NIST 800-50 Building an Information Technology Security Awareness Program

NIST 800-50 Building an Information Technology Security Awareness and Training Program is a set of recommendations from the National Institute of Standards and Technology on how to setup Security Awareness and Training Program. This document provides guidelines for building and maintaining a comprehensive awareness and training program, as part of an organization’s IT security program. The guidance is presented in a life-cycle approach, ranging from designing (Section 3), developing (Section 4), and implementing (Section 5) an awareness and training program, through post-implementation evaluation of the program (Section 6). The document includes guidance on how IT security professionals can identify awareness and training needs, develop a training plan, and get organizational buy-in for the funding of awareness and training program efforts. This document also describes how to: Select awareness and training topics; Find sources of awareness and training material; Implement awareness and training material, using a variety of methods; Evaluate the effectiveness of the program; and Update and improve the focus as technology and organizational priorities change. The document is a companion publication to NIST Special Publication 800-16, Information Technology Security Training Requirements: A Role- and Performance-Based Model. The two publications are complementary – SP 800-50 works at a higher strategic level, discussing how to build an IT security awareness and training program, while SP 800-16 is at a lower tactical level, describing an approach to role-based IT security training Disclaimer This hardcopy is not published by National Institute of Standards and Technology (NIST), the US Government or US Department of Commerce. The publication of this document should not in any way imply any relationship or affiliation to the above named organizations and Government.