What AT-2 literacy training and awareness requires
If an auditor, a customer contract or a federal sponsor asks for training evidence, AT-2 is the control they usually mean. AT-2 requires security and privacy literacy training and awareness for all system users, including managers, senior executives and contractors, delivered when people join, at a defined frequency, and again after system changes or defined events. The control also expects awareness techniques, periodic content updates and lessons learned from incidents and breaches to feed back into the material. The organization owns the program and defines the frequency and events in its own policy, so the first task is to write those definitions down before anyone is tested against them.
Who must be trained is broader than most training catalogs assume. Contractors and third-party staff with system access count as users, and executives and managers are named explicitly, so a program aimed only at employees with laptops leaves gaps an assessor will find. Baseline selection matters here too. SP 800-53B selects AT-2 for the low, moderate and high baselines and for the privacy baseline, and it selects the insider threat enhancement at low and above, and the social engineering and mining enhancement at moderate and high. Confirm the enhancements against the baseline your system actually carries before designing the program.
AT-2 is hard to evidence because the proof is scattered. Course completions sit in the learning management system, joiner dates in HR, contractor access in a ticketing or identity system, and lessons learned in incident records. Assessors will ask you to connect them: who was in scope on a given date, what they completed, and whether the content changed after an incident. Agree on the trigger events and the system of record for each evidence type early, and decide who reconciles them. Ask any implementation partner to show how that reconciliation will be produced from your existing systems rather than assembled by hand before an assessment.
Which users, teams and contractors AT-2 covers
AT-2 applies to all system users, but who counts as a user, how contractors are brought in, and which systems the training describes are decisions the organization makes and documents. Each card below is a scoping choice that changes the training population, the content and the evidence an assessor will ask for.
Defining system users
AT-2 reaches all system users, so the first decision is the population list. Start from account records in identity and access systems, then add people who use the system without a standard account, such as shared-mailbox operators and help desk staff who work through admin consoles. Record the source of truth for the list and how often it is reconciled. An assessor testing AT-2 will compare the training roster against that list, so gaps between the two are the first finding to avoid.
Contractors and third-party staff
Contractors with system access are users for AT-2, whether or not they sit on the organization's payroll. Decide whether they complete the organization's own training, a supplier's equivalent, or both, and write that choice into the contract or access agreement. Ask each supplier to provide completion records in a form you can retain. Where a supplier's training does not cover your systems or data, the gap remains yours to close.
Managers and senior executives
AT-2 names managers and senior executives explicitly, and their training usually differs from the frontline curriculum. Plan content on decisions they make, such as approving access exceptions, accepting risk and responding to a suspected breach. Treat executive completion as a tracked item with the same records as other users, because an assessor will test that leadership is included rather than assume it.
Systems and data the training reflects
Training content should describe the systems people actually use, the data they handle and the rules for that data. Map each in-scope system and data category to the lessons it needs, such as handling of regulated records or use of administrative tools. When a system changes, the content change is part of the same review. Confirm with the control owner which systems are inside the authorization boundary before drafting the curriculum.
Baselines that select AT-2
SP 800-53B Release 5.2.0 selects AT-2 for the low, moderate and high baselines and for the privacy baseline, so it applies to nearly every system in a federal-style program. The enhancements differ by baseline: AT-2(2), covering insider threat, is selected in the low, moderate and high baselines, and AT-2(3), covering social engineering and mining, is selected in the moderate and high baselines. Confirm the selected baseline for each system before scoping enhancements.
Privacy baseline and PII handling
The privacy baseline also selects AT-2, which matters for systems that process personally identifiable information regardless of impact level. Include staff who handle PII in the population, and make sure the content covers privacy duties, not only security. Where the organization has a privacy office, agree with it who owns the privacy content and how completion is recorded. Confirm this scope with the privacy lead before finalizing the roster.
How to implement AT-2 in sequence
This sequence turns AT-2 from a policy statement into a running training program: a defined audience, set frequencies, curriculum that covers the enhancements that apply, tracked completion, awareness activity, and content that improves after incidents. Each step produces an artifact an assessor can examine.
