risk
Inadequate security awareness and training
Personnel lacking security awareness and training are more likely to make harmful mistakes, misconfigure systems, or be deceived — providing weak human defence and undermining every technical control. Includes insufficient privacy training.
In catalog since 2026-09-17T22:28:00Z · Last changed 2026-09-17T22:28:00Z (f368a6cce277)
Record JSON · Open in map · Data retrieval guide
Catalog revision: 791ff2dd3a45707290badee660f185e514d15f1cf518908628f425c2f2c56ee4. A connection does not establish full coverage.
Attributes
- category
- cyber_security
- domain
- Awareness & Training
- Human Resources / Personnel Security
- taxonomy
- iso-27005-vulnerability
- nist-privacy-risk
- inherent_rating
- high
Details
- risk_id
- aware-insufficient-training
- category
- cyber_security
- likelihood
- high
- impact
- medium
- inherent_rating
- high
- treatment
- mitigate
- taxonomies
- iso-27005-vulnerability
- nist-privacy-risk
Source
No record-specific source URL is provided.
Connections
- UC-HR-06 — Embed security and competence in HR practices mitigates Inadequate security awareness and training
- strength
- related
- rationale
- Developing personnel through training and embedding cybersecurity across HR stages builds a security-aware workforce; enabler, not the dedicated awareness-training control.
- UC-TRAIN-01 — Deliver security awareness training to all personnel mitigates Inadequate security awareness and training
- strength
- primary
- rationale
- Delivering security & privacy awareness training to all personnel is the direct first-order defense against the inadequate-awareness gap.
- UC-TRAIN-03 — Record training completion and measure effectiveness mitigates Inadequate security awareness and training
- strength
- related
- rationale
- Monitoring completion, following up non-completion, and measuring effectiveness assures coverage and drives improvement, but this detective control delivers no training itself; the operative defense is delivery (UC-TRAIN-01).
- UC-TRAIN-02 — Train personnel with specialized security roles and duties mitigates Inadequate security awareness and training
- strength
- related
- rationale
- Role-based training raises the security competency of high-risk roles, reducing the overall training-adequacy gap for that population.