with organizational activities involving CUI are identified.
- [b]Policies, standards, and procedures related to the security of the system are identified.
- [c]Managers, systems administrators, and users of the system are made aware of the security risks associated with their activities.
- [d]Managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system.
How to meet it
Roll out annual security awareness training covering CUI handling, phishing, acceptable use, and incident reporting using an affordable platform (KnowBe4, Proofpoint, or even a structured slide deck with quiz for very small teams), and require completion before system access for new hires. Track completion to individual names. Evidence: training content, completion records with dates, and the policy requiring it.
3.2.2 Insider Threat Awareness
Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
Points: 5 points.
Assessment objectives (NIST SP 800-171A)
- [a]Information security-related duties, roles, and responsibilities are defined.
- [b]Information security-related duties, roles, and responsibilities are assigned to designated personnel.
- [c]Personnel are adequately trained to carry out their assigned information security-related duties, roles, and responsibilities.
How to meet it
Identify roles with security duties (system admins, the ISSO/security lead, anyone handling incident response) and give them role-specific training beyond general awareness: vendor courses, CompTIA/SANS material, or documented internal training on your own procedures. Refresh when duties or systems change. Evidence: a roles-to-training matrix and certificates or attendance records for each named person.
3.2.3 Security Training
Provide security awareness training on recognizing and reporting potential indicators of insider threat.
Points: 1 point.
Assessment objectives (NIST SP 800-171A)
- [a]Potential indicators associated with insider threats are identified.
- [b]Security awareness training on recognizing and reporting potential indicators of insider threat is provided to managers and employees.
How to meet it
Add an insider threat module to your annual training covering behavioral indicators (unusual data hoarding, disgruntlement, unexplained foreign contacts) and exactly how and to whom employees report concerns. Most awareness platforms include this content, so this is often a one-checkbox fix. Evidence: the module content showing indicator and reporting coverage, plus completion records.