Federal Pub Provides IT Security Training Approach (NIST SP 800-16)

The cool thing about the National Institutes of Standards and Technology publication (NIST SP 800-16) is that it not only informs about how to approach information technology security training, but could actually be used as a guideline for all types of training approaches and in helping to determine needs. We assume that federal cutbacks and austerity measures due to the economic downturn has brought out the merits and methodology or purpose of this publication; to get smart about IT Security/training of same. While the original publication date was in 1998, the usefulness of this 14 year old tool is more relevant than ever and is the classic example of why this blog was started.  "If it works, use it!"
Here is a reconstructed version of the pub's "Framework" table that highlights the proposed methodology and rationale for the desired outcomes of IT security measures.

Framework For Information Technology Security Training*
	Awareness	Training	Education
Attribute:	What	How	Why
Level:	Information	Knowledge	Insight
Learning Objective:	Recognition, Retention	Skill	Understanding
Example Teaching Method:	Media: video, newsletters, posters	Practical Instruction: -lecture and/or demo -case study -hands on instruction	Theoretical Instruction: -Seminar & Instruction -Reading & Study -Research
Test Measure:	True/False, Multiple choice (Identify learning)	Problem solving: e.g. recognition, resolution (apply learning)	Essay (interpret learning)
Impact Timeframe:	Short-term	Intermediate	Long-term

*Reference NIST SP 800-16, April 1998, Information Technology Security Training Requirements: A Role and Performance Base Training Model, p 18.

Federal CIO University - At GSA

The CIO Council addresses information technology education for Chief Information Officers (CIOs) and that has led to a specific initiative to address the needs of federal executives - The CIO University. 


Originally established by Executive Order 13011 (Federal Information Technology) and later codified by the E-Government Act of 2002, the CIO Council is the principal interagency forum for improving agency practices related to the design, acquisition, development, modernization, use, sharing, and performance of Federal information resources.

The process by which CIO university curriculum was developed was a careful one that involved senior executives, industry representatives and academic partners. Beginning with the good work done by the CIO Council to list a set of high-level competencies that met the requirements of the Clinger Cohen law, GSA and the CIO Council agreed that universities would need more specific guidance to guarantee the full intent of the law would be met. To do that, it was necessary to add specificity to these categories. Using a facilitated group process, each of the major content areas were reviewed using groupware to capture all the comments of focus groups consisting of representatives from academia, industry and senior executives from government. Following established principles based on adult learning theory, behavioral learning objectives were collected that were a product of the group consensus.

CIO University - FAQs

Read more…

How do I enroll in CIO University?

There is no enrollment process through the government. Students simply apply to one of our approved Master's Programs and register for their "CIO University" specific program (the listed point of contact from each university can assist students with specific questions on courses.) After a student receives their graduate degree, their name is forwarded to GSA and the CIO Council. They are then instructed to fill out an online exit survey and invited to a graduation ceremony held in July in Washington, DC. For those unable to attend, CIO University certificates are mailed after the graduation. Note: all travel is the responsibility of the student.

25 Point Implementation Plan To Reform Federal Information Technology Management

dated 12/09/2010.

THE CHALLENGE

The Federal government invests approximately $80 billion per year in information technology (IT). Yet far too often, these investments fail to deliver on their plans without adequate intervention or warning, resulting in billions of wasted taxpayer dollars. We must change the way Washington works when it comes to IT.

THE SOLUTION

On June 30, 2009, the Federal Chief Information Officer (CIO) launched the IT Dashboard, which allows the American people to monitor IT investments across the Federal government. If a program is over budget or behind schedule, the IT Dashboard tells you that, and by how much. The IT Dashboard also provides contact information for the person responsible, the agency CIO, and allows the public to provide feedback.

However, it is not enough to simply shine a light on IT programs and hope results follow. As the President said in his inaugural speech “those of us who manage the public's dollars will be held to account, to spend wisely, reform bad habits, and do our business in the light of day, because only then can we restore the vital trust between a people and their government.” Following the President’s lead, on January 13, 2010 the Federal CIO held the first TechStat Accountability Session (or more simply, TechStat). A TechStat is a face-to-face, evidence-based review of an IT program, undertaken with agency leadership, powered by the IT Dashboard. In each TechStat session, the team works together to carefully examine program data, with a focus on problem solving that will lead to concrete action to improve overall performance.

Techstat Toolkit

Learn more...