sandy ingram's Profile

A cybersecurity assessment management tool at Interior is used to track
cybersecurity progress, but status updates aren't verified or followed up on, so
documented problems often go unfixed or inadequately fixed.

Among cybersecurity staff, Interior required only self-certified training.
The inspector general found that only 13.5% of self certifications were relevant
and complete.

Finally employers should train employees so they know how to
recognize threats to the security of protected data and report suspicious
activities. If employees cannot attend and participate in this training, their
access to such information should be blocked until they attend the training.
Once employees are trained, and as a way to encourage and reinforce these
behaviors, employers should publicly acknowledge and reward employees who alert
the company of potential problems.

Since you want to make sure that rank-and-file employees are well
trained, you will initially want to provide complementary, mandatory training
and development opportunities for the managers to whom these employees report.
In doing so, you can develop a benchmarking program, which can be used as a tool
for checking on and evaluating managerial goals. For instance, managers can be
held responsible for signing off on benchmarks such as follows:.



• 
  
  
  
• Completing a privacy-data inventory that identifies where information is
  stored.
  
• Establishing and communicating a privacy policy statement program.
  
• Verifying policies and practices for security measures.
  
• Setting aside off-network computers that employees can use during break
  times or off-hours that will not compromise your network files; and
  
• Taking steps to ensure that contractor-software providers take regard for
  ensuring protection, the same as you do.