risk
Missing role-based and ongoing security/privacy training
Because no role-based training program or ongoing awareness refresh exists for staff handling sensitive data or privileged systems, personnel cannot execute security procedures correctly or recognize evolving attacks, so avoidable errors and successful social-engineering compromises follow.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- category
- cyber_security
- domain
- Awareness & Training
- Human Resources / Personnel Security
- taxonomy
- iso-27005-vulnerability
- nist-privacy-risk
- inherent_rating
- medium
Details
- risk_id
- aware-role-based-training-gap
- category
- cyber_security
- likelihood
- high
- impact
- medium
- inherent_rating
- medium
- treatment
- mitigate
- taxonomies
- iso-27005-vulnerability
- nist-privacy-risk
Source
No record-specific source URL is provided.
Connections
- UC-TRAIN-02 — Train personnel with specialized security roles and duties mitigates Missing role-based and ongoing security/privacy training
- strength
- primary
- rationale
- Delivering role-based training to admins/devs/IR/leaders before access and on change is the direct closure of the role-based training gap.
- UC-TRAIN-01 — Deliver security awareness training to all personnel mitigates Missing role-based and ongoing security/privacy training
- strength
- related
- rationale
- Annual all-personnel refresh supplies the ongoing-awareness component of the gap; the role-specific core is delivered by UC-TRAIN-02.
- UC-HR-06 — Embed security and competence in HR practices mitigates Missing role-based and ongoing security/privacy training
- strength
- related
- rationale
- Defining role competence requirements enables the role-based training and development that closes gaps for staff in security-relevant roles.
- UC-TRAIN-03 — Record training completion and measure effectiveness mitigates Missing role-based and ongoing security/privacy training
- strength
- related
- rationale
- Completion monitoring against the assigned population catches uncompleted role-based training but does not itself deliver it.
- UC-HR-07 — Secure remote working arrangements mitigates Missing role-based and ongoing security/privacy training
- strength
- related
- rationale
- the remote-working policy drives role-specific secure-working awareness for off-site staff