Sharing Indicator : White 1-10 Essential Cybersecurity Controls Cybersecurity Awareness and Training Program To ensure that personnel are aware of their cybersecurity responsibilities and have the Objective essential cybersecurity awareness. It is also to ensure that personnel are provided with the required cybersecurity training, skills and credentials needed to accomplish their cybersecurity responsibilities and to protect the organization’s information and technology assets. Controls 1-10-1 1-10-2 A cybersecurity awareness program must be developed and approved. The program must be conducted periodically through multiple channels to strengthen the awareness about cybersecurity, cyber threats and risks, and to build a positive cybersecurity awareness culture. The cybersecurity awareness program must be implemented. The cybersecurity awareness program must cover the latest cyber threats and how to protect against them, and must include at least the following subjects: 1-10-3 1-10-3-1 Secure handling of email services, especially phishing emails. 1-10-3-2 Secure handling of mobile devices and storage media. 1-10-3-3 Secure Internet browsing. 1-10-3-4 Secure use of social media. Essential and customized (i.e., tailored to job functions as it relates to cybersecurity) training and access to professional skillsets must be made available to personnel working directly on tasks related to cybersecurity including: 1-10-4 1-10-5 18 1-10-4-1 Cybersecurity function’s personnel. 1-10-4-2 Personnel working on software/application development. and information and 1-10-4-3 Executive and supervisory positions. technology assets operations. The implementation of the cybersecurity awareness program must be reviewed periodically. Document Classification: Unclassified