AT-4 Training records: requirements and evidence

AT-4 training records: what the requirement asks and why assessors check it

AT-4 requires your organization to document and monitor its security and privacy training activities, covering both awareness training and role-based training, and to keep individual training records for a retention period that the organization defines. An audit, customer questionnaire or contract clause that cites AT-4 is not satisfied by a course catalog or a policy that says training happens. The assessor wants to see who was trained, on what, when, and whether the records exist for the period you committed to. AT-4 has no control enhancements in SP 800-53 Release 5.2.0, so the whole requirement sits in the base control. It is selected in the low, moderate and high security control baselines and in the privacy baseline in SP 800-53B Release 5.2.0, which means almost every system scope you will be assessed against includes it. The risk AT-4 addresses is simple to state and easy to miss in practice: training that cannot be shown to have happened gives no assurance that personnel can recognize phishing, handle incidents or process personal information correctly. AT-4 is the evidence trail behind AT-2 (literacy training and awareness) and AT-3 (role-based training). If AT-2 and AT-3 say that people must be trained before access or at defined intervals, AT-4 is where you prove that they were. Assessors who test AT-2 or AT-3 will usually ask for the records next, so weak AT-4 evidence tends to undermine two other controls at once.

AT-4 is hard to satisfy for three common reasons. Records are scattered across HR systems, a learning management platform, certificate folders and spreadsheets maintained by individual managers, so no one can produce a complete history for one person quickly. Completion is often recorded for a course but not for the version of the content delivered, or the role that triggered it. And the retention period is frequently never defined, so there is no basis for deciding how long to keep records or when to delete them. The organization owns this control and sets the retention period, based on its own legal, contractual and risk obligations. Before scoping an assessment, confirm with legal and compliance what period applies, where the authoritative record lives, and who is accountable for producing it on request. A practical first check is to pick three employees in different roles and ask for their complete training history from the systems of record. If the answer requires manual assembly from several sources, the control is not operating in a form an assessor can test. Consider an illustrative case where a contractor with privileged access completed onboarding training but the record sits only in an email thread. That gap is what AT-4 exists to close. An implementation partner can help consolidate sources and define the record set, but the organization still decides what is retained and must be able to demonstrate it.

Which systems, people and training programs AT-4 applies to

AT-4 applies wherever AT-2 and AT-3 training happens, so the scope of the record set follows the scope of the training program. The decisions below determine which systems hold records, which people generate them, and how long they must be kept.

Baseline selection sets the obligation

AT-4 is selected in the low, moderate and high security baselines and in the privacy baseline, so the baseline a system sits in determines whether the control applies at all. Confirm the impact level of each system in scope, then check the SP 800-53B baseline and any tailoring decisions recorded in the system security plan. Where a system is tailored, record the reason the baseline was changed.

Awareness and role-based user groups

AT-4 covers both awareness training and role-based training, so the record set must include every population that receives either. List the user groups that AT-2 and AT-3 reach, including managers, executives, privileged administrators and staff in defined security roles. A group missing from the training roster is usually a group missing from the records.

Contractors and third parties

Decide whether contractors, managed service staff and other third-party personnel complete the same training as employees. If they do, their completion must appear in your records, even when they are tracked in a vendor system. If a third party trains its own staff, document that arrangement and what evidence you accept from it.

Training systems that hold records

Identify every system that stores a training event: the learning management system, HR records, identity or access tools that log completions, and ticketing systems used to assign or chase training. Records split across systems must be reconciled to one individual record. Confirm which system is authoritative for each population and how the others feed it.

Monitoring and completion tracking

AT-4 requires monitoring of training activities, so decide who checks completion, how often, and what happens to people who miss a deadline. For example, an LMS may mark an activity complete when a learner views it, when a grade is received, or when a learner ticks it manually, so the completion rule must match what the organization claims was learned. Document the rule before assessment.

