What PR.AT-02 role-based training asks for in NIST CSF 2.0
PR.AT-02 asks that individuals in specialized roles receive awareness and training so they can do their role's tasks with cybersecurity risk in mind. It sits in the Awareness and Training (PR.AT) Category of the PROTECT Function in NIST CSF 2.0. The outcome is not a generic course completed by everyone. It is evidence that people who hold privileged access, approve payments, make leadership decisions or handle business-critical data understand the threats that matter to their work. When an auditor, customer or board asks for proof, the question is usually which roles were identified as specialized, what extra training each role received, and whether that training was tested and kept current. PR.AT-01 covers general awareness for all personnel and other users, such as recognizing social engineering and reporting suspicious activity. PR.AT-02 goes further. A security engineer changing firewall rules, a finance approver releasing a supplier payment or an executive authorizing a data transfer can each be targeted in ways a general course does not address. The risk is that these people act on privileged access, money or strategic decisions without knowing how attackers pursue them. CSF 2.0 absorbed the content of CSF 1.1 PR.AT-3, PR.AT-4 and PR.AT-5 into this Subcategory, which is why the scope now reaches executives, third-party staff and role-specific knowledge tests rather than only a single training program. The difficulty is maintenance. Role lists go stale as people move teams, take on new system permissions or change responsibilities, and the HR system rarely records security-relevant duties accurately. Contractors, managed service staff and other third parties often sit outside HR records entirely, so their role-based training is easy to miss. NIST publishes this as a voluntary framework and does not certify anyone against it, so no body will confirm your training meets PR.AT-02. Start by asking who owns the list of specialized roles, how it is reviewed, and whether third-party roles are included in the same list.
Which roles and third parties PR.AT-02 puts in scope
PR.AT-02 asks for additional training for people whose roles carry more cybersecurity risk, but it does not name those roles for you. The decisions below determine how large the specialized population is, who delivers and records the training, and how much mapping work comes before any course is built.
Identify the specialized roles first
Start with the roles NIST names as examples: security staff, finance and senior leadership. Each one has a different risk profile, so list the tasks that can cause harm, such as approving payments, changing access rights or authorizing system changes. A narrow list keeps the training population small and easier to refresh each year. Ask each department head to confirm which of their roles perform those tasks, and record the decision so an assessor can trace it.
Include staff with business-critical data access
Beyond named functions, PR.AT-02 reaches anyone whose access to business-critical data or systems gives them outsized influence. Examples include database administrators, HR staff with payroll data and customer support agents who can reset credentials. Pull access reports from identity and data systems rather than relying on job titles, because access often accumulates across roles. Expect this group to be the largest and least obvious part of the scope.
Decide on contractors and suppliers
The Implementation Examples for PR.AT-02 include training for contractors and suppliers. Decide whether a contractor in a specialized role must complete your course, must hold equivalent training from their employer, or is covered by a contract clause. Each option has a different effort profile: running your own course adds administration, while accepting equivalent evidence requires reviewing their material. Write the choice into supplier contracts so it is enforceable.
Map roles to systems and data
Build a matrix that links each specialized role to the systems, applications and datasets it can change or view. This map shows which training content each group needs, such as privileged access handling for administrators or payment verification for finance. It also gives you a defensible basis for scope when auditors ask why a given role is or is not included. Keep the matrix in your asset and access records so it updates when people move.
Test role knowledge after training
PR.AT-02 includes testing role-specific knowledge, which is a separate step from completing a course. Decide which scenarios each role must pass, such as a fraudulent payment request for finance or a privileged access request for administrators. Scoring and retake rules add design work, and the results become evidence of effectiveness. Confirm with your learning platform that completion and assessment records can be exported per person and per role.
Set the annual refresher cycle
The Implementation Examples describe annual refreshers for specialized roles. Once the scope is fixed, the recurring cost is mainly the yearly update of content and the re-enrollment of changed roles. Track role changes through HR events so newcomers and movers are enrolled within a set window. Ask your provider to confirm how role lists and enrollments are kept current, because stale rosters are a common gap at review time.
