AT-1 Policy and procedures: requirements and evidence

What AT-1 policy and procedures require before any training starts

AT-1 asks the organization to document an awareness and training policy and the procedures that implement it, distribute both to defined roles, assign them to a designated official, and review and update them at a defined frequency and after defined events. If an assessor or a customer contract asks for the AT-1 documents and your team can show training content but no governing document, the gap is not in the courses. It is in the absence of an owner, a scope and a set of rules that say who must be trained, on what, how often and how completion is recorded. Without that document, training cannot be shown to be consistent, current or owned by anyone accountable for it.

AT-1 has no control enhancements in SP 800-53 Release 5.2.0, but it is selected in the low, moderate and high security control baselines and in the privacy baseline, so it applies to every system in scope regardless of impact level. The control is short, which is part of what makes it hard. Its organization-defined parameters, such as who receives the policy, who the designated official is, and how often the policy is reviewed, must be filled in with specific values rather than left general. Reviewers test those values against the document itself and against the environment, so a policy that names a role nobody holds, or a review cycle the team has never run, will fail even though the wording looks complete. Before drafting, confirm these parameters with the control owner and the organization's own governance calendar, since the review frequency and triggering events are organizational decisions and not values supplied by NIST.

The practical test is whether the documents match what happens. The procedures should describe the real steps for delivering training, collecting records and handling exceptions, and the policy should point to the systems or repositories where those artifacts live. An open-source wiki with version history, such as XWiki, can hold the policy and procedures so that each change is recorded with its date and author, which supports the review evidence an assessor will ask for. Confirm with your tooling owner which version history and access controls your chosen platform provides before relying on them as evidence.

Which systems, teams and third parties AT-1 policy must cover

AT-1 is selected in the low, moderate and high baselines and the privacy baseline, so the policy's scope follows each system's impact level and the organization's privacy obligations. The cards below cover the decisions that change how much the policy and procedures must reach, and who must own them.

Systems inside the authorization boundary

The policy and procedures should name the systems whose users must receive security and privacy training, which normally means every system inside the authorization boundary described in the system security plan. Check whether the boundary includes shared services such as identity providers, ticketing tools and collaboration platforms, because their users are part of the training population even when the system owner sits elsewhere. An illustrative example: a payroll application that depends on a shared identity provider brings that provider's administrators into the training scope. Confirm the boundary with the system security plan before drafting scope language.

Impact level sets the baseline

Because AT-1 is selected in the low, moderate and high baselines, the impact level of each system determines which baseline applies and therefore how formal the policy must be. A system categorized at a higher impact level is expected to carry a more detailed set of training procedures and a stricter review cycle. Document the categorization that drives the baseline selection in the policy itself, so an assessor can trace the scope back to the security categorization.

Privacy baseline and PII obligations

AT-1 also appears in the privacy baseline, which applies regardless of impact level. Where the organization processes personally identifiable information, the policy should say which roles receive privacy training alongside security training, and which personnel handle PII under the privacy program. Ask the privacy office to confirm which processing activities the policy must cover before scope is fixed, so privacy-specific training obligations are not left to individual teams.

Personnel groups who receive training

The policy should define each group that must be trained: general users, managers, executives, and contractors. Each group carries different expectations, so the policy should state which groups receive which training and who decides the mapping. Include contractors and temporary staff explicitly, since they often fall outside employee onboarding. Ask the HR and procurement teams to confirm the current roster of groups before the policy is approved.

Teams that own delivery and records

Training delivery, content updates and training records are often owned by different teams, such as security, HR, learning and development, and system owners. The policy and procedures should name the accountable official, the delivery owner and the records owner, and describe how they hand off. An assessor will look for a clear owner for each step, so unassigned responsibilities are a common gap. Confirm these owners in writing and record them in the procedures.

Third parties who deliver or host training

Many organizations use external learning platforms, managed training providers or consultants to deliver content. The policy should cover what the third party does, where training records are stored, and how the organization retains oversight of content and completion data. Check contract terms for content review rights, record access and data handling before relying on an external provider for AT-1 evidence. Where a third party hosts the training platform, confirm that its records can be exported in a form the organization can retain.