Define the audience and training triggers
Start by listing every group that must receive literacy training: general system users, managers, senior executives and contractors. For each group, record the events that require training, such as onboarding, a system change or a defined security event. The output is a written audience register with its triggers, owned by the security or compliance lead and approved by the people who own the system. Done means every user population in the system boundary appears in the register, and no contractor group is missing.
Set organization-defined frequencies
AT-2 leaves several parameters to the organization, including how often recurring training occurs and which events trigger extra training. Decide these values, record them in the system security and privacy plan or the training standard, and justify them against the system's risk. The output is a parameter table that names each frequency and trigger. Ask the independent assessor to confirm the values are specific enough to test, since vague wording such as 'periodically' is hard to verify.
Build or source the literacy curriculum
Create a curriculum that covers security and privacy literacy for the whole audience: handling of sensitive data, authentication habits, reporting paths, acceptable use and privacy responsibilities. Confirm the content against the organization's applicable regulations and policies. The output is a versioned curriculum with learning objectives and a content owner. Where an LMS such as Moodle is self-hosted, the same course can be published in the platform the organization runs.
Add insider threat and social engineering content
Check whether the organization's baseline selects AT-2(2) for insider threat and AT-2(3) for social engineering and mining. Per SP 800-53B Release 5.2.0, AT-2(2) applies to the low, moderate and high baselines, and AT-2(3) applies to the moderate and high baselines. Where they apply, add modules that describe recognizing insider threat indicators, reporting them, and spotting phishing, pretexting and similar manipulation. The output is these modules in the curriculum, mapped to the enhancement they satisfy.
Deliver training and track completion
Assign the curriculum to every person in the audience register and record the date each person completes it. Use the LMS completion record where the platform supports it, and confirm that the platform's completion rule matches the policy, since some activities are marked complete on viewing and others only on a grade or manual tick. The output is a completion log per person, with overdue users flagged to their managers. This log is the main evidence an assessor will examine.
Run awareness campaigns between formal training
AT-2 expects awareness techniques beyond the course itself. Plan short, recurring activities such as posters, newsletters, simulated phishing exercises and briefings tied to current threats. Record what was delivered, to whom and when. The output is an awareness calendar and a dated record of each activity. Confirm with the assessor which activities count as evidence of awareness for the system, since expectations differ between organizations.
Feed incidents and lessons learned into content
After each security incident, breach or near miss, review whether the curriculum or awareness material would have changed the outcome. Update the content, record the change with its reason and version, and schedule retraining for affected groups where the parameters require it. The output is a change log linking each incident lesson to a revised module. This loop shows the assessor that training responds to real events, which the AT-2 requirement for lessons learned explicitly asks for.
How an assessor tests AT-2 with examine, interview and test methods
The examine method works from documents and records. For AT-2, SP 800-53A lists examine objects that include the codes of federal regulations that apply to the system, the security and privacy literacy training curriculum, the training materials and the training records. The assessor reads these artifacts to judge whether the training was designed to cover the right people and topics and whether it was delivered.
- Applicable regulations: the assessor checks that the curriculum reflects the laws, regulations and contractual obligations that apply to the system, and that the organization can name them.
- Curriculum: a written outline of topics, audiences and frequencies, showing coverage for managers, senior executives and contractors as well as staff.
- Training materials: the modules, slides, awareness content and exercises actually delivered, with version dates that show when content changed.
- Training records: completion data for each person, with dates that line up with the onboarding and recurring schedule.
Before the assessment, confirm that the curriculum version, the materials and the records all cover the same period and the same content, because mismatches between them are the first thing an examiner notices.
The interview method tests whether the people responsible for literacy training and awareness understand their duties and can explain how the program runs in practice. SP 800-53A lists organizational personnel with responsibilities for literacy training and awareness as interview objects. The assessor compares what interviewees say with the artifacts gathered during the examine step, so answers need to match the documents.
- Ownership: who approves content, who schedules sessions, who tracks completion and who answers for gaps.
