AT-3 Role-based training: requirements and evidence

What AT-3 role-based training requires before a role gets access

AT-3 asks an organization to give security and privacy training to personnel who hold defined roles, and to do it before those people are authorized to access the system or perform their assigned duties. General awareness training does not satisfy it on its own. An assessor or contract clause will look for training tied to specific roles, such as system administrators, developers, incident responders or staff handling PII, with content that reflects what those people actually do. The control has three triggers: before access or duties begin, at a frequency the organization defines, and whenever system changes require it. Content must also be updated over time, and lessons learned from incidents and breaches should feed into it. SP 800-53B selects AT-3 for the low, moderate and high baselines and for the privacy baseline, so it applies to almost every system that falls under SP 800-53. The enhancements are where the baselines diverge. None of the security baselines selects an AT-3 enhancement, but the privacy baseline includes AT-3(5), which concerns training for personnel who process personally identifiable information. If your organization handles PII, confirm with your privacy office which roles touch PII and whether their training covers the processing duties that AT-3(5) describes, not just general privacy awareness. The hard part is usually not writing the course. It is that most organizations have never defined their security roles in a way that can be tested. Before building content, list the roles in your system security and privacy plan, map each one to the duties it performs, and record who holds it today. Assessors will ask for that mapping first. An implementation partner can help build the role inventory and training matrix, but the organization must approve the roles, set the frequency and own the content decisions.

Which roles, systems and third parties AT-3 reaches

AT-3 applies only to the people and systems the organization chooses to bring into scope, so the first decisions are which roles count as security-sensitive, which baseline the system carries and whether outside personnel are included. Each decision changes who must be trained, how often, and what evidence an assessor will ask for.

Privileged administrators and developers

System administrators, database administrators and developers with access to production or code repositories are the roles most often named in AT-3. The organization defines the role list itself, so it should be built from the access matrix rather than job titles alone. Check that every account with elevated rights maps to a defined role, and that training is completed before the account is activated, not after the first change window.

Incident responders and security operations staff

Personnel who triage alerts, contain incidents or run forensics need training tied to the incident response plan and to lessons learned from past events. AT-3 expects content to be updated from incidents and breaches, so this group usually needs a faster refresh cycle than general staff. Confirm that responders are listed in the incident response roster and that their training records link back to that roster.

Privacy staff and personnel handling PII

Where the system processes personally identifiable information, the privacy baseline brings in AT-3(5), which adds training for personnel who handle PII. Privacy officers, customer support staff, analysts and anyone with bulk data exports are the usual population. Decide which job functions touch PII before selecting the baseline, because that decision determines whether the privacy enhancement applies to them.

Low, moderate and high baselines

SP 800-53B selects AT-3 for the low, moderate and high security baselines, and it selects no AT-3 enhancements for those three. The baseline therefore sets whether AT-3 applies at all, not how deep it goes. Record the impact level of each system in the security categorization so that the training scope traces to a documented baseline, and confirm any tailoring decisions in the system security and privacy plan.

Privacy baseline scope

The privacy baseline applies regardless of security impact level, so a low-impact system that processes PII still carries AT-3(5). Teams often assume privacy training follows only from high-impact systems. Check the data inventory for PII flows on every system, including test and analytics copies, and scope training to those flows rather than to the security category alone.

Contractors and third-party operators

AT-3 covers personnel in defined roles, and contractors and third-party operators who hold those roles are commonly included through contract terms or access agreements. Decide whether the organization will require the provider to deliver its own training, accept the organization's training, or verify completion through records. The contract, the access agreement and the training records should all state which option applies, so an assessor can trace each external user to a training record.

How an assessor tests AT-3 against SP 800-53A

An assessor tests AT-3 by working through the nine determination statements in SP 800-53A Rev. 5 and gathering evidence for each one through three methods: examine, interview and test. The determination statements ask whether the organization has defined the roles that need role-based training, the content and frequency of that training, and whether the training is delivered before access is granted or duties are performed, afterward at the defined frequency, and when system changes require it. Each statement is answered on its own, so a gap in one area, such as refresher frequency, does not get hidden by strong evidence in another. Before fieldwork, confirm with your assessor which of the nine statements will be tested against your organization-defined parameters, since those parameters (the roles, the frequency and the trigger events) are what the evidence must match.

