Revised cybersecurity guidelines target training
Connecting state and local government leaders
NIST is revising one of its publications to distinguish between training for user awareness and formal training for IT security professionals.
The National Institute of Standards and Technology is revising guidelines for information security training for government employees to reflect increased specialization in that field.
NIST has released a draft of the first revision of Special Publication 800-16, titled "Information Security Training Requirements: A Role-and Performance-Based Model," for public comment.
“Since the initial publication date [1998], there has been an increase at the national level in the attention paid to, and the need for, a properly trained information security workforce,” NIST’s executive summary states. “The Federal Information Security Management Act of 2002 not only requires organizations to ensure that all users of information and information systems are aware of their information security responsibilities, but also requires departments and agencies to identify and train those with ‘significant responsibilities for information security.’”
FISMA does not specify the type of training required for those employees. But in 2004, the Office of Management and Budget specified role-based training and said it must be conducted according to NIST guidance and standards. OMB is also formalizing security-awareness training for all information technology users and is including it in the Information Systems Security Line of Business. Service centers providing such training for other agencies are expected to use approved materials.
For the first time, SP 800-16 includes guidance for formal awareness training programs that use specific educational materials as opposed to informal programs that rely on tools such as posters, e-mail messages and other reminders of basic security policies. The NIST publication also provides guidance for role-based training for security professionals.
The guidelines are intended for two audiences: information security professionals and instructional design specialists who develop the training materials and courses.
“The information security professional will probably be reading to understand what must be done to provide role-based training in his or her organization,” the draft revision states. “The instructional design specialist and training development specialist will be reading to understand the training methodology contained in the document and to use that methodology to design and possibly present training courses for specific audiences.”
NIST is seeking feedback on how easy it is for the two audiences to understand the draft document. The agency also wants input on a number of other changes, including:
- The use of icons or tags to identify which audience a chapter or section is targeted to.
- Whether the distinction between general awareness programs and formal awareness training is meaningful to organizations.
- Whether the additional level of detail is helpful in developing training courses.
- Whether more detailed definitions of “employees with significant responsibilities for information security” are needed. “We believe that by the time someone opens SP 800-16, Rev. 1, the department or agency should have already decided who in the organization has significant responsibility for information security, and that SP 800-16, Rev. 1 would then be used to develop information security training courses or modules for those people,” the document states. “Do you agree with this approach?”
- Whether the catalog of roles for which specific training could be developed is clear enough.
SP 800-16 is one of a number of information security training initiatives for government employees. Other resources include training standards developed by the Committee on National Security Systems, the IT Security Essential Body of Knowledge developed by the Homeland Security Department, competencies and training topics for the GS-2210 series developed by the Office of Personnel Management, the Information Security Workforce Development Matrix Project being developed by the CIO Council’s IT Workforce Committee, and the cyber education training initiative being developed as part of the Comprehensive National Cybersecurity Initiative launched by the Bush administration.
NIST cooperated with the developers of those initiatives while revising SP 800-16 in an effort to move toward development of a set of homogenous standards.
“One possible outcome of this harmonization effort that we envision is that NIST SP 800-16, Rev. 1 might serve as a fairly general foundational document from which the other training and workforce development initiative publications and communitywide programs could be seen as tailor-fit efforts for their particular communities,” the NIST document states.
NIST is accepting comments on the draft revision at 800-16comments@nist.gov until June 26.
NEXT STORY: VA's security lessons learned