- Audience coverage: whether the interviewee can explain how contractors, executives and managers receive training and how that is verified.
- Triggers: how training responds to system changes, incidents and breaches, and how lessons learned from those events reach the next cycle of content.
- Awareness activities: how the organization runs awareness beyond formal courses, such as reminders, campaigns and simulated social engineering exercises.
- Consistency: whether answers match the curriculum and records. Divergence between interview answers and documents is a finding in its own right.
Prepare named owners and a short walkthrough of one recent content update so the interviewees can explain a real example with confidence.
The test method examines the mechanisms that manage literacy training. For AT-2, SP 800-53A names test objects such as the mechanisms managing literacy training, which in practice are often a learning management system, assignment rules, reminder workflows and reporting. The assessor runs or observes these mechanisms to see whether they behave the way the policy and curriculum describe.
- Assignment rules: the assessor checks that new users are enrolled at onboarding and that recurring training is assigned on schedule, often by creating a test account.
- Completion logic: the platform must decide completion the way the policy describes. For example, Moodle's activity completion can mark an activity complete when a learner views it, when they receive a grade, or when they tick it manually, depending on the conditions set for that activity (illustrative).
- Reminders and escalation: overdue notices and what happens when someone does not finish, including who is alerted.
- Reporting: exports showing completion by role and date, which should reconcile with the training records.
- Change control: logs or review records showing that changes to training settings are approved.
Ask the platform owner to demonstrate each rule live and to show the configuration history, since a setting that was changed recently may not match the evidence from earlier periods.
SP 800-53A assesses AT-2 with 10 determination statements. Each statement is a pass or fail test of one part of the requirement, and the assessor combines examine, interview and test evidence to decide whether it is met. The statements cluster around a few themes: who receives training, when it happens, what it covers and how it changes, and the enhancements that the baselines select.
- Coverage: whether every category of user, including managers, executives and contractors, is within the training population.
- Timing: whether initial, recurring and event-driven training is defined at a set frequency and carried out.
- Content: whether the curriculum addresses the topics the organization defined and is updated periodically.
- Lessons learned: whether incidents and breaches feed back into training content.
- Enhancements: whether insider threat and social engineering content exists where the selected baseline calls for it.
Before the assessment begins, map each determination statement to at least one artifact and one interviewee, so gaps surface while there is still time to close them.
What assessors request and where AT-2 findings usually come from
This table maps the assessment methods SP 800-53A uses for AT-2 to the evidence an assessor typically asks for and the gaps that tend to appear. Read each row as a question the assessor will ask, then check whether your records can answer it for every user group, not only for the general workforce.
| Assessment focus | Evidence requested | Where findings usually appear |
|---|---|---|
| Curriculum currency | Current literacy training curriculum and materials, with version history and the dates of content updates tied to system or threat changes | Training content that still describes retired tools, old system versions or superseded policies |
| Completion for contractors | Completion records for contractors and third-party staff with system access, matched to their access grants | Contractors with active accounts who have no training record, or whose training lapsed after onboarding |
| Completion for executives and managers | Completion or tailored awareness records for managers and senior executives, separate from the general workforce report | Leadership excluded from campaigns because they were treated as a separate audience with no documented tracking |
| Recurring training frequency | The defined training frequency, the schedule and the completion history per user across the assessment period | Users overdue for recurring training, or no evidence that the defined frequency was applied to all user groups |
| Lessons learned from incidents | Records showing that incidents, breaches and near misses were reviewed and fed into training content, with dates | Incident reports with no linked training update, or lessons learned that were never added to the curriculum |
| Training tied to content version | Records that identify which curriculum version each user completed, with the content version history | Completion logs that show course titles but not the version, so an assessor cannot confirm the user saw current content |
| Interview of training owners | Explanation from personnel responsible for literacy training and awareness of how content is reviewed and who approves changes | Owners who cannot describe the update trigger, or who say the process is informal and undocumented |
| Test of training mechanisms | Configuration and output of the learning platform or tracking tool, including completion rules and reporting | Completion rules that mark a course complete on a single click or on a view, without evidence the content was understood |
Evidence that passes an AT-2 review
An assessor testing AT-2 looks for a traceable chain: the curriculum defines what is taught, the records prove who completed it and when, and the audience lists prove that the right people were in scope. Each artifact below feeds that chain, and each goes stale unless someone owns its refresh schedule between assessments.