How an assessor tests role-based training
This table walks through the test steps an assessor typically follows for PR.AT-02, with the evidence each step asks for and the findings that most often appear. Read it as a checklist for your own pre-assessment review: if you cannot produce the item in the right-hand column, expect a finding.
| Test step | What the assessor checks | Evidence usually requested |
|---|---|---|
| Confirm the role list | The organization has a documented, current list of specialized roles such as security staff, finance, senior leadership and staff with access to business-critical data | Approved role inventory with owners, review dates and the criteria used to add or remove roles |
| Map roles to training | Each listed role has role-specific training defined, separate from general awareness covered under PR.AT-01 | Training matrix linking roles to course content, objectives and delivery method |
| Sample training records | A sample of individuals in each specialized role shows completed role-based training, with dates and scores where applicable | Learning management system exports, completion logs and attendance records for sampled staff |
| Test role-specific knowledge | Training includes some check of whether learners can apply what they were taught to their role's tasks | Quiz results, practical exercise outputs, tabletop participation records and remediation for failed checks |
| Check third-party coverage | Contractors and suppliers who hold specialized roles receive equivalent role-based training or evidence of their own equivalent training | Contract or onboarding clauses, third-party training attestations, and records for contractor accounts sampled |
| Verify refresher schedule | Refreshers occur at the interval the organization set in its own policy, and overdue individuals are followed up | Policy stating the interval, refresher calendar, overdue reports and escalation records |
| Review policy and ownership | Someone accountable owns the program and reviews content after incidents, role changes or new threats | Program owner assignment, review minutes and change history for course content |
Implementing PR.AT-02 in five steps
This sequence turns the PR.AT-02 outcome into working evidence: a known list of specialized roles, role-specific curricula, training that reaches contractors and suppliers, tested knowledge, and a refresher schedule that someone owns and reviews.
Identify specialized roles and their risks
Start by listing the roles that need more than general awareness. NIST's examples include security staff, finance, and senior leadership, and the list should also cover anyone with access to business-critical data, including third parties who hold those roles. For each role, record the systems and data it touches, the decisions it makes, and the attacks that would hurt most if that role were targeted, such as payment fraud for finance or account takeover for administrators. Your HR, IT, and business owners should review the draft, since they know who really holds privileged access. This step is complete when you have a role register that names each role, its owner, its risk notes, and the people or third-party accounts assigned to it.
Define role-specific curricula
For each role in the register, define what that role must know to do its tasks with cybersecurity risk in mind. A treasury analyst needs payment verification steps and business email compromise patterns. An engineer with production access needs secure change handling and secrets management. Senior leaders need decision-level material on incidents, reporting duties, and their own exposure to social engineering. Map each module to the role, the system or process it supports, and the internal policy it reflects. Ask the course owner to confirm that content matches current procedures before anything goes live. The output is a curriculum map linking roles to modules, owners, and review dates.
Deliver training and extend it to contractors and suppliers
Deliver the role-based modules through your learning platform, and include contractors, managed service providers, and supplier staff who hold the same roles. Access to a role's systems should depend on the training being assigned, so contractors cannot slip past the requirement because they sit outside the employee directory. Put the contractual obligation in the statement of work or supplier agreement so the duty is written down and enforceable. Self-hosted learning platforms such as Moodle can record activity completion for each learner, which gives you a per-person completion log. Confirm the completion conditions you set, because a module can be marked complete when it is viewed, graded, or ticked manually. The output is a completion log that covers employees and third parties by role.
Test role-specific knowledge
Completion alone does not show that people can do their role's tasks safely, so test role-specific knowledge after training. Use scenario-based questions or short practical exercises drawn from the role's real workflows, such as approving a changed supplier bank account or responding to a suspicious privileged access request. Record the results against each person and role, and decide in advance what a failing result triggers, such as remedial modules or a supervised period before access is granted. Review the questions with the role owner each time a process changes. The output is test results by role, with the remediation actions taken for anyone who did not pass.
Set and track annual refreshers
NIST's Implementation Examples for PR.AT-02 include annual refreshers, so set a recurring calendar for each role's training and testing. Assign an owner who sees the calendar, receives overdue alerts, and escalates gaps to the role's manager. Update the curriculum when roles change, when new systems or threats affect the role, or when incidents show a gap. Ask your provider or internal team to confirm how refresher assignments and completion records are kept, and how long they are retained for your audit needs. The output is a refresher calendar and a change log showing when each curriculum was reviewed and why. Together with the role register, completion log, and test results, this calendar is the evidence an assessor will ask to see.
