Subcontrol 17.8

[adammontville]

Train workforce members to be aware of causes for unintentional data exposures, such as losing their mobile devices or emailing the wrong person due to autocomplete in email.

Measures

c_i_j= # of correct answer for employee j in round i
TQ_i_j = # of toal question for employee j in round i
n = # of total employee randomly picked
m = # of round
alpha = damping factor(more recent round will have higer weight) < 1

Metrics/KEI

TP Quality = ( SUM over j: 1 to n ( (SUM over i:0 to m-1 ( (c_i_j / TQ_i_j) * alpha^i ) ) / (SUM over i:0 to m-1 (alpha^i ) ) ) ) / n

See comments for #33 and #34

[adammontville]

Inputs

• List of workforce members
• List of most recent completion date for this module of the security awareness training for each workforce member
• Required frequency of training (at least annually)

Operations

• For each workforce member in Input 1, check Input 2 to see if that workforce member's most recent completion date of this training module was within the time frame specified by Input 3 (if the workforce member is not listed in Input 2, assume the workforce member is not compliant). Generate a list of compliant workforce members (M1) and a list of non-compliant workforce members (M2).

Measures

• M1: List of workforce members who have completed this security awareness training module within the specified time frame (compliant list)
• M2: List of workforce members who have not completed this security awareness training module within the specified time frame (non-compliant list)
• M3: Number of workforce members in the compliant list (M1)
• M4: Number of workforce members in the non-compliant list (M2)
• M5: Total number of workforce members in Input 1

Metrics

• Coverage: M3 / M5