意识与培训
确保人员接受培训并了解网络安全政策。
意识与培训由以下 NIST CSF 2.0 成果定义：PR.AT-01 (Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind); PR.AT-02 (Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind)。 对照映射 通过 ISO 27001, CIS v8.1, PCI DSS, CMMC, 800-53, HIPAA 和 NIS2 中已发布的对照表完成映射。 编辑说明 在 SOC 2, GDPR 和 DORA 中经编辑映射。 本站数据中无映射 本站数据中 Essential Eight, CPS 234 和 Cyber Essentials 无映射。
| 框架 | 要求 | 标题 | 链接 | 来源 / 原因 |
|---|---|---|---|---|
| NIST CSF 2.0 | PR.AT-01PR.AT-02 | Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind; Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind | 主题定义 | PR.AT-01 PR.AT-02 |
| ISO 27001 | A.6.3Clause 7.3 | Information security awareness, education and training; Awareness | 对照映射 | A.6.3: via PR.AT-01; PR.AT-02; NIST 800-53 map: AT-2, AT-3 Clause 7.3: via PR.AT-01; PR.AT-02; NIST 800-53 map: AT-2 |
| CIS v8.1 | CIS 14.1CIS 14.9CIS 14.2CIS 14.3CIS 14.4CIS 14.5CIS 14.6CIS 14.7CIS 14.8 | Establish and Maintain a Security Awareness Program; Conduct Role-Specific Security Awareness and Skills Training; Train Workforce Members to Recognize Social Engineering Attacks… | 对照映射 | CIS 14.1: via PR.AT-01 CIS 14.9: via PR.AT-02 CIS 14.2: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): training to recognise social engineering. CIS 14.3: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): training on authentication. CIS 14.4: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): training on data handling. CIS 14.5: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): training on causes of unintentional data exposure. CIS 14.6: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): training to recognise and report incidents. CIS 14.7: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): training to report missing security updates. CIS 14.8: Editorial (CIS's published crosswalk covers 49 of 153 safeguards): training on the dangers of insecure networks. |
| SOC 2 | CC1.4CC2.2 | Commitment to attracting, developing and retaining competent people; Internal communication of objectives and responsibilities | 编辑说明 | AICPA's TSC mappings are not openly licensed; ControlMapping editorial mapping (criterion summaries are ours, not AICPA text). |
| PCI DSS | 12.6.112.6.3 | Formal security awareness programme; Awareness training on hire and at least annually | 对照映射 | 12.6.1: via PR.AT-01 12.6.3: via PR.AT-01 |
| CMMC | AT.L2-3.2.1AT.L2-3.2.2AT.L2-3.2.3 | Role-Based Risk Awareness; Role-Based Training; Insider Threat Awareness | 对照映射 | AT.L2-3.2.1: via 800-171r3 03.02.01 → AT-2; 800-171r2 Appendix D → AT-2, AT-3 AT.L2-3.2.2: via 800-171r3 03.02.02 ↔ PR.AT-01, PR.AT-02 → AT-3; 800-171r2 Appendix D → AT-2, AT-3 AT.L2-3.2.3: via 800-171r3 03.02.01 → AT-2; 800-171r2 Appendix D → AT-2 |
| 800-53 | AT-2AT-3 | Literacy Training and Awareness; Role-based Training | 对照映射 | AT-2: via PR.AT-01 AT-3: via PR.AT-01; PR.AT-02 |
| HIPAA | §164.308(a)(5)§164.308(a)(5)(ii)(A) | Security Awareness and Training; Security Reminders | 对照映射 | §164.308(a)(5): via NIST HIPAA map: AT-2, AT-3 §164.308(a)(5)(ii)(A): via NIST HIPAA map: AT-2, AT-3 |
| GDPR | Art.39(1)(b) | Tasks of the data protection officer | 编辑说明 | Art.39(1)(b): No official crosswalk exists for GDPR; ControlMapping editorial mapping. |
| NIS2 | 8.18.2 | Awareness raising and basic cyber hygiene practices; Security training | 对照映射 | 8.1: via PR.AT-01; PR.AT-02; ENISA ISO map: Clause 7.3, A.6.3 8.2: via PR.AT-01; ENISA ISO map: A.6.3 |
| Essential Eight | — | 无要求 | 本站数据中无映射 | 本站数据中没有 Essential Eight 要求映射到此主题。 |
| DORA | Art.13(6)Art.5(4) | Learning and evolving; Governance and organisation | 编辑说明 | Art.13(6): Compulsory ICT security awareness programmes and digital operational resilience training for all staff and senior management. Art.5(4): Management body members keep their knowledge of ICT risk up to date, including through regular training. |
| CPS 234 | — | 无要求 | 本站数据中无映射 | 本站数据中没有 CPS 234 要求映射到此主题。 |
| Cyber Essentials | — | 无要求 | 本站数据中无映射 | 本站数据中没有 Cyber Essentials 要求映射到此主题。 |
主题定义 定义本主题的 CSF 2.0 结果 · 对照映射 至少一项选择有已发布对照表作为依据 · 编辑说明 ControlMapping 的判断及理由 · 未映射，仅与该主题的 CSF 成果相同 · 本站数据中无映射 我们的数据中未映射任何内容；通常为新工作，但请查看覆盖范围说明. 方法说明.
要求编号和标题均按各框架官方发布的英文原文显示。
映射有误或缺失？ 报告
关于意识与培训
安全意识培训是关键的人员层防御手段，有助于降低社会工程学攻击、网络钓鱼和意外数据泄露的风险。培训内容应涵盖识别网络钓鱼尝试、安全浏览习惯、密码管理规范、事件报告流程以及各岗位的安全职责。PCI DSS要求在员工入职时进行安全意识培训，且至少每年一次，培训内容须包括网络钓鱼和社会工程学（12.6.3）；大多数其他框架则将培训频率交由组织自行决定。网络钓鱼模拟演练是衡量培训成效的常用方法。