How training records prove a role received the right training
Completion alone is weak evidence for PR.AT-02. A training log showing that a finance analyst opened a module says little about whether the analyst was trained for the role's risks. Assessors typically look for a chain that links three things: the specialized role, the curriculum assigned to that role, and a test result showing the person can apply it. Your records should let an assessor start from a role list, follow the assigned modules, and see graded or signed-off outcomes for each person in that role, including contractors and suppliers who hold the same roles.
Learning management systems can produce this chain if they are configured for it. In Moodle, the Activity completion API marks an activity complete when a learner views it, when they receive a grade from it, or when they tick it manually, depending on the conditions set for that activity. Those conditions are the important part. A view-based completion shows exposure, a graded completion shows a score against a stated pass mark, and a manual tick shows that someone attested to the outcome. Before relying on any of these, decide for each role-specific module which condition counts as evidence, and write that decision down. Confirm the exact settings with your own Moodle version and configuration, since completion behavior depends on how each activity is set up.
Documented conditions are what turn raw records into evidence. Record, for each module, the role it serves, the completion rule, the pass threshold where grades apply, who may sign off manually and what they must check, and how often refresher training is required. Keep the role assignments themselves under change control so an assessor can see who held a specialized role on a given date. Ask your implementation partner to test the chain end to end with a sample of users in each role, and ask your auditor which records they will sample. The aim is a report that an independent reviewer can reproduce without asking the training team to explain what a checkbox meant.
Evidence that passes a PR.AT-02 review
PR.AT-02 asks whether people in specialized roles are trained well enough to do their tasks with cybersecurity risk in mind. An assessor will look for a chain of records: who holds those roles, what they are taught, who finished it, and whether it stays current. The cards below cover the artifacts that connect those links and how to keep each one accurate between assessments.
Specialized role register
A written list of the roles your organization treats as specialized, such as security operations, finance approvers, senior leadership, and staff with access to business-critical data. For each role, record the named holders, the reason the role needs extra training, and the owner who approved it. Review the register when reporting lines change or when a new system grants elevated access. An assessor will compare this list against your access reviews, so a role that exists in access records but not in the register is a visible gap.
Role-specific curricula
Course outlines and materials tied to each specialized role, showing the tasks each role performs and the risks it faces, such as payment fraud for finance or credential misuse for administrators. Generic awareness content does not satisfy this artifact on its own. Version each curriculum, record the date of each revision, and tie changes to incidents, new tooling or threat changes so the content reflects current risk.
Per-person completion and assessment records
Records showing which named individual completed which role-specific course, when, and how they performed on any knowledge check. Completion alone is weak evidence, so confirm that the assessment tests role knowledge, not just attendance. If you use a learning management system such as Moodle, check how its activity completion rules are configured, since a course can be marked complete when a learner only views it unless you require a grade or manual confirmation. Export these records on a schedule so the audit copy does not depend on one platform.
Third-party training attestations and contract clauses
Contractors, managed service providers and suppliers who hold specialized roles need role-based training too. Evidence can be a contract clause requiring training, a signed attestation from the supplier, or training records the supplier provides for its named staff. Confirm that clauses name the roles covered and the refresh frequency. Review attestations when a supplier changes personnel on your account, not only at contract renewal.
Refresher schedule with dates
A calendar that sets the due date for each role's refresher training and tracks each person against it. NIST's Implementation Examples for PR.AT-02 include annual refreshers, so the schedule should show the cycle, the last completion and the next due date for every holder. Overdue entries should trigger an escalation to the role owner. Keep the schedule in a system that records changes, so an assessor can see when a due date moved and who approved the change.
Role change records that trigger training
Records showing that a move into a specialized role, or a grant of elevated access, led to training before or shortly after the change. Connect these records to your joiner, mover and leaver process and to access provisioning tickets. Without this link, an assessor may find people with privileged access who never completed role training. Check the records each quarter against access reviews to catch changes that bypassed the process.
