Provide role-based security and privacy training before access or assigned duties and annually thereafter, and when system changes require it, to four groups: everyone with unescorted access to a physically secure location, general users, privileged users and personnel with security responsibilities, each with the minimum topics the Policy lists (from the section 4.2 penalties and incident reporting through access control, media protection, cryptography and mobile devices to the findings of the last FBI CJIS audit); update the content annually and after audits, environment changes, incidents or Policy changes, and incorporate lessons learned; a CSO or SIB Chief may accept another agency's training documentation at the accepting agency's risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.