Retention period defined in advance

The organization sets the retention period for training records as an organization-defined parameter, so the value is a scoping decision that must be written down before assessment. Choose a period that covers the look-back an assessor will test, and state it in the policy or procedures. A period that is changed after records are purged will be hard to defend.

How an assessor tests AT-4 training records

This table maps the three SP 800-53A determination statements for AT-4 to the examine, interview and test methods an assessor uses, the evidence each one requests and the findings that appear most often. Read each row as one step in the assessor's work, and confirm the organization-defined parameter before testing begins.

Assessment step	Evidence requested	Common findings
Examine: security and privacy awareness and training policy and procedures (AT-04 labels in SP 800-53A)	Current policy and procedures that name what training activities are documented and monitored, who owns the records and how long they are kept	Procedures describe record keeping in general terms but do not say which training activities or record fields are covered
Examine: training records for awareness and role-based training	Sampled individual records showing who completed which awareness and role-based training, with dates and the retention period applied	Records exist for some training types only, or completion is held in email or spreadsheets with no consistent fields
Interview: personnel responsible for training record retention	Named owners who can explain how records are created, reviewed, retained and disposed of, and how they confirm the retention period	Owners cannot say where records live, who may change them, or what happens to records of departed staff
Test: mechanisms supporting the management of training records	Demonstration of the learning platform or record system producing, storing, exporting and monitoring training records, including access settings	Records can be edited without an audit trail, or the platform cannot produce a record for a sampled individual on request
Organization-defined parameter (AT-04_ODP)	Written value for the retention period and the training activities in scope, approved before the assessment starts	Parameter left blank or set after the assessment, so the assessor cannot confirm the test criteria
Mapping to AT-2 and AT-3 evidence	Records that link each sampled person to the literacy and role-based training assigned to them, with completion status	Assessor finds training content delivered but no record that links completion to a named individual
Retention and disposal check	Evidence that records are kept for the defined period and removed or archived according to the stated procedure	Records deleted early when accounts are closed, or kept indefinitely with no documented basis

How to implement AT-4 in the order an auditor will read it

This sequence takes AT-4 from an undefined retention rule to a tested training record trail that an assessor can trace from policy through to individual completions. Each step closes with a written output, so the evidence is ready before the assessment begins.

Set the retention period and record fields
AT-4 requires individual training records to be kept for an organization-defined period, so the first decision is that number and the authority behind it. The security or compliance lead, with legal and records management input, writes the retention parameter into the awareness and training policy and the AT-4 procedure. In the same document, list the minimum fields every record must carry: learner identity, role, course or module identifier, version of content, date of completion, score or completion status, and the training type (awareness or role-based). The output is a signed retention parameter and a record schema. Ask the assessor which format they expect before you finalize field names.
Inventory every training source
Training evidence often sits in several places: a learning management system, an HR onboarding tool, vendor portals, classroom sign-in sheets and spreadsheets kept by team leads. Build a list of each source that delivers security or privacy training, the owner of each source, and the record types it produces. Include contractors and any third-party training that the organization relies on. The output is a training source register. A source that is missing from this register is a common reason an assessor finds records that cannot be traced to a population of users.
Consolidate records into one store or export process
Choose a single system of record for training completions, or define a scheduled export that pulls completions from every source into one repository on the schedule set in the procedure. A self-hosted learning platform such as Moodle can hold course completions for in-house training, using its activity completion tracking, which marks an activity complete when a learner views it, receives a grade from it, or ticks it manually, depending on the conditions set for that activity. Confirm with the platform owner exactly which completion condition each course uses, because the condition determines what the record proves. The output is a working store with one record per learner per course.
Link records to AT-2 and AT-3 activities
AT-4 records are only useful if they tie back to the training that AT-2 and AT-3 require. Map each awareness course to the AT-2 audience and each role-based course to the AT-3 roles defined in the organization's role list. Store the link as a field on the record or as a mapping table, so a reviewer can start from a required activity and find who completed it, or start from a person and see which required activities they have finished. The output is a traceability table covering every AT-2 and AT-3 activity. Gaps in this table usually show where the organization has not yet defined a role or course.
Define monitoring and completeness checks
Monitoring means someone checks the records on a defined cadence and acts on what they find. Write the checks into the procedure: for example, comparing the current user population from the identity directory against training completions, flagging overdue or missing records, and reporting people whose required training has lapsed. Assign an owner for each check and a path for escalation to the managers of the people involved. The output is a completeness report template and a log of past runs, with actions and closure dates. Keep the first few reports, even if they show gaps, because a history of follow-up is stronger evidence than a clean report that nobody reviewed.
Set retention and disposal rules
Once records exist, the retention parameter must be enforced. Define how records are stored, who can access them, how they are protected from alteration, and when they are disposed of after the retention period ends. Where training records contain personal data, check disposal and access rules against the organization's privacy obligations and any applicable data protection law. Disposal should be logged, so that an assessor can see that deletion followed the rule rather than happening ad hoc. The output is a retention and disposal schedule, a disposal log procedure and an access list for the record store.
Run a sample review before the assessment
Before the assessor arrives, select a sample of individuals across roles and training types and trace each one from the population list, through the AT-2 or AT-3 requirement, to the completion record and the monitoring follow-up. Check that each record has every required field and that dates fall within the retention period. Record the exceptions and fix the cause, not only the individual record. The output is a sample review worksheet with exceptions, root causes and corrections. This review is prepared by the organization or its implementation partner. Only the independent assessor determines whether AT-4 is met.

