STIGQter: STIG Summary: Traditional Security Checklist Version: 1 Release: 3 Benchmark Date: 15 Jun 2020: STIGQter: STIG Summary: Traditional Security Checklist Version: 1 Release: 3 Benchmark Date: 15 Jun 2020:SV-42943r3_rule
V-32606
Security Training - Information Security (INFOSEC)
SM-02.02.01
CAT II
10
1. Ensure initial and recurring (annual minimum) information security training is provided to each employee.
2. Ensure the following training topics are covered at a MINIMUM:
a. Classified Handling (physical (storage) security, transportation/transmission & marking of documents, equipment and media)
b. Communications Security
c. Computer (AKA: cybersecurity) Security requirements
d. Counter-intelligence briefings
e. Penalties for engaging in espionage activities
f. Courier briefing (if applicable)
g. Reporting of derogatory information
h. Reporting of Security Incidents
i. Security of Laptop computers when traveling
j. Special access programs, NATO, COSMIC TS, etc (as applicable)
k. Use of personal computers for conducting official business
l. Concerns identified during Component self-inspections
m. Procedures to be followed when using classified removable data storage media.
n. Procedures to be followed if an individual believes an unauthorized disclosure of classified data has occurred on an information system or network (typically called a “data spill”).
o. Ensure 100% of initial training and termination briefings are accomplished and at least 95% of employees have annual training. While 100% annual training is the goal, things like extended employee TDY or leave make this difficult to achieve.
All training accomplished must be documented. Anything less will be a finding.
Check #1. Check that initial and recurring (minimum annually) information security is provided to each employee.
Check #2. Check to ensure the following training topics are covered. Some topics may not be necessary based on the organizations mission or other considerations. Reviewers should use discretion in determining if adequate training topics are covered:
a. Classified Handling (physical (storage) security, transportation/transmission & marking of documents, equipment and media)
b. Communications Security
c. Computer (AKA: cybersecurity) Security requirements
d. Counter-intelligence briefings
e. Penalties for engaging in espionage activities
f. Courier briefing (if applicable)
g. Reporting of derogatory information
h. Reporting of Security Incidents
i. Security of Laptop computers when traveling
j. Special access programs, NATO, COSMIC TS, etc (as applicable)
k. Use of personal computers for conducting official business
l. Concerns identified during Component self-inspections
m. Procedures to be followed when using classified removable data storage media.
n. Procedures to be followed if an individual believes an unauthorized disclosure of classified data has occurred on an information system or network (typically called a “data spill”).
Check #3. Check records of employee training and ensure 100% of initial training briefings are accomplished and at least 95% of employees have completed annual training. Note that while 100% completion of annual training is the goal, employees on extended leave. TDY or other circumstances make this a difficult thing to accomplish.
All training accomplished must be documented. Anything less will be a finding.
TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.
V-32606
False
SM-02.02.01
Check #1. Check that initial and recurring (minimum annually) information security is provided to each employee.
Check #2. Check to ensure the following training topics are covered. Some topics may not be necessary based on the organizations mission or other considerations. Reviewers should use discretion in determining if adequate training topics are covered:
a. Classified Handling (physical (storage) security, transportation/transmission & marking of documents, equipment and media)
b. Communications Security
c. Computer (AKA: cybersecurity) Security requirements
d. Counter-intelligence briefings
e. Penalties for engaging in espionage activities
f. Courier briefing (if applicable)
g. Reporting of derogatory information
h. Reporting of Security Incidents
i. Security of Laptop computers when traveling
j. Special access programs, NATO, COSMIC TS, etc (as applicable)
k. Use of personal computers for conducting official business
l. Concerns identified during Component self-inspections
m. Procedures to be followed when using classified removable data storage media.
n. Procedures to be followed if an individual believes an unauthorized disclosure of classified data has occurred on an information system or network (typically called a “data spill”).
Check #3. Check records of employee training and ensure 100% of initial training briefings are accomplished and at least 95% of employees have completed annual training. Note that while 100% completion of annual training is the goal, employees on extended leave. TDY or other circumstances make this a difficult thing to accomplish.
All training accomplished must be documented. Anything less will be a finding.
TACTICAL ENVIRONMENT: The check is applicable for fixed (established) tactical processing environments. Not applicable to a field/mobile environment.
M
2506