{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"cyber_security","domain":["Awareness & Training","Human Resources / Personnel Security"],"inherent_rating":"high","taxonomy":["iso-27005-vulnerability","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aaware-insufficient-training","description":"Personnel lacking security awareness and training are more likely to make harmful mistakes, misconfigure systems, or be deceived — providing weak human defence and undermining every technical control. Includes insufficient privacy training.","details":{"category":"cyber_security","impact":"medium","inherent_rating":"high","likelihood":"high","risk_id":"aware-insufficient-training","taxonomies":["iso-27005-vulnerability","nist-privacy-risk"],"treatment":"mitigate"},"id":"risk:aware-insufficient-training","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aaware-insufficient-training","sourceIds":["iso-27001","nist-800-53","nist-csf-2","nydfs-500","soc2"],"sourceUrl":null,"title":"Inadequate security awareness and training","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:1ab76fafa621d96aa66912576c1e6c8a1de1ffe34e22b1c4b726baaed6ffb6b6","properties":{"rationale":"Developing personnel through training and embedding cybersecurity across HR stages builds a security-aware workforce; enabler, not the dedicated awareness-training control.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-06-36a1f4aa.json","sourceId":"uc:UC-HR-06","targetDetailPath":"/data/v1/records/risk-aware-insufficient-training-7cb09d2f.json","targetId":"risk:aware-insufficient-training","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:358b69c65fd3738651f16989f96b72debda0886e39521e36e7e4bf3064c3773b","properties":{"rationale":"Delivering security & privacy awareness training to all personnel is the direct first-order defense against the inadequate-awareness gap.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-train-01-5f513831.json","sourceId":"uc:UC-TRAIN-01","targetDetailPath":"/data/v1/records/risk-aware-insufficient-training-7cb09d2f.json","targetId":"risk:aware-insufficient-training","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:55c64fdc077e23798161e3dc838d18bd4c29bc45f85c4ba7f9441d4b53cf92fb","properties":{"rationale":"Monitoring completion, following up non-completion, and measuring effectiveness assures coverage and drives improvement, but this detective control delivers no training itself; the operative defense is delivery (UC-TRAIN-01).","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-train-03-7125ac3e.json","sourceId":"uc:UC-TRAIN-03","targetDetailPath":"/data/v1/records/risk-aware-insufficient-training-7cb09d2f.json","targetId":"risk:aware-insufficient-training","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:64c73a32b10bf3e12c583ecf05ca62d03621a735a331e46557d71f08ee3e5ca8","properties":{"rationale":"Role-based training raises the security competency of high-risk roles, reducing the overall training-adequacy gap for that population.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-train-02-88898a0b.json","sourceId":"uc:UC-TRAIN-02","targetDetailPath":"/data/v1/records/risk-aware-insufficient-training-7cb09d2f.json","targetId":"risk:aware-insufficient-training","type":"mitigates"}],"schemaVersion":1}