Security awareness training is foundational
Security awareness training is mandatory for all companies under any compliance framework. It doesn’t matter what standard or framework your company adheres to; security awareness training is required. You can see this in Table 7.1 which maps security standards and frameworks to the sections that cover security awareness training:
|
Standard/Framework |
Section |
|
NIST CSF |
PR.AT-1 |
|
NIST 800-53 |
AT-2, PM-13 |
|
CIS |
14 |
|
PCI |
12.6 |
|
HIPAA |
164.308(a)(5)(i) |
|
CMMC |
AT.L2-3.2.3 AT.L2-3.2.1 |
|
ISO 27001 |
... |
