Security Awareness

In accordance with Administrative Procedure 3720, all staff, faculty, and other individuals operating on behalf of the District (Personnel) who use District Information Resources shall be required to complete security awareness training.

Personnel with access to privileged accounts or confidential information (as defined in the Long Beach Community College District Data Classification Standard) shall be required to complete additional role-based security awareness training relevant to any compliance and/ or regulatory programs.

Although many see cybersecurity as a technological problem, 68% of security breaches in 2023 involved a non-malicious human element; i.e., those behaviors that can be mitigated through security awareness training (Verizon 2024 Data Breach Report).

The purpose of security awareness training then is to educate Personnel on the risks and threats associated with an ever-evolving threat landscape. With relevant training at regular intervals, the risk of common attacks is shown to be greatly diminished.

Training Shall Promote Awareness of the Following:

• Best practices for protecting the confidentiality, integrity, and availability of protected data and information assets.
• Phishing (whaling, vishing, smishing, etc.), ransomware, and related cyber fraud.
• Procedures for reporting cyber incidents.

Training Shall Be Conducted on an Annual Basis

Security awareness training is currently conducted online through Keenan SafeColleges. Notifications including due dates, specific courses, and instructions shall be sent to Personnel in advance.

All Personnel shall be required to complete security awareness training and, at a minimum:

1. Complete the required Security Awareness Training Course once every 12 months.  
   
   All new Personnel are required to complete the Security Awareness Training Course within the first 30 days of their start date or before receiving access to District Information Resources.
    
2. Read Administrative Procedure 3720 and electronically sign the Computer and Network Use Agreement to acknowledge that they understand, agree to, and will abide by the security standards and procedures as stipulated within and are subject to any violation thereof. Access to the District’s Information Resource shall not be granted without the user’s signature.
    
3. Additional Security Awareness Training may be required for any District Personnel for reasons such as the Personnel’s role, District policy changes, new or updated Federal and State mandates, and even the evolving threat landscape itself.

Related Awareness Topics

• Data Classification Standard
• Common Types of Scams
• FERPA-Protected Data
• Incident Reporting Procedure
• OneDrive: Best Practices for Sharing Files and Folders
• Password Best Practices
• Phishing: How to Recognize Phishing Attempts
• Ransomware
• Working Remotely