Curriculum and version history
The security and privacy literacy curriculum is the document an assessor compares against the organization's stated topics and the defined training frequency. Keep it under version control with dated revisions, a named owner and an approval record for each change. Check that every revision traces to a reason, such as a system change, a policy update or a lesson learned, and that the current version matches what learners actually saw. Undated or unowned slides are a common finding.
Training materials and awareness content
Keep the modules, quizzes, posters, phishing simulation scripts and awareness messages in a retrievable archive, labeled with the date each was in use. AT-2 expects content that reflects current threats, so the archive should show periodic content updates rather than one set of slides reused for years. Confirm with the assessor which materials count as formal training and which as awareness, and keep both.
Completion records with dates
Completion records prove that each person finished training at onboarding and at the defined recurring interval. Export them from the learning platform with user identifier, course version, completion timestamp and the completion rule used. In Moodle, activity completion can be triggered by viewing an activity, receiving a grade or a manual tick, so confirm the condition configured for each course and document it. A tick-box record alone is weak evidence for a knowledge-based course.
Audience lists tied to rosters
The audience list shows who must be trained, including managers, senior executives and contractors. Generate it from the HR system for employees and from the contract or access management record for contractors, then reconcile it against the training system each cycle. Assessors look for gaps, such as an active account with no training record or a contractor who received system access before completing onboarding training. Record the reconciliation date and the person who signed off.
Awareness campaign records
Awareness activities such as phishing exercises, briefings and campaign posts need their own log. For each campaign, record the topic, the audience, the start and end dates, the delivery channel and the results, including who failed or reported. These records show the awareness techniques AT-2 calls for beyond formal courses. Keep the results with the follow-up training assigned to people who needed it, since that link is what assessors test.
Lessons-learned updates
AT-2 expects training content to change after incidents, breaches and near misses. Keep a register that links each lesson to the incident record, the curriculum change it produced and the date that change reached learners. Review the register before each assessment to confirm that recent incidents have either produced a content update or a documented decision that none was needed. An empty register across a year with incidents will draw questions.
How learning platform completion records support AT-2 evidence
A learning platform can prove that AT-2 training happened only if the organization decides, in advance, which recorded event counts as literacy training completion. Moodle's activity completion feature can mark an activity complete when a learner views it, when they receive a grade from it, or when they tick it manually, depending on the conditions configured for that activity. Those three triggers mean very different things to an assessor. A view shows the page was opened, a grade shows the learner was tested on the material, and a manual tick shows only that someone claimed to have done it. For AT-2, which expects security and privacy literacy training for all system users, the organization should set the completion condition to a graded assessment or an equivalent knowledge check, and document that choice in its training procedures so the rule is consistent across courses.
Completion data alone does not show that the content is current. AT-2 also expects periodic updates to training content and lessons learned from incidents and breaches, so a record that a learner completed a course in a given year says nothing about whether that course reflected the controls in force at the time. Pair each completion record with the version of the training material it was delivered from, the date of the last content review, and the change that triggered any update. In practice this means keeping course materials under version control and recording the version number or revision date within the course or in an exported report. Confirm with your platform administrator how long previous course versions and their activity logs are retained, because an assessor may ask which version a learner saw months earlier.
Before relying on platform reports in an assessment, ask the people who will be examined to show you the completion settings for each mandatory security course, a sample of learner records traced back to the version delivered, and the export process used to produce evidence. Confirm which settings your Moodle release and plugins support, since reporting features vary by version and by add-on. Treat the platform as the system of record for completion, not as proof of program quality, and keep the policy, curriculum and lessons-learned reviews alongside it so the evidence tells one consistent story.
