Educating Employees About CMMC | Hyper Vigilance

Building a CMMC Solution: Educating Around CMMC

In this series—Building a CMMC Solution—we’ll be exploring the different steps and factors it takes to build a CMMC and NIST cybersecurity strategy for businesses from the ground up. From getting started to cybersecurity user education, we’ll be walking through each step to help you as you prepare to go through the CMMC certification process

Check out the first three articles in our Building CMMC Solutions series:

•  Building a CMMC Solution: 3 Steps to Start Your CMMC Plan

• Building a CMMC Solution: Factors and Strategies to Consider

• Building a CMMC Solution: Building and Testing

• Building a CMMC Solution: The CMMC Certification Process 

Insiders—that is, your own employees— are responsible for over 20% of data breaches, making them a significant threat to enterprise cybersecurity and regulatory compliance. Breaches in end user security include both intentional attacks by trusted parties and mistakes that lead to the exposure of sensitive and protected information. This makes user education in cybersecurity issues and threats a business priority in addition to an IT one. 

The primary goal of CMMC is to protect the controlled unclassified information (CUI) as well as federal contract information (FCI) entrusted to US defense contractors as part of their contracts. Managing the insider threat is a vital part of a CMMC compliance strategy, and a cybersecurity user education program is a core part of this.

What is Cybersecurity User Education?

Cybersecurity end user education involves training end users to recognize and properly respond to cyber threats and to fulfill their duties under applicable regulations. End user security training should be a core part of any organization’s security strategy, as all companies are subject to a range of data privacy laws. However, with the emergence of CMMC and NIST 171, defense contractors have a new set of requirements to train employees on—and a mandate to do so.

End User Security Training

End user security training should provide employees with an understanding of the primary cyber threats that they face and other potential causes of data breaches. Important topics to cover include:

• Phishing: Phishing attacks are one of the most common types of cyberattacks. Employees need to know about phishing attack vectors (email, SMS, etc.), common pretexts, and how to detect a phishing attack.
• Social Engineering: Phishing is one of several types of social engineering attacks. In addition to phishing, end users need to be aware of the other techniques that attackers may use to trick them into handing over sensitive information or providing access to corporate systems.
• Ransomware: Ransomware has emerged as a leading cyber threat in recent years and poses a significant threat to an organization’s operations and data security. Employees should be trained on common ransomware infection mechanisms and how to detect and properly respond to a ransomware attack.
• Password Security: Weak and reused passwords are commonly exploited by attackers to gain access to corporate systems and steal data. Employees should be trained on how to generate and manage secure passwords and how to use multifactor authentication (MFA) solutions whenever possible.
• Cloud Security: Insecure and unauthorized cloud-based storage is a common source of leaked corporate data. End users should be trained to only use approved corporate cloud solutions that are secured in accordance with CMMC and NIST 171 guidance.
• Social Media: Social media can be a goldmine for cybercriminals looking for information to use in social engineering attacks, and these sites are commonly used to send phishing content and malicious links. Social media access should be restricted on corporate systems, and employees should be trained on the risks and responsible use of social media.
• Regulatory Compliance: CMMC is one of many regulations that businesses may be subject to, and each law has its own restrictions and requirements. Employees must be trained on what they can and cannot do with protected corporate and customer data.

Training on these and other cybersecurity topics should be ongoing and a core component of a corporate security and training strategy. Employees are companies’ first line of defense against the loss or theft of company and customer data, but they are only effective if they know what threats are out there and how to recognize and respond to them.

How to Educate Employees on Cybersecurity

An organization’s cybersecurity training should be tailored to its unique needs. Some important considerations when developing a cybersecurity education plan to turn employees into a company’s first line of cyber defense include the following:

• Content: Cybersecurity training content should include the cyber threats and regulatory requirements that are most relevant to an employee. This information may vary based on industry, company, and an employee’s role within the organization and changes over time. Training content should be based on cyber threat intelligence and tailored to an employee’s role.
• Audience: Different groups within the organization will have different security training needs. For example, employees with no connection to US defense contracts don’t need to know the finer details of CMMC and NIST 171. Targeting training to specific groups makes it more relevant and relatable to them, and helps to maximize the retention of what really matters.
• Delivery: Different people learn in different ways, and training delivered as an annual set of PowerPoint slides rarely boosts retention and changes employee behavior. When possible, deliver training via a variety of mechanisms and provide just-in-time training when possible. For example, anti-phishing training should include simulated phishing emails that tell employees that fell for the phish what warning signs they missed.
• Cadence: Repetition is essential for building retention and recall, and annual or quarterly end user security awareness training is not enough. Training should be delivered regularly in bite-sized pieces, rather than as an overwhelming and infrequent training session.

Ongoing CMMC Training

CMMC regulation is relatively new and undergoing major changes in the coming weeks and months, meaning that many employees and end users are likely unfamiliar with its rules and requirements. Ongoing CMMC training can help to close this knowledge gap by bringing employees up-to-date on the new requirements that CMMC adds on top of the existing NIST 800-171 regulation.

A good starting point for this training is an explanation of the regulation’s purpose and scope. Providing employees with information about the CMMC’s goals and their role in accomplishing them helps them to better understand the logic behind and importance of the new requirements. From there, an organization can provide more in-depth training on the specific requirements of CMMC, such as newly required security controls, processes, and procedures.

Developing Your CMMC and Cybersecurity Training Strategy

Developing an effective cybersecurity training strategy requires knowledge and expertise in a variety of different areas. In addition to knowledge of the content (cybersecurity, regulations, etc.), it’s also necessary to understand how best to convey that information to end users. Once a training program has been developed, an organization needs to update it frequently to keep up with the evolving cyber threat landscape.

Hyper Vigilance can help organizations to develop and update their training content by keeping them informed of the latest cybersecurity trends and attack vectors. This information can be incorporated into training content to ensure that end users remain an effective first line of defense for the company. Contact us to get started today.