What meeting PR.AT-02 costs in money and effort
This table breaks down the cost components of running role-based training for PR.AT-02, showing who is paid for each, whether it is one-time or recurring, and what pushes it up or down. Read it as a checklist for building a quote, since NIST publishes no prices and the figures depend on your roles, population and platform choices.
| Cost component | Who is paid or who carries the effort | One-time or recurring | What drives it up or down |
|---|---|---|---|
| Learning platform licenses or self-hosting | Software vendor (licenses) or your platform team and hosting provider (self-hosted) | Licenses recur; self-hosting setup is one-time with recurring operations | Learner count and feature needs; open-source platforms such as Moodle (GPL-3.0-or-later) can remove license fees but add hosting, patching and upgrade work |
| Role analysis and curriculum for each specialized role | Internal training lead, security team, or an implementation partner under a written scope | One-time per role, with periodic revision | Number of specialized roles identified (security, finance, senior leadership, and others with access to business-critical data) and how different their tasks are |
| Instructor and content development time | Internal subject matter experts or external content developers | Initial build is one-time; updates recur | Content reuse across roles, how often threats and systems change, and whether you can share modules with PR.AT-01 general training |
| Role-specific testing design | Security or training staff, or a partner who designs the knowledge checks | One-time design, recurring administration | Number of roles tested and whether results are scored and tied to completion records |
| Third-party onboarding and training | Your procurement and vendor management teams; contractors and suppliers who hold specialized roles, or their employers | Onboarding is one-time per third party; annual refresh recurs | Size of the third-party population in specialized roles and whether contracts already require training |
| Record keeping and completion tracking | Your training administrators and platform team | Recurring | Completion tracking features in the platform (for example, Moodle activity completion), audit trail needs and retention periods |
| Annual refresher delivery | Internal trainers or content owners; learners' time | Recurring each year | Number of learners in specialized roles, frequency of role changes, and how much content must be rebuilt each cycle |
| Auditor sampling and evidence review | Independent auditor or assessor, who issues any report; your staff who prepare samples | Recurring with each assessment cycle | Number of roles and third parties sampled, and how easily you can produce training records, role lists and test results on request |
Which parts of PR.AT-02 are worth outsourcing
An implementation partner is most useful for the preparation work around PR.AT-02 role-based training, not for the training decisions themselves. The organization still decides which roles count as specialized, what each role must know, and how much risk it accepts if someone falls short. Partners can take on the groundwork: scoping the roles that need extra training (security staff, finance, senior leadership and anyone with access to business-critical data, including third parties in those roles), mapping each role to its tasks, and drafting curricula that the organization's risk owners approve. Ask for the role inventory and curriculum drafts as named deliverables in a fixed-scope quote, with the sign-off step written in.
Configuration of the self-hosted learning platform is the next area where outside help saves time. A partner can install and harden an open-source learning management system such as Moodle inside your own infrastructure, build role-specific courses, set up enrollment and access by group, and configure activity completion so each learner's progress is recorded. Confirm with the partner exactly which completion conditions they will set (viewing, grading or manual tick) and who checks that the settings match your curriculum. Platform setup, backups and upgrades are usually one-time work followed by a smaller recurring cost, so ask which of these a retainer would cover after go-live.
Evidence collection and testing are the parts most often underestimated. A partner can design the records that show each specialized role was trained, tested for role-specific knowledge and refreshed on schedule, then automate their export. They can also run tests that check whether training changes behavior. Your assessor, not your partner, decides whether that evidence satisfies any framework requirement, and only an independent auditor or certification body issues a report or certificate. Confirm early which assessor will review your records so the evidence format matches what they expect.
Who does what for PR.AT-02
Your organization owns PR.AT-02. That means deciding which roles are specialized, approving the training content for each, and proving that people in those roles are trained and tested. NIST's Implementation Examples for PR.AT-02 point to identifying roles such as security staff, finance and senior leadership, giving role-based training that includes contractors and suppliers, testing role-specific knowledge, and running annual refreshers. Those decisions belong to accountable managers, not to a vendor.
- Role identification: Maintain a list of specialized roles, the business-critical data each role touches, and the reason each needs extra training.
- Content ownership: Approve role-specific material, such as secure payment handling for finance or incident escalation for senior leaders.
- Third-party obligations: Write training requirements into contracts for contractors and suppliers who hold these roles, and track their completion.
