A Chief Information Security Officer (CISO) has determined through lessons learned and an associated after-action report that staff members who use legacy applications do not adequately understand how to differentiate between non-malicious emails and phishing emails. Which of the following should the CISO include in an action plan to remediate this issue?

The after-action report explicitly identifies the root cause as a human factor: staff members "do not adequately understand how to differentiate" between legitimate and phishing emails. The most direct and effective remediation for a knowledge and awareness gap is to provide targeted training and education. This action directly addresses the identified vulnerability by equipping employees with the skills needed to recognize and properly handle phishing attempts, thereby mitigating the specific risk highlighted by the CISO.

B. Replacement of legacy applications: This is incorrect because the problem lies with user understanding, not the applications themselves. Users would likely remain vulnerable to phishing regardless of the application they use.
C. Organizational governance: This is too broad. While a training program is part of a larger governance framework, "organizational governance" is not a specific, actionable plan to address this user-centric issue.
D. Multifactor authentication on all systems: While MFA is a critical control for preventing account takeovers after credential theft, it does not address the root cause of users clicking malicious links or downloading malware from phishing emails.

1. National Institute of Standards and Technology (NIST) Special Publication 800-61 Rev. 2, Computer Security Incident Handling Guide. Section 3.4.2, "Using Information from Incidents," states that incident data can be used to identify systemic security weaknesses, including the need for "additional user awareness training" and "clarification of policies and procedures." This directly supports using lessons learned to implement training.

2. National Institute of Standards and Technology (NIST) Special Publication 800-50, Building an Information Technology Security Awareness and Training Program. Section 1, "Introduction," outlines that the purpose of a security awareness and training program is to enhance security by improving awareness of threats and responsibilities, and teaching skills to "reduce the number of security incidents." This aligns perfectly with remediating the identified phishing knowledge gap.

3. Sans Institute, The Five Phases of a Security Awareness Program. This whitepaper, a widely respected source in cybersecurity education, outlines that a mature security awareness program is the primary method for changing user behavior and building a security-conscious culture to defend against threats like phishing. The scenario described by the CISO is a classic trigger for implementing or enhancing such a program. (Available through SANS Reading Room).