Provide security and privacy literacy training to all system users including managers, executives and contractors as part of initial training before CJI access and annually thereafter, when system changes require it, and within 30 days of a security incident for those involved; reinforce awareness with techniques such as posters, inscribed supplies, logon messages, email advisories or awareness events; update the content annually and after environment changes, incidents or Policy changes; and incorporate lessons learned from incidents and breaches.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.