- Records and testing: Keep completion records, role-specific test results and annual refresher dates that an assessor can sample.
- Ongoing review: Update the role list when responsibilities or systems change.
Check that someone named in your governance structure can show, for each specialized role, who was trained, when, on what content and with what result.
An implementation partner such as DeployOpen can help set up the systems and evidence that PR.AT-02 depends on, under a written, fixed scope. Typical work includes configuring a self-hosted learning platform, building role-specific course paths, wiring completion and assessment data into your records, and documenting how the process runs. The partner prepares the machinery and the documentation. It does not decide which roles are specialized, and it does not certify that training happened to an adequate standard.
- Platform setup: Deploy and harden a self-hosted learning platform inside your own infrastructure, such as a Moodle instance configured with activity completion rules that reflect each role's requirements.
- Course build: Draft role-based modules and knowledge checks for your review and approval.
- Evidence pipeline: Export completion, grade and refresher data in a form your auditor can sample.
- Process documentation: Write runbooks for enrollment, annual refreshers and offboarding of third-party users.
- Handover: Train your staff to administer the platform and maintain the records after the engagement ends.
For any partner, confirm in writing which outputs are configuration and documentation, and which decisions remain with your staff.
An independent auditor, assessor or certification body tests PR.AT-02 and issues any report or conclusion. NIST does not offer certifications or endorsements for CSF implementations, so no body certifies a CSF 2.0 program on NIST's behalf. Where your customer or regulator asks for an independent view, the auditor's scope and report type decide what it means. The auditor samples records and interviews staff. Independence means the auditor did not design the controls it tests, and that the partner's work is one input the auditor reviews, not a substitute for its own testing.
- Sampling: Select specialized roles and check that training matches each role's documented requirements.
- Record testing: Verify completion dates, test scores and refresher cycles against source data.
- Third-party checks: Confirm that contractors and suppliers in specialized roles have received the required training.
- Interviews: Ask role holders what they were trained to do and whether they can explain it.
- Reporting: Issue findings and any formal report under the agreed scope.
Before engaging anyone, ask whether the auditor will test your records directly and whether the partner will be restricted to preparing them.
Where PR.AT-02 programs usually fall short
Role-based training programs tend to fail in predictable places: the audience is never defined, the content is generic, and no one checks whether anyone learned anything. The cards below pair each common gap with a practical fix, so the program can show that people in specialized roles can do their work with cybersecurity risk in mind.
Generic training for specialized roles
Many programs send the same annual module to everyone, including engineers who administer privileged accounts and finance staff who approve payments. PR.AT-02 asks for training that matches what each role actually does. Check whether each specialized role has content tied to its own tasks, such as payment verification for finance, secure configuration for platform staff, and incident decision-making for senior leaders. Ask for the module list per role, not a single course catalog.
Contractors and suppliers left out
Outsourced administrators, managed service staff and contractors often hold the same privileged access as employees but never enter the internal learning system. The fix is to make role-based training a contract term: name the roles covered, the content required and the evidence the supplier must return. Confirm that onboarding of third parties with access to business-critical data includes the same role check as employees.
No maintained role register
Without a current list of which roles count as specialized, training requirements exist only in someone's memory. Build a role register that links each job title or access group to the training it needs, and assign an owner who reviews it when org charts or system access change. Ask who can point to the register and when it was last reviewed.
Knowledge never tested
Completion of a course shows attendance, not competence. PR.AT-02 Implementation Examples point toward testing role-specific knowledge, for example through scenario questions about a payment fraud attempt or a privileged access request. Failed questions should trigger targeted retraining. Confirm that the assessment is built around the tasks in the role and that results are kept with the individual record.
Refreshers not tracked
Role-based training often happens once at onboarding and is then forgotten. NIST's Implementation Examples for PR.AT-02 include annual refreshers, so the program needs a due date per person and role, reminders before expiry and escalation to managers when training lapses. Ask for a report showing how many people in specialized roles are current and how many are overdue.
Records detached from people
When an employee moves from a general role into finance or an administrator position, the old completion records often stay behind, and the new role's training never starts. Link training records to identity and role data so that a role change triggers the new training requirement automatically. Confirm that the learning platform and the identity system exchange this data, or that an owner reconciles them on a fixed schedule.