For the examine method, the assessor reviews the artifacts named in the procedure: the security and privacy training curriculum, the training materials, the individual training records, and the regulations or codes the organization cites as the basis for its training requirements. The assessor is checking whether the curriculum maps to the defined roles, whether materials reflect current content and lessons learned from incidents, and whether records show that each person in a role completed the right course before access or duties began. A useful internal check is to pick a sample of recent hires and role changes and confirm that the training record predates their access grant, since that sequence is where assessors most often find gaps.

The interview method goes to the personnel responsible for role-based security and privacy training, usually the training owner, the security or privacy lead and the managers who approve access. Expect questions about how roles were defined, who decides when a role needs training, and how content is updated after an incident. The test method examines the mechanisms that manage role-based training, which for many organizations is a learning management system or a set of scheduled assignments and completion reports. Confirm that these tools can enforce the access-before-training sequence, report completion by role and produce dated records. The open-source Moodle platform, for example, marks activities complete based on view, grade or manual tick, depending on how each activity is configured, so the configured completion condition must match the training requirement the organization claims to enforce. Ask the vendor or your own administrators to demonstrate that condition in your instance.

What assessors request for AT-3 and where findings usually land

This table compares, for each part of AT-3, what an assessor examines, interviews or tests, the evidence they ask to see, and the findings that most often appear. Read each row as a checklist to prepare evidence before an assessment, and note that the most common gaps are sequencing failures, where training dates fall after access was granted.

Assessment area	Test approach and evidence requested	Where findings usually land
Role definitions	Examine the organization-defined roles that require role-based training and the mapping of each role to its training content. Request the role register and the access list for each role.	Roles are named in policy but not in a maintained register, so assessors cannot tell which staff fall under AT-3.
Before-access sequencing	Compare the training completion date for a sample of personnel with the date their system access or duties began. Request access grant logs and training records side by side.	Training completed after access was granted, or training recorded only after a privileged account was already active.
Periodic and change-driven refresh	Examine the defined training frequency and any triggers for system changes. Test whether refresher records exist for each cycle and for a sample of significant changes.	Frequency is defined but records show gaps, or no training is triggered when a system change alters a role's duties.
Content updates and lessons learned	Examine the training curriculum and its revision history. Interview the owners about how incidents and breaches feed back into content.	Curriculum has no version history, or incident lessons are not reflected in later training material.
Privacy enhancement AT-3(5) on PII	For privacy baseline systems, examine role-based training covering PII processing. Request curriculum sections on PII handling and records for personnel who process PII.	PII processing roles exist, but the training does not cover PII handling or no records show those staff completed it.
Training mechanisms and tools	Test the learning platform or mechanism that issues and records role-based training. Confirm that completion records can be exported and are protected from alteration.	Completion depends on manual spreadsheets, and records cannot be reconciled with the access list.

How to implement role-based training in six steps

This sequence turns AT-3 from a policy statement into a working gate: every person in a defined role finishes the right training before access, refreshes it on schedule and after relevant changes, and leaves a record an assessor can test.

