AT-1 Policy and procedures
Awareness and training policy and procedures: documenting, distributing, owning and periodically reviewing the policy and procedures that govern security and privacy training, and what assessors examine.
AT Awareness and training
Awareness and training (AT) family of NIST SP 800-53 Rev. 5: security and privacy literacy training, role-based training, training records and feedback on training results.
AT-2 Literacy training and awareness
Security and privacy literacy training and awareness for all system users, including managers, executives and contractors: initial and recurring training, awareness techniques, content updates and lessons learned, plus insider threat and social engineering enhancements.
AT-3 Role-based training
Role-based security and privacy training for personnel in defined roles, before they get access or perform duties and periodically after, with content updates and lessons learned, plus the privacy baseline enhancement on processing PII.
AT-4 Training records
Documenting and monitoring security and privacy training activities and retaining individual training records for a defined period, the evidence trail behind AT-2 and AT-3.
AT-6 Training feedback
Giving defined personnel feedback on organizational training results at a defined frequency, so that failures in critical roles reach senior managers; not in any SP 800-53B baseline.
