Which provision did the Computer Security Act of 1987 mandate regarding federal employees who use those systems?

• A. Security awareness training
• B. Mandatory encryption
• C. Regular penetration testing
• D. Occasional security briefings

Answer: (A)

Security awareness training for people who use federal automated information systems is what this act established. The idea is that users are a key line of defense, so agencies must implement a security program that includes training to teach employees and contractors about their security responsibilities, appropriate use of systems, and how to recognize and respond to threats. This training helps ensure policies are followed and sensitive data is protected, addressing human factors that no technical control can fully mitigate.

The other options aren’t the baseline requirement the act set. It doesn’t mandate encryption for all users by default, nor does it require regular penetration testing or only occasional security briefings for every user.