Social Engineering
What is Social Engineering?
The psychological manipulation of people into performing actions or divulging confidential information. Social engineering attacks exploit human trust rather than technical vulnerabilities and include phishing, pretexting, and baiting.
Terms that appear alongside social engineering
Each of these is named in at least one of the same controls as social engineering. The number is how many controls name both.
- phishing 12 shared controls
- insider threat 7 shared controls
- security awareness 5 shared controls
- penetration testing 3 shared controls
- security awareness training 3 shared controls
- vulnerability 3 shared controls
- cybersecurity 3 shared controls
- nist 2 shared controls
Frameworks that govern social engineering
What the standards actually require on social engineering
Requirements naming social engineering across 6 standards, quoted from the control text.
Teach the workforce to spot social engineering, for example phishing, pretexting and tailgating.
CIS-14.2 · Train Workforce Members to Recognize Social Engineering Attacks →Teach staff to spot social engineering, including phishing, business email compromise, pretexting and tailgating. Implementation Groups: IG1, IG2 and IG3 (part of the IG1 essential cyber hygiene baseline, so every enterprise applies it). Asset type: Users.
cis-controls-v8-1::14.2 · Train Workforce Members to Recognize Social Engineering Attacks →Security awareness training must address threats and vulnerabilities that could affect cardholder data or sensitive authentication data, covering at minimum phishing (and attacks related to it) plus social engineering.
12.6.3.1 · 12.6.3.1 Awareness training covers phishing and social engineering →Personnel dealing with user account details are advised of what social engineering attacks are, how to manage such situations and how to report them.
ISM-2071 · Social engineering advice for account support staff →Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining.
fbi-cjis-security-policy::AT-2(3) · AT-2(3) Literacy Training and Awareness | Social Engineering and Mining →Information need: whether staff are prepared to react properly to social engineering attacks. Measure: the percentage of staff who react correctly to a test such as a simulated phishing email to selected staff;
iso-iec-27004-2016::B.15 · Social engineering preparedness →Questions people ask about social engineering
What is Social Engineering?
Why is Social Engineering important for compliance?
Which compliance frameworks address Social Engineering?
Where can I learn more about Social Engineering?
See how Social Engineering applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.