1. Information Security Awareness and Training Department of Commerce NOAA WebShop Conference November 13, 2007

2. 2 FISMA The head of each agency shall... Delegate to the agency Chief Information Officer... Training and overseeing personnel with significant responsibilities for information security... The head of each agency shall... Ensure that the agency has trained personnel sufficient to assist the agency with complying with...

3. 3 Two Training Efforts General IT Security Awareness Training IT Security Role-Based Training (for personnel with significant responsibilities in information security)

4. 4 Awareness Training DOC Operating Units are required to ensure all its employees, including contractors, receive general security training and awareness on an annual basis DOC IT Security recommends the following sample list of qualified security related activities: Attending a training course or educational seminar Conference presentation

5. 5 Awareness Training ( Cont’d ) Professional association chapter meeting Educational vendor presentation Web-based course Classroom time in a higher education academic (university level class)

6. 6 Awareness Training ( Cont’d ) Self-study (of pre-approved materials with suitable documentation provided) DOC Security Training Session OU sponsored IT security training conferences

7. 7 Role-Based Security Awareness Training Each operating unit is responsible in ensuring all qualified personnel complete their required training. Certification and Accreditation for information system security officers/managers (ISSOM) and system owners Roles and Responsibilities of designated authorizing officials IT security operations personnel and planning for ISSO/M

8. 8 Training Delivery Methods Commerce Learning Center – Skillsoft Role-Based training In-person training (ILT/ISC2)

9. 9 Questions