Define the roles in writing
Start by listing every role that needs security and privacy training because of what it does on the system, such as administrators, developers, help desk staff, data handlers and managers who approve access. AT-3 leaves the role definitions to the organization, so the output is a written role catalog approved by the system owner and security lead, with each role tied to the systems, data and duties it covers. Confirm the list against your system inventory and access request records. The step is done when every account type in your identity directory maps to at least one defined role, and unmapped accounts are either assigned a role or flagged for review.
Map each role to required training content
For each role in the catalog, document the training topics it needs, such as secure administration for privileged roles, secure coding for developers, handling of sensitive records for data processors and incident escalation for staff who first see alerts. Link each topic to the system duties it addresses so an assessor can trace a role to its curriculum. The output is a role-to-curriculum matrix plus the training materials for each module. Where a role also touches personally identifiable information, record that in the matrix so Step 6 can be applied. Review the matrix with the people who perform those duties, since they can confirm whether the training matches the work.
Set the before-access gate in provisioning
Connect the role catalog to the access request and provisioning workflow so that an account for a defined role is not activated until the required training is recorded as complete. In many environments this means a check in the identity or ticketing system that reads the training record before granting group membership or privileged access. The output is a documented gate, with its configuration screenshots or workflow definitions retained as evidence. Test the gate with a sample new account for each role and keep the results. Confirm with your identity platform team whether your tooling can enforce this check or whether it must be a documented manual approval step.
Configure the periodic and change-triggered refresh
AT-3 requires training at a defined frequency after the initial completion and when system changes call for it. Set the refresh frequency for each role in the catalog, and define the change triggers, such as a new system release, a new data type, a changed privileged access model or a new threat that alters role duties. Configure your learning platform or ticketing workflow to issue reminders and to flag overdue completions. The output is a refresh schedule with named triggers and a report of current completion status by role. Your organization sets the frequency, so confirm the values with your security governance owner rather than adopting a default.
Run the content review cycle with lessons learned
Set a recurring review of training content owned by a named person, with inputs from incident reports, breach analyses, audit findings and changes to the system. AT-3 expects content updates and lessons learned from incidents and breaches to be reflected in training, so record each review, the inputs considered, and the changes made. Keep the revision history with the materials so an assessor can see what changed and why. The output is a dated review log linking specific incidents or findings to specific curriculum changes. If no incident occurred in a period, record the review and the reason no change was needed, since the assessor will look for evidence that the review happened.
Extend role training for PII processing under the privacy baseline
The privacy baseline in SP 800-53B selects AT-3(5), which concerns training for personnel who process personally identifiable information. Identify every role in the catalog that handles PII, then add modules on the privacy requirements, handling rules and reporting duties that apply to those roles. Coordinate the content with your privacy office, since the legal basis and handling rules come from the organization's own privacy program. The output is a PII training module per affected role, a list of who completed it, and privacy office sign-off on the content. Confirm with your privacy lead which regulations and internal policies the module must reflect before you publish it.

How a self-hosted learning platform produces AT-3 evidence

A self-hosted learning management system such as Moodle can hold a separate course for each defined role, such as system administrators, developers, help desk staff and privileged operators, and record when each person finished it. The completion setting on each activity decides what the platform counts as done. Moodle marks an activity complete for a learner when they view it, when they receive a grade from it, or when they tick it manually, depending on the conditions set for the activity. Those three triggers mean very different things. A page view shows that someone opened a document, a graded quiz shows that they answered questions, and a manual tick shows only that they claimed to have finished. Before the course opens to learners, the organization should decide which of these its AT-3 wording counts as training completion, then set each activity to match that decision.

Ask the team that owns the requirement to write down the completion rule for each role course: the minimum passing grade, whether the learner must complete the activity in sequence, and whether a manual tick is allowed at all. Then run a test learner through each course, confirm that the completion status changes only when the rule is met, and export the completion report for that test learner. Check that the export shows the role, the course version, the date and the learner's identifier, since an assessor will ask which version of the material a person saw before they were given access. Moodle's completion data is only as reliable as the course design behind it, so treat this check as part of the control, not as setup work.

Completion records also need a retention and reporting plan that is confirmed in your own environment. Confirm which database tables and logs hold completion and attempt data, how long the platform keeps them, whether backups include them, and whether an administrator can produce a per-role report for a defined period without database access. Confirm how material updates are tracked, because AT-3 expects content to be refreshed and lessons learned to be incorporated, and a learner who completed version one of a course should not appear current after version two is published. Where the organization cannot confirm these points from its own installation, record that as an open item rather than assuming the platform handles them.

Evidence that passes AT-3 and how to keep it current

An assessor testing AT-3 follows the chain from role to content to person: which roles need training, what that training covers, and proof that each person completed it before they got access. The artifacts below connect those links, and each one decays unless someone updates it on a schedule between assessments.

