AT.L2-3.2.3 Insider Threat Awareness
Provide awareness training that teaches staff to recognize potential insider threat indicators and to report them.
3
artefacts
0
held by a system
1
at each review
hard
to go live
HR system / LMS
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
- Completion records · HR system / LMS
governing documentDocuments that govern the control
- Insider threat awareness content covering indicators and reporting · HR system / LMS
- Defined reporting channel communicated to staff · HR system / LMS
First move
This control is evidenced by people and documents, not systems. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date. Do not try to automate it.
Common gaps auditors find
- Insider threat omitted from awareness content
- Indicators taught with no reporting route given
- Training not refreshed
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetAT.L2-3.2.2 Role-Based Training · AU.L2-3.3.1 System Auditing