Which training records pass an AT-4 assessment

An assessor testing AT-4 looks for a training record trail that is complete, current and provably retained. The six artifacts below connect the training activities behind AT-2 and AT-3 to the records an assessor will sample, and each one needs a routine refresh between audits.

Training record schema

Define the fields every training record carries: user identifier, role, course identifier, training type (awareness or role-based), completion date, score or result, and the version of the content delivered. A consistent schema lets an assessor follow one person from assignment to completion without manual reconciliation. Check that the schema is written into the AT-1 procedures and that the same fields are used across every training tool in use.

Individual completion records

Keep a dated record for each person and each course, showing when the training was assigned, started and completed. Assessors commonly sample individuals and ask for proof that they completed the training they were required to take. Confirm that completion is recorded by the system of record rather than by a manager's email, and that the timestamps can be exported in a readable format.

Role assignment records linked to AT-3

Store the role each person holds and the role-based courses that role requires, so the assessor can see why a given person needed a given course. These records are the bridge to AT-3, where role-based training is defined. Review them whenever job roles, system access or contractor assignments change, because a stale role record makes a completed course look like the wrong training.

Monitoring reports on completion and overdue users

Produce reports that show completion rates by group and list users who are overdue, with the date each overdue item was escalated. Monitoring is the activity AT-4 names explicitly, so the report itself is evidence, not only the underlying data. Schedule the report, keep each dated version, and record who reviewed it and what follow-up was taken for overdue users.

Retention period and disposal logs

Record the retention period the organization has defined for training records, then keep logs showing when records were disposed of under that period. AT-4 requires retention for an organization-defined period, so the value must be set by the organization and written down. Confirm the period with your legal, HR and contract owners, and check that disposal does not remove records still needed for an open audit or investigation.

Access controls on training records

Restrict who can view, edit or delete training records, and log changes to them. Training records contain personal data, so the access model should separate people who administer courses from people who can alter completion history. Review the access list at the same cadence as other privileged access reviews, and confirm that record exports are protected in transit and at rest.

What meeting AT-4 costs in money and effort

This table breaks down the cost components of keeping AT-4 training records, who is paid for each, whether the cost is one-time or recurring, and what drives it up or down. NIST does not estimate compliance costs, so use the table to shape a written, fixed-scope quote rather than to predict a figure.