Role-to-training matrix

This matrix lists every organization-defined role with system access, the security and privacy training each role must complete, and the point at which completion is required, such as before account creation or before performing a listed duty. It is the document an assessor uses to test whether the roles were defined and the training assigned to them. Review it when roles change, when a new system is onboarded, and at the periodic review date your policy sets. Confirm the matrix names the PII processing roles that the privacy baseline requires training for.

Curriculum and materials with version history

Keep each course outline and its slides, labs and quizzes under version control, with a dated changelog that names what changed and why. Assessors compare the content against the threats and system changes in the period under review, so a course that still describes last year's architecture is a finding. Tie each revision to a trigger such as a new system release, a security incident, or a lessons-learned item. Store prior versions so you can show which content each learner actually received.

Dated completion records tied to access grants

A completion record should show the learner, the role, the course version, the completion date, and the date access was granted. The assessor test is ordering: training must precede authorization or the performance of duties. If your learning platform marks activities complete on view, a grade, or a manual tick, record which condition applies to each course so a viewed video is not mistaken for demonstrated understanding. Export these records on a schedule and check a sample against the provisioning log in your identity system.

Content update and lessons-learned logs

AT-3 expects content to be updated periodically and to reflect lessons learned from incidents and breaches. Maintain a log that links each incident, near miss, or audit finding to the course change it produced, with the owner and the date the change reached learners. Entries with no corresponding course revision show an assessor that lessons were recorded but not acted upon. Review the log after every incident response exercise and at each scheduled content review.

PII training records for the privacy baseline

Organizations in the privacy baseline must show that personnel who process personally identifiable information received training matched to that processing. Keep a separate record set for PII-processing roles, with the specific PII categories and handling duties covered, the completion date, and the refresh date. Reconcile this list against the systems inventory and data flow records each quarter so that someone who started processing PII is not missing from the roster. Ask your assessor which PII training evidence they expect to see for your system.

What meeting AT-3 costs in money and effort

This table lists the cost components of running AT-3 role-based training, who is typically paid for each, whether it is one-time or recurring, and what moves it up or down. Use it to structure a quote request, since NIST does not publish figures for these costs and no supplied fact gives a price or duration.

Cost component	One-time or recurring	Who is paid or who carries the effort	What drives it up or down
Role-based course development	One-time, then recurring on content updates	Internal instructional designers or an outside content developer	Number of defined roles, depth of role-specific content, and how often the content is revised after incidents
LMS licenses or self-hosting effort	Recurring	Software vendor for hosted licenses, or internal platform team for self-hosted systems	Number of learners, hosting model, and whether the LMS already exists in the client environment
Engineering time to link provisioning to training	One-time build, recurring maintenance	Internal IAM or platform engineers, or an implementation partner under a fixed scope	Number of systems that gate access, and how many role changes occur each year
Training record and evidence upkeep	Recurring	Compliance or security staff, sometimes with help from a partner	Completion tracking granularity, retention period set by the organization, and how many roles must be proven
Content review for lessons learned and changes	Recurring	Security team, privacy office for the AT-3(5) PII content, and incident response staff	Incident volume, system change frequency, and how many regulations the content must reflect
External content review	Recurring or per review cycle	Outside security or privacy specialists, if the organization chooses to use them	Scope of review, number of roles, and whether reviews are scheduled or triggered by events
Auditor sampling and assessor time	Recurring per assessment	Independent assessor or auditor, whose fees are set by the assessor	Sample sizes the assessor selects, number of roles and personnel, and completeness of records before fieldwork

Who owns AT-3 and what a partner can take on

The organization owns AT-3. It decides which personnel hold the defined roles that need security and privacy training, sets the training content and frequency, approves the curriculum, and signs off on how lessons learned from incidents and breaches feed back into updates. An assessor will ask the organization, not a vendor, why a role was included or excluded and who approved the material.

Role definition: Name each role that receives role-based training, such as system administrators, developers, privileged users and staff handling PII, and record why each role was chosen.
Content approval: Assign an accountable owner who approves curriculum changes and documents the date and reason for each update.
Access gating: Decide the rule that personnel complete the required training before they receive access or perform assigned duties, and who enforces it.
Lessons learned: Define the trigger and process that turns incidents, breaches and audit findings into training updates.
Retained decisions: Keep the approvals, rationale and meeting records that show management made these choices.