How the policy and the procedures differ, and why assessors check both

The policy states what the organization intends to do about security and privacy training, who is responsible, which personnel and systems fall in scope, and how management backs the program. The procedures describe how staff actually carry that intent out: who schedules each training event, how completion is recorded, who follows up on overdue personnel, and who reviews the results and updates content. A policy that promises role-based training for privileged staff is not enough on its own, because someone has to know the steps that deliver it. Before the assessment, confirm that each document has a named owner, that the policy is approved by a senior official, and that the procedures identify the role responsible for every step, not just the team.

Assessors test AT-1 by comparing the two documents with what happens in practice. Under the examine method in SP 800-53A, they read the policy and procedures and check that they are distributed to the defined roles, that the review frequency and triggering events are stated, and that the system security plan and privacy plan describe training consistently with them. Under the interview method, they ask personnel with training responsibilities how they run the program and whether they know the current documents. A gap appears when a procedure names a tool or spreadsheet that nobody uses, or when the system security plan describes a training cadence the procedures never mention. Ask the control owner to walk an assessor from a policy statement to a completed training record, so that the trail is visible from end to end.

The practical decision is where to keep the documents and how to show their history. A wiki or documentation platform with version control lets you show who changed a procedure, when, and what the previous wording said, which is the kind of evidence an assessor asks for at review time. For example, in an illustrative setup, the policy could live in a wiki with page-level permissions limiting edit rights to the control owner, while the procedures sit in a separate book that the training team maintains. Confirm with your assessor which review cadence and approval records they expect, because the defined frequency in your organization's policy sets the standard you will be measured against.

How an assessor tests AT-1 and what they ask to see

This table compares the three assessment activities an assessor uses for AT-1, the evidence each one asks for, and the gaps that most often cause findings. SP 800-53A assesses AT-1 with 17 determination statements under the examine and interview methods, so read each row as a test the organization should expect and prepare for before fieldwork begins.

Test approach	Evidence requested	Common findings
Examine the awareness and training policy and procedures	Current signed policy, implementing procedures, version history, stated scope, and the named official who owns them	Policy names no accountable official, or procedures describe a process nobody follows
Examine the system security plan and privacy plan	Plan sections that reference the awareness and training policy, roles covered, and the control implementation statement for AT-1	Plan cites a policy version that has since been replaced, or the privacy plan omits training roles
Examine distribution and review records	Distribution list or acknowledgment records, review dates, and change log showing updates after defined events	No record of distribution to defined roles, or review frequency is stated nowhere in the document
Interview personnel with awareness and training responsibilities	Walkthrough by the official and training staff explaining how the policy is applied, who approves changes and how updates are triggered	Interviewees describe duties differently from the written policy, or cannot name the owner
Compare procedures with training records	Sample of training records, training calendar and content owners, checked against the procedures' stated cycle and audience	Procedures promise role-based training that the training records do not show for some roles
Confirm the policy covers the defined scope	Scope statement listing systems, personnel and contractors covered, plus any organization-defined parameters filled in	Organization-defined values are left blank or differ between the policy and the plan

How to write, approve and roll out the AT-1 policy in order

This sequence turns AT-1 from a control statement into a governed set of documents with named owners, defined review triggers, and a record that each responsible role received them. Each step produces an artifact an assessor can examine.