Cost component	One-time or recurring	What drives it	How to keep it down
Tooling or licenses for the learning and records system	Recurring (commercial) or one-time setup (self-hosted)	Number of learners, number of named administrators, and whether the platform is priced per user. Open-source platforms such as Moodle remove license fees but not hosting or support.	Ask for per-user and per-module pricing in writing. Compare the total cost of hosting in your own environment against a hosted subscription.
Engineering time to build completion exports and reports	One-time (build), then recurring (maintenance)	Number of training sources (LMS, HR system, sign-off forms), field mapping to individual identities, and the report format an assessor will accept.	Define the record fields once, including user, course, role, date, completion and retention period. Reuse one export for all training controls.
Record upkeep by training or HR staff	Recurring	Volume of new hires, role changes and contractor onboarding, plus how often completion is verified against the defined retention period.	Trigger training assignments from HR joiner and mover events. Automate completion tracking so staff only handle exceptions.
Policy and retention rule definition	One-time, reviewed periodically	The organization-defined retention period for AT-4 and how it aligns with other records obligations. The period must be set by the organization, not the platform.	Agree the retention period with legal, records and security owners before build work begins, and record the decision in the policy.
External review or testing if a partner is used	One-time (readiness review), optional recurring (re-check)	Scope of systems reviewed, number of training sources, and whether the partner tests the record trail end to end or reviews only documents.	Set scope and deliverables in a written, fixed-scope agreement. Ask the partner which artifacts it will produce and which remain the organization's responsibility.
Auditor sampling effort	Recurring with each assessment cycle	How many individuals and training records the assessor samples, how quickly the organization can produce them, and whether records are complete and consistent.	Keep records retrievable by person and by date. Run a sample pull internally before the assessor arrives. Note that only an independent assessor or auditor issues findings.
Internal oversight of training feedback and gaps	Recurring	Frequency of monitoring for overdue or missing training and the number of follow-up actions needed for each gap.	Use automated overdue reports and set a single escalation path so gaps are handled once and documented.

How Moodle and CISO Assistant can hold AT-4 evidence

Moodle can hold the training record that AT-4 asks for, but only if the organization chooses the right completion condition for each course. Moodle's activity completion marks an activity complete for a learner when they view it, when they receive a grade from it, or when they tick it manually, depending on the conditions set for that activity. Those three triggers prove different things. A view shows that content was opened, a graded quiz shows that a learner was assessed, and a manual tick shows only that someone claimed to have finished. Before rollout, decide which trigger matches each training activity in the AT-2 and AT-3 programs, and record that decision in the training procedures so an assessor can see why a given completion counts as evidence.

Completion data in Moodle is only useful if it can be exported and kept for the period the organization defines for AT-4. The organization sets that retention period, not the tool, so confirm how the Moodle installation exports completion records, how long they persist in the database, and whether backups capture them. Test the export with a real learner account before the first audit cycle, and check that the record shows the learner, the course, the completion condition that was met and the date. Moodle's developer documentation on the activity completion API, linked below, is the starting point for confirming which fields are available.

CISO Assistant, licensed under AGPL-3.0-only, can run audits and compliance assessments against more than 200 frameworks, including automatic mapping between them. It tracks assessment work, such as the status of the AT-4 determination statements and the evidence attached to them. It is not a source of training records and should not be treated as one. Confirm with the project how its exports and attachments work, and make sure the training evidence itself stays in the learning system or another system of record that the organization controls. Both tools are licensed under copyleft terms (GPL-3.0-or-later for Moodle and AGPL-3.0-only for CISO Assistant), so review those obligations with counsel before modifying or offering either tool to others.

Who owns AT-4 work: your team, a partner and the auditor

Your organization owns AT-4. NIST expects the organization to document and monitor its training activities and to keep individual records for a period the organization defines, so the retention period, the scope of training covered and the approval of the records process are internal decisions that a partner or auditor cannot make for you. Your team also stays accountable for the content of the awareness and role-based training that generates the records.