Before engaging anyone, confirm internally who holds each decision above, because a partner can prepare materials but cannot make these calls.

Where AT-3 programs usually fall short

Most AT-3 findings trace back to a few gaps: roles that were never defined, training that arrives after access is granted, and content that never changes. The cards below pair each gap with a fix you can check against the control text and your own training records.

Roles are never defined

AT-3 applies to personnel in organization-defined roles, so an assessor first asks which roles you defined and why. Many programs train by job title alone, leaving privileged administrators, developers, incident responders and contractors without a written role list. Fix this by publishing a role matrix that names each role, the systems it touches and the training it requires, then tie that matrix to your identity provider groups so new access maps to a role automatically.

Training completes after access

The control expects role-based training before a person is authorized to access the system or perform assigned duties. Programs often grant access on day one and schedule the course for week two. Check the timestamps: compare the date a privileged account was provisioned with the date the role course was completed. Fix this by making the training a gate in the onboarding workflow, so the access request cannot be approved until the required course is recorded as complete.

No refresh after system changes

AT-3 calls for training at a defined frequency and again when system changes require it. Annual training that never mentions a new cloud region, a new authentication method or a changed deployment pipeline leaves staff trained on a system that no longer exists. Fix this by listing the change types that trigger retraining, such as a new platform release or a changed data flow, and linking them to your change management tickets so that a material change opens a training task.

Generic content with no lessons learned

The control requires periodic content updates and lessons learned from incidents and breaches. A course reused unchanged for several years, with no reference to your own incidents or near misses, is hard to defend. Fix this by keeping a short revision log for each course, recording which incident, test result or audit finding led to each change, so an assessor can trace content back to real events.

PII training missing in the privacy baseline

The SP 800-53B privacy baseline includes AT-3(5), which covers training on processing personally identifiable information. Organizations that adopt the privacy baseline often apply it to the main system but give the people handling PII the same generic course as everyone else. Fix this by confirming which roles process PII under your privacy program, then building a PII module for those roles and recording completion separately from the general course.

Common questions about AT-3 cost, effort and scope

How much effort does AT-3 role-based training take to implement?

The effort depends on how many roles your organization defines, how much system-specific content each role needs, and how often training must recur. No effort figure is supplied for this control, so ask for an estimate built from your own role list. Most of the work is one-time design: defining roles, mapping each role's duties to training content, building materials and setting up tracking. Recurring effort includes content updates, onboarding of new staff, role changes, and refreshers after significant system changes or lessons learned from incidents. AT-3 is selected in the low, moderate and high baselines and in the privacy baseline, so the obligation is the same at every impact level, but the number of roles and the depth of content grow with the system's scope and sensitivity. A useful quote lists roles, content types, delivery method, tracking and evidence outputs.

Can we run AT-3 in-house without an outside partner?

Yes. The organization owns its controls and can run AT-3 itself if it has staff who can define roles, write role-specific content, deliver training and keep records. Assessors test whether the work actually happens, so ownership cannot be handed off. Teams often underestimate three areas: keeping content current after system changes, proving that training finished before access was granted, and showing that lessons learned from incidents reached the training. An outside partner can help with the platform side, such as deploying a self-hosted learning system in your own cloud account or data center, configuring role-based courses, and preparing evidence exports. DeployOpen prepares systems and evidence for assessments, but it does not issue assessment reports. Only an independent assessor or auditor issues those. Before deciding, ask an internal owner to walk one role from definition through completion and into the records.

What does a partner need from us to scope AT-3 work?

A partner needs enough information to write a fixed scope with clear deliverables before work starts. Prepare the following: your defined roles and the duties attached to each, the systems those roles touch, existing policies and procedures (including the awareness and training policy), any current training content and completion records, and the impact baseline each system is categorized under. Also name who approves training content, which identity system grants access, where training records must be kept and for how long, and whether personnel process personally identifiable information, which brings in the privacy baseline enhancement. Share the system security and privacy plan if one exists. Finally, name one decision owner who can approve scope changes in writing. Without these inputs, any quote will carry more assumptions and the timeline will be harder to hold.