Confirm the organization-defined parameters
AT-1 leaves several values to the organization: the frequency at which the policy and procedures are reviewed and updated, and the events that trigger an earlier review. Confirm these values with the control owner and with the baseline you are implementing under SP 800-53B before drafting anything. Record each value, its rationale, and the approver in a parameter sheet. The step is complete when every parameter in AT-1 has a documented value that matches what the policy will state.
Assign the designated official
AT-1 requires a designated official to manage the policy and procedures. This person should have authority over security training across the organization and the time to maintain the documents. Record the appointment in writing, along with the official's responsibilities for drafting, updating and answering assessor questions. The output is a short owner register that names the official, the deputy, and the business owner who approves changes. The step is complete when the appointment is signed by an executive with authority to assign it.
Draft the policy with scope and roles
Write the awareness and training policy in the organization's own language. It should state its purpose, the systems and personnel it covers (including contractors and other external users where applicable), the roles that hold training responsibilities, and the commitment to management. Reference the related controls named for AT-1 in the catalog, such as PM-9, PS-8 and SI-12, so readers can see where training connects to risk management, personnel security and integrity. The output is a versioned policy document. The step is complete when each role named in the policy can be matched to a person or team in the owner register.
Draft procedures that map each step to an owner
Procedures describe how the policy is carried out. For each activity (identifying training needs, delivering literacy and role-based training, keeping records, collecting feedback), name the step, the owner, the input, the output and the system where the evidence is kept. A RACI-style table works well here. The output is a procedure set that an operator can follow without asking the policy author. The step is complete when every procedure has an owner who has agreed to it, and no training activity in the policy lacks a procedure.
Approve and version the documents
Route the policy and procedures to the approver named in the parameter sheet. Record the approval date, the version number, the change summary and the approver's name in the document itself. Store every version in a system that keeps history, so an assessor can see what changed and when. Open-source wiki and documentation platforms can provide version history and rollback, which supports this step. The output is a versioned, approved policy with a change log. The step is complete when the current version is the only one published and superseded copies are retained.
Distribute to defined roles with acknowledgment
Send the approved policy and procedures to each role defined in the policy, and collect a written or electronic acknowledgment from each recipient. Set permissions so that roles can read the documents and only the designated official can edit them. Keep the distribution list tied to the owner register so that personnel changes trigger new distribution. The output is a distribution record showing who received which version and when they acknowledged it. The step is complete when every named role has an acknowledgment on file for the current version.
Link the documents to the system security plan
Reference the approved policy and procedures in the system security plan and in any privacy plan that applies. The plan should identify AT-1 as implemented at the organization or common control level, state who owns it, and point to the current version. This lets an assessor trace the control from the plan to the governing documents. The output is a plan entry for AT-1 that matches the approved version number. The step is complete when the plan entry and the version in the document repository agree.
Schedule the first review and set triggers
Enter the review frequency and triggering events from the parameter sheet into a review calendar, with the first review date and the owner for each review. Add a trigger check to change management so that a relevant event, such as a significant change to the system or a change in the roles named in the policy, starts an out-of-cycle review. The output is a review calendar with recorded triggers. The step is complete when the first review is on the calendar and the change process can open a review when a trigger occurs.

Which evidence artifacts pass AT-1 and how to keep them current

An assessor testing AT-1 looks for a chain of documents that agree with each other: the policy, the procedures that implement it, proof that people received them, and proof that someone reviewed them when conditions changed. The six artifacts below form that chain, and each needs a routine that keeps it current between assessments.

Approved policy with version history

The awareness and training policy itself, with a named owner, an approval record and a dated version history showing what changed and why. Assessors check that the policy states its purpose, scope, roles and coordination among organizational entities, and that the version in force is the one approved. Keep the document in a version-controlled wiki or repository so each revision has an author and a timestamp. Confirm that the approved version matches the one distributed to staff.

Procedures with step owners

The procedures implement the policy: how training needs are identified, how courses are assigned, how completion is tracked and how content is updated. Each step should name the role that performs it, so an assessor can trace a policy statement to a person who carries it out. Tie procedure changes to the same change tickets used for other controlled documents. Review the step owners whenever a team reorganizes, because stale owners are a common finding.

Distribution and acknowledgment record

Evidence that the policy and procedures reached the defined roles, with each recipient's acknowledgment captured and dated. Use role-based access in the document platform so that only the intended audience receives the document, and keep the access log. When the policy changes, the distribution record should show the new version reaching the same audience. Confirm the defined recipient list matches the organization's current role catalog.

Designated official appointment

A signed or approved document naming the official who manages the awareness and training policy and procedures. Assessors check that the appointment exists, is current and matches the role described in the policy. Record the appointment in the same system as other security role assignments, so that a departure triggers a reassignment. Confirm the named official has the authority and the time to maintain the policy.

