Control Activity Personnel are aware of and understand the security policies and program. An on-going security awareness program has been implemented. All new employees, contractors and users receive an initial training on security. The training addresses ethical conduct and performance of duties in a secure manner. The training addresses the responsibilities of all staff.
Senior management supports the training program.
Interview resource owners and users. Determine what training they have received and whether they are aware of their security-related responsibilities. Review memos, e-mails or other policy distribution mechanisms. Assess whether the policy was distributed to all affected personnel. Review personnel files to test whether security awareness statements are current.