Information Technology Security (ITS) Training Carolyn Schmidt Program Manager Information Technology Security (ITS) Awareness, Training, and Education

Information Technology Security Training Overview of NIST Overview of NIST ITS Training Program To Contract or Not to Contract

Overview of NIST Mission – Research and customer oriented Organizational Structure – Hierarchical – Training function resides in HR; ITS function resides in OCIO Technological Architecture – Distributed users Training Base – ~3,000 employees; ~5,000 total users – Varied from Support to Advanced Technical

Overview of NIST ITS Training Program Designing the program Developing the material Implementing the program Maintaining the material WHO? WHAT? WHY? WHEN? HOW?

WHO General – internal and external Specialized – Security specific roles (NIST IT System Inventory) System Security Officers IT Security Officers DAA … – Technical roles System Administrators Database Administrators Information Coordinators …

WHAT General information – Alerts and advisories – Legal and regulatory requirements ITS Policies and procedures – Minimum technical requirements – SDLC process – C&A process – …

WHY Increase skill set Streamline operations Incentives – Increase performance – Increase marketability – Part of certification or degree program – Supplemental pay (i.e., bonuses)

WHEN Applicability Timeliness Recurring

HOW Blended learning Instructor-led training (ILT) Web-based

TO CONTRACT OR NOT TO CONTRACT WHAT – Require knowledge of internal policy and procedures – Sometimes too costly to get contract staff educated – Contract content must be quality WHEN – Availability of staff to deliver ILT – Contract delivery schedule must be strict HOW – Needs to be integrated in current procedures – Ownership of course/material needs to be defined

SUMMARY THERE NEEDS TO EXIST A UNION BETWEEN AN ITS PROGRAM AND CONTRACT STAFF