How long does AT-3 implementation take?

No duration is supplied for this control, and the honest answer is that it depends on scope. The main drivers are the number of roles, whether usable content already exists, whether a learning platform is already running in your environment, how many people must complete training, and how quickly your team approves content and provisions access. Because most engagements are fixed-scope, the timeline is agreed in writing before work begins, with dependencies named. Ask the partner to break the plan into milestones such as role catalog sign-off, content build, a pilot with one role, full rollout and evidence handover. Schedule risk usually comes from content approvals and access provisioning rather than from the technical build. Your quote should state which items the timeline assumes you will provide and by when.

Does AT-3 apply to contractors and other third-party staff?

AT-3 applies to personnel in the roles your organization defines as requiring role-based training. Contractors and third-party staff fall in scope when their assigned duties put them in one of those roles, which is common for anyone with privileged access or access to sensitive data. The sibling control AT-2 covers all system users, including managers, executives and contractors, so most organizations train contractors under both controls. Contracts should require contractors to finish the required training before access is granted and to make their completion records available to you. Illustrative example: a managed service provider's administrator with privileged access to a production system would normally be treated as holding a defined role and would need role-based training before access. Because the organization decides which roles exist, confirm the scope with your assessor before finalizing contract language.

How do AT-3, AT-2 and AT-4 relate to each other?

AT-2 provides security and privacy literacy training and awareness to all system users. AT-3 adds role-based training for people with defined duties, delivered before they gain access or start those duties and periodically after. AT-4 documents and monitors training activity and keeps individual training records for a defined period, which is the evidence trail behind both. In practice, AT-2 sets the baseline for everyone, AT-3 adds depth for specific roles, and AT-4 proves both happened. Assessors commonly sample records against role assignments and access grants, so design one tracking approach that shows who completed which module, when, and under which role, then link it to access provisioning. The SP 800-53 catalog lists AT-3 with 22 related controls, so AT-3 evidence often overlaps with policy, access and incident response work. Map those overlaps early to avoid duplicate records.

Can open-source tools produce AT-3 training evidence?

Open-source learning platforms can deliver role-based courses, hold role assignments and export completion data, which covers part of the evidence trail, but you must verify each capability against your own records requirements. Moodle, for example, is licensed under GPL-3.0-or-later and its activity completion can mark an activity complete when a learner views it, receives a grade from it or ticks it manually, depending on how each activity is configured. That behavior can support a tracking design, but a view alone may not prove that role-specific content was understood, so many programs pair completion with a short assessment. Keep the training curriculum, materials, role catalog, completion records, dates and content version history together. Self-hosting inside your own environment keeps these records under your control. Confirm the exact fields your assessor will request before choosing a platform configuration.

How DeployOpen scopes and prepares AT-3 evidence

DeployOpen starts every AT-3 engagement with a fixed-scope written agreement that fixes the scope, deliverables and timeline before any work begins. For role-based training, the agreement should name the organization-defined roles that need training, the training content each role receives, the trigger events that require retraining (such as a system change or a lessons-learned update), and the records that will be kept. The organization still owns the policy, the role definitions and the training decisions. DeployOpen's part is to prepare the systems and evidence that show those decisions are carried out.

The technical work covers the learning management system configuration, such as course assignments tied to each role, completion rules and reporting, and integration with the provisioning process so that a person is routed to role-specific training before access is granted. Where the chosen platform is Moodle, the scope should state which activity completion conditions mark a course complete (viewing, grading or manual tick) and why, because an assessor will ask whether completion reflects understanding of the material. Evidence packaging then gathers the curricula, training materials, role-to-course mappings, completion exports and content revision history into a form the organization's assessor can examine.

DeployOpen prepares systems and evidence. It does not issue assessment reports, attestations or certifications. Those are produced only by independent assessors, whose role is to test the control against the procedures in NIST SP 800-53A Rev. 5. Before signing, ask the proposed partner to confirm in writing which artifacts are delivered, who maintains them after handover, and which items remain the organization's own responsibility, including role approval and the sign-off that training content is current.

AT-3 Role-based training