Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): As part of initial training for new users and {{ insert: param, at-2_prm_1 }} thereafter; and When required by system changes or following {{ insert: param, at-2_prm_2 }}; Employ the following techniques to increase the security and privacy awareness of system users {{ insert: param, at-02_odp.05 }}; Update literacy training and awareness content {{ insert: param, at-02_odp.06 }} and following {{ insert: param, at-02_odp.07 }} ; and Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.

Provide practical exercises in literacy training that simulate events and incidents.

Provide literacy training on recognizing and reporting potential indicators of insider threat.

Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining.

Provide literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using {{ insert: param, at-02.04_odp }}.

Provide literacy training on the advanced persistent threat.

Provide literacy training on the cyber threat environment; and Reflect current cyber threat information in system operations.