–
Virtual learning, a key component of most cybersecurity awareness training programs, uses web-based platforms to allow employees to complete their training anytime, anywhere in the world.
Many regulatory bodies already mandate cybersecurity awareness training and require organizations to prove their staff has achieved competency to comply. This article will examine the most significant regulations and how organizations can comply.
The National Institute of Standards and Technology (NIST) of the United States Department of Commerce is one of the most widely known and respected non-regulatory bodies on the planet and produces guidelines and standards to aid federal agencies in achieving Federal Information Security Management Act (FISMA) compliance.
FISMA is a U.S. legislation that defines a framework of guidelines and security standards to protect government information and operations. It applies to “federal agencies, contractors, or other sources that provide information security for the information and information systems that support the operations and assets of the agency.”
The NIST framework identifies cybersecurity awareness training as a crucial element of any cybersecurity program. It recommends that organizations ensure “personnel and partners are provided cybersecurity awareness education and are trained to perform their cybersecurity-related duties and responsibilities consistent with related policies, procedures, and agreements.”
Although the NIST framework is voluntary, FISMA is mandatory and requires organizations to provide “security awareness training to inform personnel, including contractors and other users of information systems that support; (A) the operations and assets of the agency information security risks associated with their activities; and (B) their responsibilities in complying with agency policies and procedures designed to reduce these risks.”
The GLBA, also known as the Financial Modernization Act, is a U.S. legislation that applies to all U.S. financial institutions, governs the handling of private personal information, and holds executives personally accountable for non-compliance.
While the first version of GLBA did not mandate cybersecurity awareness training, lawmakers recently updated the regulation, requiring affected organizations to provide “personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment” by June 9th, 2023.