Retention period: Set the organization-defined period for keeping individual training records and document the reason for it, including any contractual or regulatory retention that applies to your sector.
Records process: Approve how completions are captured, who may amend a record, and how corrections are logged so that changes stay traceable.
Training content sign-off: Approve the awareness and role-based material that AT-2 and AT-3 require, since the records prove that named content was delivered.
Named owner: Assign the personnel who answer for record retention and who can be interviewed by an assessor.

Before engaging anyone, confirm with your own legal and HR teams which records they must keep and for how long.

Where AT-4 usually fails and how to close each gap

AT-4 is rarely missing outright. It fails when the organization cannot show a complete, current and retained record of who was trained, on what, and when. The gaps below are the ones assessors most often find behind AT-2 and AT-3, and each fix turns a training program into evidence an assessor can sample.

Retention period left undefined

AT-4 requires individual training records to be kept for an organization-defined period, so the parameter must have a value. Without one, staff cannot tell whether a record may be deleted, and assessors have nothing to test against. Set the retention period in writing, name the owner, and tie it to the records schedule that already governs other compliance evidence. Confirm the value with your compliance lead before the first assessment.

Records split across systems

Training often lives in an LMS, a spreadsheet kept by a manager, a ticketing queue and an email thread. When no system is authoritative, the organization cannot produce a complete record for one person on request. Designate one system of record for training completions and export or link the others to it. Check that a sample of individuals can be traced end to end from policy, to assignment, to completion, to retained record.

Completions not tied to role or content

A completion that says only that a course was finished does not show that the right people took the right version. AT-3 role-based training and content updates make this link essential. Record the role, the course version and the completion date together in each entry. When content changes, the record should show which learners still need the updated version, so the evidence matches what the organization actually taught.

No monitoring of overdue training

Assignments that expire quietly produce gaps that surface only during an assessment or an incident. AT-4 expects the organization to monitor training activities, not just store them. Run a recurring report of overdue and expiring training by role and by system, and route it to the owners who can act. Keep the reports, because a dated report showing follow-up is evidence of monitoring in its own right.

Records deleted at account removal

Many platforms delete a user's data when the account is disabled or removed, which erases the training history the organization must retain. Write a retention rule that overrides account deletion for training records, and test it by removing a test account and confirming the record remains. Confirm how your platform handles user deletion before configuring it, because the default behavior varies.

Contractors trained outside the system

Contractors and third-party staff often complete training with their employer or in a separate portal, so the organization holds no record of them. AT-2 covers contractors as system users, so their training belongs in the same evidence trail. Require contractor training to be recorded in the organization's system of record, or obtain and retain the provider's completion records under the access agreement. Verify this for every contractor group with system access.

Questions buyers ask about AT-4 training records

How much effort does AT-4 training records take to implement?

Most of the effort comes from collecting and reconciling records that already exist in different places, not from writing new controls. AT-4 asks the organization to document and monitor security and privacy training, both awareness and role-based, and to keep individual training records for a period the organization defines. The work scales with the number of people who need training, how many systems hold training data (a learning management system, HR records, spreadsheets, signed attestations), and how many roles need role-based training under AT-3. Organizations with one training platform and clean role data usually have less to do than those with several disconnected sources. Ask any partner to size the work from your headcount, systems and role catalog in a written scope.

How long does it take to get AT-4 training records in order?

The timeline depends on the drivers below, not on a fixed duration. The first driver is the state of existing data: whether completion records carry user identity, course version and completion date, and whether they can be exported. The second is how many training sources must be merged and deduplicated. The third is whether the organization has already defined its retention period and who owns it. The fourth is how many past records must be backfilled to show consistent monitoring. Fixed-scope engagements agree the deliverables and timeline in writing before work starts, so ask for the schedule to list each source system and its dependency.