What meeting AT-2 costs in money and effort
This table lists the cost components behind an AT-2 literacy program, who is paid for each, whether it is one-time or recurring, and what drives it up. Use it to build a quote request, since NIST does not publish AT-2 costs and no figures are supplied here.
| Cost component | Who is paid or who bears it | One-time or recurring | What drives the cost |
|---|---|---|---|
| Curriculum development or licensing | Internal training staff, a content developer, or a commercial course vendor | Mostly one-time, then recurring for licence renewals | Number of audiences (users, managers, executives, contractors), languages, and whether content is built in-house |
| Learning platform | Software vendor or hosting provider; internal team if self-hosted | Recurring (subscription or hosting), plus one-time setup | Number of learners, reporting needs, and whether the platform is hosted in your own infrastructure |
| Engineering to integrate HR and training records | Implementation partner or internal platform engineers | One-time integration, then recurring maintenance | Number of HR sources, joiner, mover and leaver triggers, and how completions are written to records |
| Recurring content updates | Content owners, security staff and subject matter experts | Recurring | Frequency of policy change, new threats, lessons learned from incidents, and system changes that trigger retraining |
| Campaign and awareness effort | Security awareness team, communications staff, and managers who release staff time | Recurring | Number of campaigns, simulated social engineering exercises, and time staff spend away from their duties |
| Evidence preparation and assessor sampling | Compliance lead, system owners, and the independent assessor | Recurring at each assessment cycle | Number of personnel sampled, quality of completion records, and how quickly records can be retrieved |
| Open-source platform and tooling | Internal staff or an implementation partner for installation, hardening and upgrades | One-time setup, recurring operations and upgrades | Hosting choice, support model, and whether learning content is authored in-house; open-source licences can remove licence spend but not operations effort |
Who owns AT-2 and what can be outsourced
Your organization owns AT-2 in full. The control asks for security and privacy literacy training for all system users, including managers, senior executives and contractors, so someone inside the organization must decide who is in the audience, approve what the training says, decide how often it runs, and act on what incidents and breaches teach. An outside partner can draft material and configure a learning platform, but it cannot accept the risk of an untrained user or sign off on the content that represents your policies. Assessors will ask internal staff to explain the program, so those people need to know it.
- Audience definition: Maintain the list of system users, including managers, senior executives and contractors, and update it when access changes.
- Content approval: Name an accountable role that reviews and approves curriculum, awareness techniques and periodic updates before release.
- Frequency and triggers: Set the recurring interval and the events that require retraining, such as system changes, then document the reasoning.
- Lessons learned: Feed incident and breach findings into content updates and record what changed and why.
- Records ownership: Keep completion evidence under your own governance, consistent with the retention rules in AT-4.
Before engaging anyone, confirm that a named internal owner can answer an assessor's questions about every point above without referring to the vendor.
An implementation partner such as DeployOpen can plan, install and configure self-hosted open-source learning platforms inside your own infrastructure, then structure curriculum and evidence so that your team and an assessor can use them. The partner prepares systems and evidence. It does not decide the audience, approve content as the organization's own statement, or issue any report or certificate. Scope and deliverables are typically agreed in writing before work starts, which makes the boundary explicit.
- Platform preparation: Install, harden, back up and upgrade a learning platform such as Moodle within your cloud accounts, data centers or air-gapped network.
- Curriculum structure: Organize courses, modules and assessments so that each training activity maps to a documented audience and frequency.
- Completion tracking: Configure activity completion so that completion reflects the criteria your organization defined, and test that the records export correctly.
- Evidence packaging: Prepare curriculum files, training records and configuration exports in a form your assessor can examine.
- Documentation and handover: Deliver runbooks and procedures so that your staff can operate the platform after the engagement ends.
Ask the partner to state in writing which deliverables it produces and which decisions remain with your organization.
An independent assessor tests AT-2 against the assessment procedure in SP 800-53A, which uses examine, interview and test methods with determination statements. The assessor must be independent of the people who built the program, because its conclusions carry weight only when they are not shaped by the party being tested. Depending on your framework and contract, the assessor may be an internal audit function, a third-party assessor or a certification body. Only that independent party issues findings or reports.
