Scope Enterprise Active

Security Awareness & Training

To build a security-conscious culture by educating employees.

Domain ID
DOM-026
Domain Code
SAT
Business Owner
Security Awareness Team

Domain Overview

SAT · Full Domain Profile
Short Overview

Establishes the processes for developing, delivering, and measuring security awareness and training programs across the workforce.

Description

Focuses on developing a security-minded workforce through continuous education, role-based training, phishing simulations, and awareness activities.

Why This Domain Matters

Human error remains the leading cause of security incidents, yet many organizations struggle to maintain engagement, measure effectiveness, and change employee behaviors.

Business Objectives

    Business Risks

      Common Challenges

        Key Capabilities

        Stakeholders, Industries & Technologies

        SAT · Operating Context

        Typical Stakeholders

        Applicable Industries

        Applicable Technologies

        Keywords & Tags

        Associated Controls Catalog

        4 Active Controls in Domain
        Control ID Control Name Category & Type Criticality Status Requirements Action
        SAT-001 Security Awareness Program Establishes security awareness program i...
        Administrative
        Detective
        		 High Active 📋 10 Reqs View →
        SAT-002 Security Culture Management Establishes security culture management...
        Administrative
        Detective
        		 Medium Active 📋 10 Reqs View →
        SAT-003 Role-Based Security & Compliance Training Establishes role-based training includin...
        Administrative
        Detective
        		 High Active 📋 10 Reqs View →
        SAT-004 Security Awareness Exercises & Simulations Establishes security awareness exercises...
        Operational
        Detective
        		 Medium Active 📋 10 Reqs View →

        Compliance Requirements & Audit Crosswalk

        40 Specific Audit Clauses

        The following requirements dictate specific audit evidence criteria and testing steps mapped directly under the controls of this domain.