Review log for periodic and event-driven reviews

A dated log of every review of the policy and procedures, recording the reviewer, the outcome and any updates made. AT-1 requires review at a defined frequency and after defined events, so the log should show both kinds of entry. Link event-driven reviews to the triggering change tickets, personnel changes or incident reports that prompted them. Confirm the frequency and triggers against the organization's own written parameters, since those values come from the organization, not from NIST.

System security plan references

Cross-references showing where the training policy and procedures are cited in the system security plan and related documents. Assessors use these references to confirm the policy applies to the systems in scope and that the plan describes the same training program. Update the references whenever the plan changes, and check them during each review cycle. Confirm that the plan names the same policy version that is currently approved.

How XWiki and BookStack can host and version the AT-1 documents

A self-hosted wiki can keep the AT-1 awareness and training policy and its procedures in one place, with a change history that supports the version evidence assessors ask for. The point is not the software itself but the record it creates: who changed the policy, what changed, when it changed, and which version was in force on a given date. The tool holds the document, but the organization still owns the policy.

XWiki keeps every change to a page under version control, recording what changed, when and by whom. Users can compare any two versions and roll back to an earlier one, which helps when an assessor asks for the version approved before a review date. XWiki is licensed under LGPL-2.1-or-later, so the license terms should be checked with the organization's legal team before the platform is deployed or modified. Confirm the current version control features in the XWiki blog on document version control and in the XWiki documentation for the release being installed.

BookStack takes a different approach to control. User abilities come from the roles assigned to each person, and permissions can be overridden per role at the shelf, book, chapter or page level. A team could let the training function edit the AT-1 pages while everyone else gets read-only access, with approvers holding a separate role. Confirm the current permission model in the BookStack roles and permissions documentation, and confirm the MIT license terms in the project's own repository. Neither tool makes the policy compliant. The organization must still approve the policy, distribute it to the defined roles, and review it at the frequency it has set.

What meeting AT-1 costs in money and effort

This table breaks down the cost and effort of keeping an AT-1 awareness and training policy and its procedures current, separating one-time work from recurring work. Read it to see who is paid for each component and which choices raise or lower the total. NIST does not estimate compliance costs, so use the rows to structure a written scope and quote rather than a budget.

Cost component	One-time or recurring	What drives it	How to keep it down
Policy and procedure drafting time	One-time, then recurring on revision	Number of training populations, number of systems in scope, and how many AT-2 and AT-3 details the documents must carry	Reuse an existing security policy structure and keep procedures scoped to named roles
Approval and governance time	Recurring at each approval cycle	Number of approvers, whether privacy and HR must sign off, and how formally decisions are recorded	Agree a single accountable official and a defined approval path in advance
Document tooling or licenses	Recurring if commercial, often none if self-hosted	Seat counts, hosting, and the version history and access controls the team requires	Self-hosted XWiki or BookStack can remove license spend, subject to each product's license terms
Distribution and acknowledgment effort	Recurring	Number of defined roles, contractors who need the policy, and whether acknowledgments are tracked by hand	Publish to one controlled location and collect acknowledgments through existing HR or learning records
Recurring review effort	Recurring at the defined frequency and after defined events	How often the organization sets its review cycle, and how many events trigger an out-of-cycle update	Keep the review frequency realistic and tie triggers to changes that already go through change control
External review of the documents	Optional, usually one-time per cycle	Whether an outside consultant reviews drafts, and how much tailoring is needed to the organization's environment	Limit external review to gap checks against AT-1 and the baseline in use, and ask for a fixed-scope quote
Auditor sampling during assessment	Recurring at each assessment	Number of policy versions, approval records and distribution records the assessor samples, and how easily they are retrieved	Keep a dated version history and an approval record for every revision so evidence is quick to produce

Who owns AT-1 and what an implementation partner can take on

Your organization owns the AT-1 policy and the procedures that implement it. AT-1 expects a documented awareness and training policy, implementing procedures, distribution to defined roles, a designated official who manages the document and a defined review frequency with triggers for earlier review. Those decisions are management decisions, so they stay with your people even when someone else drafts the text.