- Examine: Review the curriculum, training materials and training records, comparing them with your stated audience and frequency.
- Interview: Speak with the personnel responsible for literacy training and awareness to confirm their understanding of the program.
- Test: Check that the mechanisms managing training, such as the learning platform and its completion logic, behave as documented.
- Independence line: An implementation partner that configured the evidence can be interviewed as a source of information, but it should not perform the assessment of its own work.
- Report ownership: Only the assessor or authorizing body issues conclusions. DeployOpen prepares systems and evidence but does not issue audit reports, attestations or certifications.
Before the engagement, confirm with your assessor which evidence it will accept and whether it has a preferred format.
Where AT-2 programs usually fall short
AT-2 is easy to describe and hard to run well. The gaps below recur across programs, and each one shows up when an assessor walks from the policy to the training records. Each card pairs a gap with the check or fix that closes it.
Contractors left out of scope
AT-2 applies to all system users, and the control names contractors explicitly. Many programs train employees through the learning platform but give contractors access to systems with no training record at all. Check the access list against the training roster each quarter. Contractors with system accounts should either complete the same literacy course or show equivalent training from their employer, with the agreement stating which applies. Keep both in the same training records.
Frequency that is never defined
AT-2 requires training at a defined frequency, but many organizations write only that training happens "annually" in a policy and never set the trigger for off-cycle training. The organization must set the frequency itself. Define the recurring interval, the onboarding deadline and the events that force retraining, such as a major system change or a confirmed phishing incident. An assessor will compare what the policy says with what the records show, so the stated interval must match actual completion dates.
Incidents not feeding content
The control expects lessons learned from incidents and breaches to shape later training. In practice, incident reports close in the ticketing system and the training calendar never changes. Create a standing step in the incident closure process that asks whether the root cause suggests a training change. Record the decision even when the answer is no. This linkage is also where the insider threat and social engineering enhancements become concrete, because real cases give the content its examples.
Generic content for every role
A single course for all staff can satisfy the literal wording of AT-2, but it often misses the people who handle the most sensitive operations. Managers, senior executives and staff who approve access or change data need content on their own decisions, such as approving unusual payment requests or reviewing access grants. Map the audiences to their duties, then show which module each group completed. Role-specific depth belongs to AT-3, so keep the two controls distinct in your documentation.
Completion that proves nothing
A learning platform can record that a course was opened, which is weaker evidence than a learner completing the assessed material. Confirm how your platform defines completion before relying on its reports. In Moodle, for example, the activity completion settings decide whether a learner is marked complete by viewing an activity, by receiving a grade or by a manual tick. Choose the condition that matches the evidence you need, and document it. A manual tick with no assessment is hard to defend in an audit.
Awareness with no measurable reach
AT-2 includes awareness techniques beyond formal courses, such as posters, phishing simulations, newsletters and security briefings. Programs often run these informally and cannot show who received them. Log each awareness activity with its date, audience and content version, then tie it to the same training records used for courses. Ask the owner of the training program to confirm which activities count toward the control and which are supporting material, so the assessor does not have to guess.
How much effort does AT-2 take, and can we do it in-house?
Can we meet AT-2 in-house without an outside partner?
Yes, in principle. AT-2 is a control your organization owns, so nothing in SP 800-53 requires an outside firm to deliver literacy training. The work is mostly internal: deciding who must be trained, writing or selecting curriculum, running sessions, recording completions and reviewing content after incidents. Whether that is realistic depends on whether you have staff who can write security content, a learning platform that records completions, and someone who owns the evidence trail. Teams that lack one of these usually bring in help for that specific gap, such as building content or configuring a self-hosted learning system, while keeping ownership of the program.
What drives the cost and effort of AT-2 training?
The main drivers are the size and spread of your user population, how many roles need different content, how often training recurs, and how much curriculum you build yourself versus adapt. Enhancements matter too: AT-2(2) on insider threat and AT-2(3) on social engineering and mining are selected in the moderate and high baselines in SP 800-53B, so those topics add content and exercises. Costs fall into one-time work (needs analysis, content build, platform setup) and recurring work (delivery, tracking, content refresh, lessons learned). The recurring share is often larger over the life of the control than the initial build.
