{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"cyber_security","domain":["Awareness & Training","Human Resources / Personnel Security"],"inherent_rating":"medium","taxonomy":["iso-27005-vulnerability","nist-privacy-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Aaware-role-based-training-gap","description":"Because no role-based training program or ongoing awareness refresh exists for staff handling sensitive data or privileged systems, personnel cannot execute security procedures correctly or recognize evolving attacks, so avoidable errors and successful social-engineering compromises follow.","details":{"category":"cyber_security","impact":"medium","inherent_rating":"medium","likelihood":"high","risk_id":"aware-role-based-training-gap","taxonomies":["iso-27005-vulnerability","nist-privacy-risk"],"treatment":"mitigate"},"id":"risk:aware-role-based-training-gap","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Aaware-role-based-training-gap","sourceIds":["iso-27001","nist-800-53","nist-csf-2","nydfs-500","soc2"],"sourceUrl":null,"title":"Missing role-based and ongoing security/privacy training","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:3cffa2621074794e1d73b5bdbfe8e397637d8e0dff11b847f99710a4ba66bd87","properties":{"rationale":"Delivering role-based training to admins/devs/IR/leaders before access and on change is the direct closure of the role-based training gap.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-train-02-88898a0b.json","sourceId":"uc:UC-TRAIN-02","targetDetailPath":"/data/v1/records/risk-aware-role-based-training-gap-3e2ca2c3.json","targetId":"risk:aware-role-based-training-gap","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:af38eec7a8f928c5a9042ad4d5ea80f3bef11e25dd5ac3a101697e71f9b73a75","properties":{"rationale":"Annual all-personnel refresh supplies the ongoing-awareness component of the gap; the role-specific core is delivered by UC-TRAIN-02.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-train-01-5f513831.json","sourceId":"uc:UC-TRAIN-01","targetDetailPath":"/data/v1/records/risk-aware-role-based-training-gap-3e2ca2c3.json","targetId":"risk:aware-role-based-training-gap","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b305f30de92658cb06ef31c95b7d359ba071be977277da983b2452c0f67d5546","properties":{"rationale":"Defining role competence requirements enables the role-based training and development that closes gaps for staff in security-relevant roles.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-06-36a1f4aa.json","sourceId":"uc:UC-HR-06","targetDetailPath":"/data/v1/records/risk-aware-role-based-training-gap-3e2ca2c3.json","targetId":"risk:aware-role-based-training-gap","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:b458875d5dbaf7a3ba04ec3e0440388d35e03175da1e9c9e65e140f4cc235aee","properties":{"rationale":"Completion monitoring against the assigned population catches uncompleted role-based training but does not itself deliver it.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-train-03-7125ac3e.json","sourceId":"uc:UC-TRAIN-03","targetDetailPath":"/data/v1/records/risk-aware-role-based-training-gap-3e2ca2c3.json","targetId":"risk:aware-role-based-training-gap","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:d5f93a187ee7bedd79620ef2ca9970631b3add2a86d78b8f7cd6d782a57f8521","properties":{"rationale":"the remote-working policy drives role-specific secure-working awareness for off-site staff","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-hr-07-7b9726ca.json","sourceId":"uc:UC-HR-07","targetDetailPath":"/data/v1/records/risk-aware-role-based-training-gap-3e2ca2c3.json","targetId":"risk:aware-role-based-training-gap","type":"mitigates"}],"schemaVersion":1}