AT-6 Training feedback: requirements and evidence

What AT-6 training feedback requires and why it is hard to show

When an assessor or customer asks how training failures reach leadership, the answer has to show a defined route from training results to named people who can act on them. AT-6 Training feedback asks the organization to give feedback on its training results to defined personnel at a defined frequency. The control's guidance points out that when people in critical roles fail training, that can signal a serious problem that senior managers should hear about. The requirement is therefore not that training happens, but that results travel upward to the right audience on a schedule the organization has set and can prove. The organization must set two organization-defined parameters before it can be assessed: who receives the feedback, and how often it is given. Both are decisions for the organization, not values the standard supplies. AT-6 has no control enhancements in SP 800-53 Release 5.2.0, so the whole requirement rests on those two settings and the evidence behind them. The control is also absent from every SP 800-53B baseline (low, moderate, high and privacy), so an organization only carries it if it is selected through tailoring or an overlay. Confirm early whether your authorizing body or contract expects it. The difficulty is joining the data. To show that a failure in a critical role reached a senior manager, you need training completion and results linked to individual people, those people linked to roles, and roles linked to a reporting path that ends at someone with authority. Many learning systems hold results but not role assignments, and HR systems hold reporting lines but not training outcomes. Ask your team to produce one sample report for a critical role, dated and sent to a named manager, and check whether the chain can be traced without manual reconstruction.

Which systems, roles and teams AT-6 reaches in scope

AT-6 only produces value when the training data it feeds back covers the right people and systems. The cards below cover the decisions that shape that scope: whether the control applies at all, which systems and roles feed the results, and who receives the feedback. Each decision should be written down and approved before evidence collection starts.

Whether AT-6 applies at all

AT-6 is not selected in any SP 800-53B baseline, including low, moderate, high and privacy. It enters scope only if the organization tailors a baseline to add it or the authorizing body imposes it through an overlay or contract. Confirm this first, because it determines whether the rest of the scope questions matter for your authorization package. Record the decision and the source that required it, such as the tailoring worksheet or overlay text.

Systems and training populations covered

Decide which systems and user populations fall under the training program whose results AT-6 reviews. A system left out of the training scope produces no results to feed back, so the gap is invisible to senior managers. Compare the system inventory against the learning platform's enrollment lists and flag systems whose users are trained in a separate program.

Defining critical roles

AT-6 is written around people in critical roles, so the organization must define which roles count. Typical candidates are administrators, security operations staff, developers with production access and staff who handle sensitive data. Document the role list with the reason for each entry, and tie it to the role-based training defined under AT-3 so the two controls use the same definitions.

Recipients of training feedback

Set the defined personnel who receive feedback on training results, such as line managers, executives, system owners or a security steering group. Each recipient needs a reason to act on what they see. Confirm whether the feedback goes to the people who can change staffing or access, since a report that reaches no decision-maker does not meet the intent of the control.

Contractors and third-party personnel

Contractors, managed service staff and vendors often hold privileged access but may complete training in their employer's system. Confirm in the contract or access agreement whether their training results are reported to your organization and at what frequency. If they are excluded, record that as a scoping decision and check how their access is covered under other controls.

Defined frequency and reporting scope

AT-6 requires feedback at a frequency the organization defines, and that frequency must be set for each recipient group. Confirm which training results are included, such as completion, assessment scores or overdue assignments, and whether the report covers one system or the whole organization. Write these values into the procedure so an assessor can compare the report against them.

How an assessor tests AT-6 under SP 800-53A

This table breaks down the single AT-6 determination statement in SP 800-53A into the examine, interview and test methods and the objects each one draws on. Read it as a checklist of what evidence an assessor will ask for and where a feedback program typically falls short.

Assessment element	What the assessor does	Evidence that passes	Common finding
Determination statement (AT-06_ODP[01] and AT-06_ODP[02])	Confirms the organization defined who receives training feedback and how often it is provided	Written values for the recipients and frequency, recorded in the training policy or security plan	Recipients or frequency left undefined, so the control cannot be measured
Examine: training policy and procedures	Reads the policy and the procedures addressing training records for a feedback step tied to AT-6	Procedures that name the feedback report, its owner, its audience and its cadence	Procedures describe training records but say nothing about feedback to managers
Examine: training records and security plan	Samples records and checks the plan for the documented feedback process	Dated feedback reports on training results, plus a plan entry that matches the defined parameters	Feedback reports exist for some periods only, or the plan and practice disagree
Interview: personnel with training record retention responsibilities	Asks who produces the feedback, who receives it and how failures are escalated	Consistent answers from record owners and the named recipients, with examples of past feedback	Record owners cannot describe the feedback step or do not know the recipients
Test: mechanisms supporting training record management	Observes the system that stores or reports training results and checks it can produce feedback output	Reports generated from the learning or records system that show completion and failure results by role	Results can be read per learner but no report can be produced for the defined recipients
Link from failures to critical roles	Checks whether a failure by a person in a critical role triggers feedback to senior managers	Escalation rule or report filter that flags critical-role failures and routes them to the defined managers	Feedback goes to a general audience, so failures in critical roles are not visible to senior managers
Feedback delivery	Checks that feedback was actually sent at the defined frequency, not only designed	Distribution logs, meeting minutes or signed acknowledgments tied to each feedback cycle	Feedback is planned in the procedure but never delivered

Implementing AT-6 in five steps

This sequence turns AT-6 from a policy sentence into a recurring feedback loop: defined recipients receive training results on a defined schedule, and failures in critical roles reach senior managers who record what they did about them.