What does the organization have to provide for AT-2 to work?
The organization must supply the inputs that only it can: a list of system users including managers, senior executives and contractors, the events that trigger retraining after system changes, and access to incident and breach lessons that feed content updates. It also needs a named owner for the training program, time from managers to release staff for sessions, and a way to record who completed what. Assessors look for the curriculum, training materials and training records that SP 800-53A lists as examine objects, plus interviews with the people responsible for literacy training. Confirm these owners and inputs before any outside work begins.
How long does it take to meet AT-2?
No researched duration is available for AT-2, so do not plan against a fixed number of weeks from this page. Timing depends on your current training maturity, how many user groups and contractor populations you have, whether a learning platform already exists, and how quickly content can be approved. The practical step is to ask for a written schedule as part of a fixed-scope proposal, with milestones for content, pilot delivery, first full cohort completion and the first evidence package. Confirm the expected timeline with your assessor as well, since they will test whether the program runs as described.
What should we ask a partner for in a fixed-scope quote?
Ask for a written scope that names the systems, user populations and roles covered, and states which AT-2 determination statements the work is meant to support. The quote should list deliverables in concrete terms: curriculum and materials, the platform configuration, completion tracking and reporting, the content update process, and an evidence pack for assessors. Ask who does each task, which items are one-time and which are recurring support, what is excluded, and what you must provide. DeployOpen plans and delivers under agreed written scope, and any price follows from that scope, so ask for the scope first. Note that a partner prepares evidence but cannot issue an assessment report or attestation; an independent assessor does that.
How do AT-2, AT-3 and AT-4 divide the work?
AT-2 covers literacy training for all system users, including managers, senior executives and contractors. AT-3 adds role-based training for people in defined roles, delivered before they receive access or perform duties and then periodically. AT-4 covers the records that prove training happened, which are the evidence trail behind both AT-2 and AT-3. In practice, the same learning platform and completion data often serve all three, but the content, audience and retention rules differ. Plan the three together so that one completion record can show whether a user met a literacy requirement, a role-based requirement and the retention period you have defined.
What recurring work should we budget for after AT-2 is in place?
The recurring work is what keeps AT-2 current. It includes delivering training at the frequency you define, onboarding new users, retraining after system changes or defined events, reviewing and updating content, and folding lessons learned from incidents and breaches into materials. Each cycle also produces records that must be kept for assessors. Ask whether support for these tasks is included in the fixed-scope engagement or offered as a retainer, and what happens when your curriculum or platform changes. Recurring effort is usually driven by staff turnover, contractor churn and the rate at which your threat picture changes.
How DeployOpen prepares AT-2 evidence
DeployOpen plans, implements and documents the self-hosted training platform that delivers AT-2 literacy training inside your own cloud accounts, data centers or air-gapped network. In practice that means configuring the learning platform, setting up user provisioning from your directory, building the course structure for the security and privacy literacy curriculum, and producing the records that show who completed what and when. The work is fixed in scope, with deliverables and timelines agreed in writing before any work starts, so you can see exactly which systems, content and evidence are included and which are left to your team.
Responsibility for the control stays with your organization. Your leadership decides the training frequency, the defined events that trigger additional training, the audience for each course, and the content owner who reviews material after incidents and policy changes. DeployOpen can prepare the curriculum structure and the evidence trail, but it does not write your organization's assessment conclusions, and it does not issue audit reports or certifications. An independent assessor or certification body does that work. Ask any partner, DeployOpen included, to show in the written scope which AT-2 items they build and which ones your staff must maintain.
Ongoing support is available as a retainer for platform upgrades, content revisions after lessons learned, and periodic checks that completion records still reconcile with your identity source. Before you request a quote, confirm three things: which of your systems will host the training, who will own the content and its review cycle, and where the training records must be retained. Those answers determine the scope, and a written scope is what allows an assessor to trace each AT-2 requirement to a working system and a named owner.