Questions buyers ask about PR.AT-02 training
Does NIST certify that our role-based training meets PR.AT-02?
No. NIST does not offer certifications or endorsements of CSF-related products, implementations or services, and it has no plans for a conformity assessment program. PR.AT-02 is an outcome you describe and evidence in your own environment. If a customer or regulator wants independent assurance, an outside assessor reviews your program and issues whatever report it is licensed to issue. DeployOpen prepares training records, role lists and test results for that review, but it does not issue reports or certificates.
How much effort does role-based training take for our organization?
The effort depends on how many specialized roles you have and how different their tasks are. NIST's Implementation Examples point to security staff, finance, senior leadership and anyone with access to business-critical data as starting groups. Effort comes from four pieces: identifying the roles, building content for each role, testing role-specific knowledge, and keeping records. Most of the work is in the first two. Ask any provider to break its estimate into those four pieces so you can see where your team's time goes.
Can our own team run role-based training without an outside partner?
Yes, many organizations do this in-house, especially where security and HR already have a working training process. The main gaps are usually role mapping, content for finance or engineering tasks, and evidence capture. Your team owns the training program and its outcomes in every case. An implementation partner can help set up a learning platform, such as a self-hosted Moodle instance, and build the tracking so that completion and test results are recorded consistently. Decide which parts you will keep in-house and which you will outsource before you request a quote.
What does role-based training ask of our staff and managers?
It asks people in specialized roles to spend time on training that relates directly to their work, and it asks managers to confirm that the right people are enrolled. Staff should understand the risks linked to their tasks, such as payment approvals for finance or privileged access for administrators, and they should be able to show that knowledge through a short assessment. Leaders need to approve the role list and make time in calendars. Plan the schedule with these groups early so the training does not compete with peak business periods.
How long does it take to set up role-based training?
No fixed duration applies because the timeline depends on scope: the number of roles, the number of third parties, whether a learning platform already exists, and how much existing material can be reused. A narrow scope covering two or three roles on an existing platform takes far less time than a program covering many business units and external suppliers. Ask for a written scope and milestones before work starts, and check that the schedule separates role mapping, content, testing and evidence collection.
How do we handle training for contractors and third parties?
PR.AT-02 covers third parties who hold specialized roles, and NIST's Implementation Examples call for role-based training that includes contractors and suppliers. Start by listing which external staff hold those roles and what access they have. Then decide whether they complete your training, their own equivalent training, or a documented combination. Put the requirement into contracts and keep records of who completed what. The contract and vendor review work is often best coordinated with legal and procurement, not only with the security team.
How often should role-based training be refreshed?
NIST's Implementation Examples for PR.AT-02 include annual refreshers, so an annual cycle is the reference point to plan against. Refresh sooner when roles change, when new systems or payment processes are introduced, or after a relevant incident. Keep dated records of each completion and each test result so you can show the cycle was followed. Confirm the cadence your customers, regulators or contracts expect, because some may ask for more frequent updates than the framework's baseline.
How DeployOpen prepares PR.AT-02 evidence
DeployOpen plans, implements and documents self-hosted open-source learning and evidence systems inside the client's own infrastructure, and prepares the records an assessor will ask to see for PR.AT-02. In practice that means setting up a learning management system in the client's cloud account, data center or air-gapped network, defining role-based course paths for security staff, finance, senior leadership and third parties in those roles, and configuring completion tracking so that each role's training can be shown as delivered. Moodle is one example of an open-source platform used for this work, and its activity completion settings determine whether a learner is marked complete by viewing material, receiving a grade or ticking a box, so those settings need to match the evidence the organization intends to present. The client still decides which roles count as specialized, what each role must learn and how often refreshers run.
DeployOpen does not issue audit reports, attestations or certifications. Whether PR.AT-02 is met is a judgment made by the organization's own governance and, where a customer, contract or regulator requires an external view, by an independent auditor, assessor or certification body. NIST itself does not offer certifications or endorsements of CSF implementations or services. DeployOpen's role is to prepare systems, controls and evidence so that the independent party can test them. Confirm this boundary in writing before engaging any implementation partner, and ask your assessor which records they expect to sample, such as enrollment lists, course content versions, completion logs and test results.