What does AT-4 need from our HR and training teams?

AT-4 is shared work between the teams that run training and the teams that hold personnel data. Training teams need to confirm which courses count as awareness and which as role-based training, and to keep course versions and completion evidence. HR needs to supply a current, authoritative list of personnel, roles, start and transfer dates, and departures, so that records can be tied to the right people and retained or disposed of on schedule. Security or compliance leads need to define the monitoring cadence and the retention period. Without agreement on these owners, records tend to diverge across systems, and that gap is usually what an assessor finds first.

Can our team implement AT-4 training records in-house?

Yes, many organizations do this in-house, provided they have someone who owns the training data, a defined retention period and a monitoring routine. The skills needed are mostly data work (exporting, matching identities, versioning courses) plus clear governance. The harder part is often keeping records consistent over time once the initial clean-up is done. Teams that outsource usually do so for the initial setup, such as configuring a self-hosted learning platform to store completion evidence, or for an independent review before an assessment. The organization keeps ownership either way, and only an independent assessor can issue an assessment result.

What will an assessor sample when testing AT-4?

An assessor works from the three determination statements in SP 800-53A for AT-4, using the examine, interview and test methods. In practice, expect them to read the awareness and training policy and the procedures for training records, interview the people who hold record retention responsibility, and test the mechanisms that manage training records. Sampling usually means picking a set of personnel across roles and checking whether their training is documented, whether it was monitored, and whether records are still available for the defined period. Prepare by making sure any individual can be traced from role to training to completion evidence.

Does NIST set the retention period for training records?

No. AT-4 includes an organization-defined parameter, so the organization chooses the retention period and documents it. NIST does not set a number for AT-4, and any figure you see quoted elsewhere should be checked against the authority that applies to your system, such as a contract, an agency or a sector regulator. Whatever period you choose should appear in your training policy and procedures, and your records should be retrievable for the full period. Ask your assessor or contract owner to confirm the requirement before you fix the value.

Does AT-4 have any enhancements we need to add?

No. In SP 800-53 Release 5.2.0, AT-4 has no control enhancements, so the scope is the base control and its organization-defined parameter. It is selected for the low, moderate and high security baselines and for the privacy baseline. The related controls AT-2, AT-3, CP-3, IR-2, PM-14 and SI-12 deserve attention because their evidence often overlaps with training records. Confirm the baseline your system uses in the SP 800-53B profile before you scope the work.

How DeployOpen prepares AT-4 training records

DeployOpen helps organizations set up the systems and records that show AT-4 is working, inside their own infrastructure. The organization still owns its training program and its retention period, and an independent assessor decides whether the evidence meets the control.

How we scope

Agree in writing which training systems, platforms and record sets fall within the AT-4 engagement.
Confirm with the organization the retention period it defines for training records as its organization-defined parameter.
Identify who owns record retention responsibilities and who will be interviewed during assessment.
Set out the deliverables, timelines and any ongoing retainer support before work starts.

How we build

Configure the learning platform so completion and attendance data is captured per individual and per course.
Set up training record storage that keeps individual records for the defined retention period.
Build reporting that tracks security and privacy awareness and role-based training activity over time.
Test that records can be retrieved, exported and reviewed, and document how those tests were run.

How we hand over

Deliver written procedures for documenting, monitoring and retaining training records.
Provide a record map linking AT-4 evidence to AT-2 and AT-3 training activities and their outputs.
Document configuration, retention settings and access controls so assessors can examine them directly.
Walk the organization's staff through the handover so they can run and maintain the records process.

How we support

Offer ongoing support and upgrades for the training platform as a retainer if the organization wants it.
Review retention settings and record completeness when training content or staffing roles change.
Prepare evidence packages for the organization's independent assessor, who issues any conclusions.
Confirm with the assessor which evidence formats and sampling approach they expect before handover.