        REQUIREMENT ID REQUIREMENT TITLE & DETAILS MAPPED CONTROL TYPICAL OWNER ACTION
        SAT-001-R001 Awareness Program Framework The organization shall establish a secur... SAT-001 Security Awareness Program Security Awareness, Information Security, Human Resources, CISO View ↗
        SAT-001-R002 Awareness Strategy The organization shall define a security... SAT-001 Security Awareness Program Security Awareness, Information Security, Human Resources, CISO View ↗
        SAT-001-R003 Awareness Content Management The organization shall develop and maint... SAT-001 Security Awareness Program Security Awareness, Information Security, Human Resources, CISO View ↗
        SAT-001-R004 Awareness Communication The organization shall communicate secur... SAT-001 Security Awareness Program Security Awareness, Information Security, Human Resources, CISO View ↗
        SAT-001-R005 Awareness Delivery The organization shall deliver security... SAT-001 Security Awareness Program Security Awareness, Information Security, Human Resources, CISO View ↗
        SAT-001-R006 Participation Management The organization shall manage participat... SAT-001 Security Awareness Program Security Awareness, Information Security, Human Resources, CISO View ↗
        SAT-001-R007 Awareness Metrics The organization shall define and track... SAT-001 Security Awareness Program Security Awareness, Information Security, Human Resources, CISO View ↗
        SAT-001-R008 Executive Reporting The organization shall provide executive... SAT-001 Security Awareness Program Security Awareness, Information Security, Human Resources, CISO View ↗
        SAT-001-R009 Program Review The organization shall conduct periodic... SAT-001 Security Awareness Program Security Awareness, Information Security, Human Resources, CISO View ↗
        SAT-001-R010 Continuous Improvement The organization shall establish a conti... SAT-001 Security Awareness Program Security Awareness, Information Security, Human Resources, CISO View ↗
        SAT-002-R001 Culture Framework The organization shall establish a secur... SAT-002 Security Culture Management CISO, Security Awareness, Human Resources, Business Leadership View ↗
        SAT-002-R002 Culture Assessment The organization shall conduct regular a... SAT-002 Security Culture Management CISO, Security Awareness, Human Resources, Business Leadership View ↗
        SAT-002-R003 Behavioral Measurement The organization shall measure security... SAT-002 Security Culture Management CISO, Security Awareness, Human Resources, Business Leadership View ↗
        SAT-002-R004 Leadership Engagement The organization shall promote leadershi... SAT-002 Security Culture Management CISO, Security Awareness, Human Resources, Business Leadership View ↗
        SAT-002-R005 Employee Participation The organization shall encourage and ena... SAT-002 Security Culture Management CISO, Security Awareness, Human Resources, Business Leadership View ↗
        SAT-002-R006 Culture Metrics The organization shall define and track... SAT-002 Security Culture Management CISO, Security Awareness, Human Resources, Business Leadership View ↗
        SAT-002-R007 Improvement Initiatives The organization shall develop and imple... SAT-002 Security Culture Management CISO, Security Awareness, Human Resources, Business Leadership View ↗
        SAT-002-R008 Culture Reporting The organization shall report on securit... SAT-002 Security Culture Management CISO, Security Awareness, Human Resources, Business Leadership View ↗
        SAT-002-R009 Periodic Review The organization shall conduct periodic... SAT-002 Security Culture Management CISO, Security Awareness, Human Resources, Business Leadership View ↗
        SAT-002-R010 Continuous Improvement The organization shall establish a conti... SAT-002 Security Culture Management CISO, Security Awareness, Human Resources, Business Leadership View ↗
        SAT-003-R001 Training Framework The organization shall establish a role-... SAT-003 Role-Based Security & Complian... Security Training, Information Security, Compliance, Human Resources View ↗
        SAT-003-R002 Role-Based Training The organization shall develop and deliv... SAT-003 Role-Based Security & Complian... Security Training, Information Security, Compliance, Human Resources View ↗
        SAT-003-R003 Privacy Training The organization shall provide training... SAT-003 Role-Based Security & Complian... Security Training, Information Security, Compliance, Human Resources View ↗
        SAT-003-R004 Compliance Training The organization shall provide training... SAT-003 Role-Based Security & Complian... Security Training, Information Security, Compliance, Human Resources View ↗
        SAT-003-R005 Insider Threat Awareness The organization shall provide insider t... SAT-003 Role-Based Security & Complian... Security Training, Information Security, Compliance, Human Resources View ↗
        SAT-003-R006 Incident Reporting Training The organization shall provide training... SAT-003 Role-Based Security & Complian... Security Training, Information Security, Compliance, Human Resources View ↗
        SAT-003-R007 Specialized Security Training The organization shall provide specializ... SAT-003 Role-Based Security & Complian... Security Training, Information Security, Compliance, Human Resources View ↗
        SAT-003-R008 Training Records The organization shall maintain comprehe... SAT-003 Role-Based Security & Complian... Security Training, Information Security, Compliance, Human Resources View ↗
        SAT-003-R009 Training Effectiveness Review The organization shall conduct periodic... SAT-003 Role-Based Security & Complian... Security Training, Information Security, Compliance, Human Resources View ↗
        SAT-003-R010 Continuous Improvement The organization shall establish a conti... SAT-003 Role-Based Security & Complian... Security Training, Information Security, Compliance, Human Resources View ↗
        SAT-004-R001 Exercise Framework The organization shall establish a secur... SAT-004 Security Awareness Exercises &... Security Awareness, Security Operations, Human Resources, CISO View ↗
        SAT-004-R002 Phishing Simulations The organization shall conduct regular p... SAT-004 Security Awareness Exercises &... Security Awareness, Security Operations, Human Resources, CISO View ↗
        SAT-004-R003 Social Engineering Exercises The organization shall conduct social en... SAT-004 Security Awareness Exercises &... Security Awareness, Security Operations, Human Resources, CISO View ↗
        SAT-004-R004 Security Awareness Drills The organization shall conduct security... SAT-004 Security Awareness Exercises &... Security Awareness, Security Operations, Human Resources, CISO View ↗
        SAT-004-R005 Exercise Performance Measurement The organization shall measure performan... SAT-004 Security Awareness Exercises &... Security Awareness, Security Operations, Human Resources, CISO View ↗
        SAT-004-R006 Corrective Actions The organization shall implement correct... SAT-004 Security Awareness Exercises &... Security Awareness, Security Operations, Human Resources, CISO View ↗
        SAT-004-R007 Exercise Reporting The organization shall report on securit... SAT-004 Security Awareness Exercises &... Security Awareness, Security Operations, Human Resources, CISO View ↗
        SAT-004-R008 Lessons Learned The organization shall capture and docum... SAT-004 Security Awareness Exercises &... Security Awareness, Security Operations, Human Resources, CISO View ↗
        SAT-004-R009 Exercise Review The organization shall conduct periodic... SAT-004 Security Awareness Exercises &... Security Awareness, Security Operations, Human Resources, CISO View ↗
        SAT-004-R010 Continuous Improvement The organization shall establish a conti... SAT-004 Security Awareness Exercises &... Security Awareness, Security Operations, Human Resources, CISO View ↗

        Cross-Mapped Regulatory Frameworks

        Harmonized Control Mappings
        Framework Code Framework Name & Description Family / Category Version Action
        MAPPED NIST SP 800-50 Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        NIST-CSF NIST CSF (PR.AT) The NIST Cybersecurity Framework provide...
        NIST
        Framework
        		 v2 View →
        MAPPED ISO 27001 (Clause 7.2) Crosswalk regulatory baseline mapped under ASPIA UCL. Standard Baseline —
        COBIT2019 COBIT (APO07) COBIT is an enterprise governance and ma...
        COBIT
        Governance Framework
        		 v2019 View →
        NIST80053 NIST SP 800-53 (AT) NIST SP 800-53 Rev. 5 presents control f...
        NIST
        Control Catalog
        		 vRev. 5 View →
        PCI-DSS PCI DSS (Requirement 12) PCI DSS is an industry security standard...
        PCI
        Standard
        		 v4 View →