Policy ownership: Name the owner in the policy itself and confirm that the owner has authority over training content, schedules and enforcement.
Designated official: Assign a named role, not a shared mailbox, and record the backup who acts when that person is absent.
Approval: Record who approves the policy and each procedure, with the date and version, before distribution.
Review calendar: Set the periodic review interval and the events that force an update, such as a significant incident, a new system class or a change in regulated scope.
Distribution: Decide which roles receive the documents and how acknowledgment is recorded.

Confirm these items against your organization's own governance structure and any frequency your system security plan or contract already defines.

Where AT-1 programs usually fall short and how to close each gap

AT-1 looks simple on paper, but assessors tend to find the same few weaknesses: nobody clearly owns the policy, its review schedule is vague, staff never receive it, procedures describe work that does not happen, and the documents drift away from the system security plan. Each card below names one gap and a closing action an owner can assign this quarter.

No named designated official

AT-1 requires the organization to name the official who manages the awareness and training policy and procedures. Many programs leave this to a team name or a shared mailbox, so when the policy goes stale nobody is accountable for it. Assign a named role, not a person's name alone, with a deputy, and record the appointment in the policy itself. Ask the assessor's likely question: who signed off the last review, and can they show the approval?

Review frequency and triggers undefined

The control expects the policy and procedures to be reviewed and updated at a defined frequency and after defined events. Programs often write 'reviewed periodically' without a number or a list of triggers, which leaves an assessor nothing to test against. Set a fixed review interval, list events that force an early review, such as a major system change, a security incident or a change in a regulation the organization follows, and keep a dated revision history.

Policy not distributed or acknowledged

A policy that sits in a folder is not distributed to the defined roles. Assessors look for evidence that the people who must follow the policy received it, usually through a named distribution list, a publication location and a record of acknowledgment. Export the distribution list from your identity provider, publish the approved version to a single location and track who has acknowledged each version. Re-issue the policy after every material revision.

Procedures no one runs

Procedures that describe a training workflow nobody follows are one of the most common findings. The steps may name a learning management system report or a quarterly sign-off that has not happened in a year. Walk each procedure with the person who performs it, record the actual steps, and remove any step that is not performed. Where a step is performed, keep the output as evidence, such as a dated training completion export.

Documents disconnected from the SSP

The awareness and training policy should match how the system security plan describes training for each system in scope. When the SSP names one training provider and the procedures name another, or the SSP lists roles that the policy never mentions, an assessor will record a gap. Compare the policy, the procedures and the system security plan line by line, and reconcile the role names and training frequencies before each assessment.

What buyers and practitioners ask about AT-1 cost, effort and outside help

How much effort does AT-1 take to implement?

AT-1 is a single policy and procedures control, so the effort sits in writing and maintaining documents rather than in technical builds. The work depends on how many documents already exist, how many roles receive training, and how far the existing policy set matches what SP 800-53A examines. An organization with a current awareness and training policy and a named owner has a short gap review ahead of it. An organization starting from nothing needs drafting, review by the people who run training, and approval by a senior official. Ask any partner to break the effort into drafting, review, approval and distribution, and to state which parts they would do and which your staff must do.

Can a small team write AT-1 without outside help?

Yes, a small team can write AT-1 alone if it has someone who understands both the training program and the assessment method. AT-1 has no control enhancements in SP 800-53 Release 5.2.0, and SP 800-53A Rev. 5 assesses it with 17 determination statements using the examine and interview methods. The hard part is not length but coverage: the policy must name a designated official, define the roles that receive training, and set review frequencies and triggering events that the organization actually follows. A small team should check its draft against the examine and interview objects in SP 800-53A before calling it complete.

What does the organization need to supply for AT-1?

The organization owns the policy, so it must supply the decisions that only it can make. These include the designated official, the defined roles that receive training, the review frequency, the events that force an update, and the link to the system security plan and privacy plan. It also needs staff who run awareness and training today, because interviews will test whether the written procedures match daily practice. Finally, it needs an approval record and a distribution method. A partner can prepare the drafts and the evidence trail, but it cannot make these organizational decisions or sign the policy on the organization's behalf.

