unified
UC-TRAIN-01 — Deliver security awareness training to all personnel
Provide security and privacy awareness training to all personnel as part of onboarding, at least annually thereafter, and when threats, policies, or systems change materially. Include practical exercises reflecting current threats, such as phishing simulations and social-engineering awareness, and update content based on lessons learned and emerging risks. Require timely completion as a condition of continued system access.
Record JSON · Open in map · Data retrieval guide
Catalog revision: 24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028. A connection does not establish full coverage.
Attributes
- domain
- Awareness & Training
- type
- preventive
- category
- administrative
Details
- unified_id
- UC-TRAIN-01
- title
- Deliver security awareness training to all personnel
- statement
- Provide security and privacy awareness training to all personnel as part of onboarding, at least annually thereafter, and when threats, policies, or systems change materially. Include practical exercises reflecting current threats, such as phishing simulations and social-engineering awareness, and update content based on lessons learned and emerging risks. Require timely completion as a condition of continued system access.
- domain
- Awareness & Training
- control_type
- preventive
- control_category
- administrative
- members
- framework
- nist-800-53
- control_id
- AT-2
- coverage
- full
- relationship
- superset_of
- framework
- nist-csf-2
- control_id
- PR.AT-01
- coverage
- full
- relationship
- superset_of
- framework
- iso-27001
- control_id
- A.6.3
- coverage
- full
- relationship
- superset_of
- framework
- nydfs-500
- control_id
- 500.14
- coverage
- partial
- delta
- authorized-user activity monitoring and email/web filtering prongs not covered
- relationship
- intersects_with
- guidance
Source
No record-specific source URL is provided.
Connections
- UC-TRAIN-01 — Deliver security awareness training to all personnel mitigates Phishing, spear-phishing and social engineering
- strength
- primary
- rationale
- Control explicitly runs phishing simulations and social-engineering awareness, directly lowering susceptibility to deception/credential theft.
- UC-TRAIN-01 — Deliver security awareness training to all personnel mitigates No acceptable-use policy for messaging and telecoms
- strength
- related
- rationale
- Training on safe use of email/messaging gives the guidance that reduces inadvertent disclosure via insecure channels even absent a formal AUP.
- UC-TRAIN-01 — Deliver security awareness training to all personnel mitigates Inadequate security awareness and training
- strength
- primary
- rationale
- Delivering security & privacy awareness training to all personnel is the direct first-order defense against the inadequate-awareness gap.
- ISO 27001 Stage 2 Annex A Controls Audit tests UC-TRAIN-01 — Deliver security awareness training to all personnel
- SOC 2 Type II Interim Testing tests UC-TRAIN-01 — Deliver security awareness training to all personnel
- ISO 27001 Stage 1 ISMS Documentation Review tests UC-TRAIN-01 — Deliver security awareness training to all personnel
- UC-TRAIN-01 — Deliver security awareness training to all personnel mitigates User error and mishandling of sensitive information
- strength
- related
- rationale
- General awareness cuts inadvertent sensitive-info mishandling, but the operative defense against the named operational errors (misconfiguration, privilege settings) is role-based training; general training only contributes.
- UC-TRAIN-01 — Deliver security awareness training to all personnel maps_to PR.AT-01 — Awareness and Training: Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
- framework
- nist-csf-2
- control_id
- PR.AT-01
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- 2.0
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-TRAIN-01 — Deliver security awareness training to all personnel maps_to A.6.3 — Information security awareness, education and training
- framework
- iso-27001
- control_id
- A.6.3
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- 2022
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- Security Awareness Training Campaign operates UC-TRAIN-01 — Deliver security awareness training to all personnel
- UC-TRAIN-01 — Deliver security awareness training to all personnel mitigates Missing role-based and ongoing security/privacy training
- strength
- related
- rationale
- Annual all-personnel refresh supplies the ongoing-awareness component of the gap; the role-specific core is delivered by UC-TRAIN-02.
- UC-TRAIN-01 — Deliver security awareness training to all personnel maps_to 500.14 — Monitoring and training
- framework
- nydfs-500
- control_id
- 500.14
- coverage
- partial
- delta
- authorized-user activity monitoring and email/web filtering prongs not covered
- relationship
- intersects_with
- source_version
- 23 NYCRR 500, Second Amendment
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.
- UC-TRAIN-01 — Deliver security awareness training to all personnel maps_to AT-2 — Literacy Training and Awareness
- framework
- nist-800-53
- control_id
- AT-2
- coverage
- full
- relationship
- superset_of
- delta
- Not provided
- source_version
- Rev. 5
- provenance
- mapper
- coworkcanvas-compliance-graph
- reviewDate
- 2026-09-07
- direction
- canonical_to_source
- defaultConfidence
- medium
- defaultStatus
- active
- note
- Each member is a documented relationship claim from the canonical unified control to a source control or guidance proposition. relationship: equal|superset_of (full) / intersects_with|subset_of (partial) / informs (guidance). confidence 'medium' = single-mapper, documented, not yet externally corroborated. source_version is the member framework's edition from the standard version register.