How long does it take to put AT-1 in place?

No researched timeline exists for AT-1, so this page does not give a duration. The time depends on the current state of documentation, the number of roles to define, the approval path inside the organization, and how many systems the policy must cover. Ask any implementation partner for a timeline in a written scope that lists each deliverable, the review cycles, and the dependencies on your staff and approvers. A fixed-scope agreement sets out these items before work starts, so the timeline and its assumptions can be checked before any money is committed.

Can an implementation partner write the AT-1 policy for us?

A partner can draft the AT-1 policy and procedures, map them to the examine and interview objects in SP 800-53A, and prepare the supporting records. DeployOpen prepares systems, controls and evidence for compliance assessments, and it works within a written scope. It does not issue audit reports, attestations or certifications, and it does not own the controls. The organization must review, adopt and approve the policy, and an independent assessor decides whether the control is met. Confirm in the scope who writes, who reviews, who approves and who keeps the signed version.

Will an assessor accept AT-1 documents produced on self-hosted tools?

An assessor evaluates the content and the evidence of the policy, not the tool that stores it, so self-hosted documents can be accepted when they show the required information, approval, distribution and review history. Wiki platforms such as XWiki keep every change under version control, recording what changed, when and by whom, and allow comparison and rollback between versions. BookStack assigns user abilities through roles, and permissions can be overridden per shelf, book, chapter or page. These features support the evidence trail, but the assessor will still test whether the policy was approved, distributed to the defined roles and reviewed on schedule. Confirm the assessor's expectations before you choose the tool.

How does AT-1 relate to AT-2 and AT-3?

AT-1 is the governing layer. It requires a documented awareness and training policy and procedures, and AT-2 and AT-3 describe the training that the procedures must deliver. AT-2 covers literacy training and awareness for all system users, while AT-3 covers role-based training for personnel in defined roles. If AT-1 defines the roles, review frequency and responsibilities, the AT-2 and AT-3 content and records must follow those definitions. An assessor will usually test the three together, so a policy that does not match the actual training schedule or role list will create findings in the sibling controls as well.

What changes for AT-1 after the Release 5.2.0 update?

Release 5.2.0 of 27 August 2025 updated the related controls of every -1 policy and procedures control, and AT-1 is one of them. The release was a minor update focused on software update and patch security, and it added SA-15(13), SA-24 and SI-2(7) and revised SI-7(12). The change to AT-1 concerns its related-control references, so the policy text does not need a rewrite for the release alone. Organizations should still check the CPRT or OSCAL content for AT-01, compare it with their current policy, and record the review date and outcome as evidence. Confirm with your assessor how they want that review documented.

How DeployOpen works on this

DeployOpen helps organizations prepare the awareness and training policy, procedures and supporting evidence that AT-1 asks for, using self-hosted open-source platforms inside the client's own infrastructure. The organization keeps ownership of the policy and its approval, while DeployOpen prepares the systems and documentation an independent assessor would examine.

How we scope

Agree in writing which systems, business units and training owners fall within the AT-1 policy and procedures scope.
Confirm the baseline the organization is targeting, since AT-1 applies across the low, moderate, high and privacy baselines.
Identify the named official, distribution roles and review triggers the organization must define before work starts.

How we build

Set up a self-hosted documentation platform in the client's environment to hold the policy and procedures.
Configure role-based permissions so policy owners can edit while staff and assessors have read access.
Enable version history so every change to the policy and procedures records what changed, when and by whom.

How we hand over

Deliver the policy and procedures set, mapped to the AT-1 assessment objectives in SP 800-53A for the assessor to examine.
Provide a record of distribution, review dates and approval history that shows the policy was communicated to defined roles.
Document administration steps so the client's own staff can maintain the platform and the policy after handover.

How we support

Offer ongoing support and periodic policy review as a retainer, if the organization wants continued help after handover.
Support updates to the policy when SP 800-53 releases change the related controls, such as the -1 controls revised in Release 5.2.0.
Confirm with the organization's independent assessor which evidence formats and locations they expect before finalizing deliverables.