Set the two organization-defined parameters
AT-6 leaves two values to the organization: who receives training feedback and how often it is delivered. The control owner, usually the security awareness lead working with HR and the CISO, proposes named recipients by role, such as the CISO, the business owner of each critical function and the head of the relevant line of business, and proposes a frequency. The decision is written into the AT-6 entry of the system security plan and approved by the accountable senior official. Done means a signed parameter decision that an assessor can match to the control text and the parameter identifiers used in SP 800-53A.
Define training results and critical role failures
Before any report exists, the organization must state what a training result is and what counts as a failure in a critical role. Typical inputs are completion status, assessment scores, failed attempts, overdue mandatory courses and role-based training that was not finished before access was granted. The control owner agrees these definitions with the role owners, so a failure means the same thing to the training team and to the managers who receive the feedback. Done means a short definitions table approved by the owners of the critical roles, kept with the training procedures.
Produce a recurring feedback report from training records
Using the training records maintained under AT-4, the awareness team generates the feedback report at the agreed frequency. The report lists results by recipient group, flags failures in critical roles against the definitions from the previous step, and shows trends since the last cycle. Where a learning management system such as Moodle is used, its activity completion data can supply completion status, but the team must confirm which completion conditions each course uses, since completion can depend on viewing, grading or manual marking. Done means a sample report, reviewed for accuracy by someone outside the training team, saved with its data source and run date.
Route the report to named senior managers
The report goes to the recipients fixed in step one, through a channel that creates a record, such as a ticket queue, a signed memo or a governance meeting agenda. Each failure in a critical role is assigned to a named manager with a request for a response, for example retraining, reassignment of duties or a documented acceptance of the risk. The awareness team does not close these items on its own. Done means each flagged failure has an owner, a logged delivery date and a recorded response, which together form the evidence an assessor will sample.
Review the parameters after each cycle
At the end of each feedback cycle, the control owner checks whether the recipients still hold the critical roles, whether the frequency still matches the risk, and whether the failure definitions still catch what matters. Changes in personnel, new critical roles, incidents involving untrained staff and changes to the system security plan are reasons to adjust. Each change is recorded with its rationale and approved by the same senior official who signed the original decision. Done means an updated parameter decision or a documented decision to keep the current values, which keeps the control current between assessments.

How a training result becomes a senior manager decision

A training result reaches a senior manager only when three things line up: the individual records behind it are trustworthy, the role-based training that generated them is defined for the people who matter most, and someone summarizes the outcome in a form a manager can act on. AT-4 supplies the raw trail of who was trained, when and on what content. AT-3 determines which roles carry the training requirement in the first place, so a completion rate for a critical role means something only if that role was defined as needing role-based training. Feedback under AT-6 sits on top of both. Before you design the report, confirm with the owners of training records that completion data is complete for the roles you care about, since a summary built on partial records will look reassuring and tell managers very little.

Useful feedback names the roles it covers, not only the population. For example, an illustrative report might list privileged administrators, payment operations staff and incident responders separately from general staff, with each group's assessment scores and overdue training counts. It also needs explicit failure criteria agreed in advance, such as a threshold of overdue role-based training, repeated failed assessments on a critical topic, or a training gap for someone whose access has already been granted. Without those criteria, every reviewer decides for themselves what counts as a problem. Set the frequency to match how quickly a gap could matter, and record the decision that follows: who received the feedback, what they chose to do, and when the gap was closed or accepted. That documented follow-up is what an assessor will ask to see, and it is what turns a report into a management decision.

Evidence that passes an AT-6 test

An assessor testing AT-6 wants to see that feedback on training results was defined, delivered on schedule and acted on when results were poor. The cards below cover the artifacts that prove each step, from the parameter values to the management response. Keeping them current between audits matters as much as having them once.

Documented parameter values

AT-6 has two organization-defined parameters, and the organization must set their values itself. Record who receives feedback (the defined personnel) and how often it is provided (the defined frequency), and approve those values in the training policy or the security plan. Assessors compare later reports against these values, so a report that goes to the wrong audience or runs on a different schedule is an immediate finding. Confirm the exact parameter wording against the SP 800-53A procedure for AT-06 before you finalize it.

Dated sample feedback reports

Keep copies of each feedback report with its issue date, reporting period, the training results it covers and the named recipients. A report that summarizes completion rates, assessment failures and repeat failures by role is the strongest form, because it shows what senior managers actually saw. Retain at least one report for each defined frequency across the review period. Illustrative example: a quarterly summary for finance approvers that lists three users who failed a phishing assessment twice.

Delivery records

A report only counts as feedback if the defined recipients received it. Keep distribution logs, email headers, ticket records or dashboard access logs that show the date each report reached each recipient. If reports are published to a shared dashboard, capture a dated export or access record, because a dashboard that changes silently provides no evidence for a past date. Ask your auditor which delivery record format they accept before you rely on one.

Management response and actions

Feedback that reveals failures in critical roles should trigger a documented response, such as retraining, access review, reassignment or escalation. Record the decision, the owner, the due date and the closing evidence in your issue tracker or GRC tool. Assessors look for a traceable line from a reported failure to a recorded action, and an empty response column is often the finding that matters most.

Training policy and procedures

The awareness and training policy and the supporting procedures should describe the feedback process: what data is compiled, who compiles it, the defined frequency, the recipients, and how failures are escalated. Version and approve these documents, and keep the approval records. Procedures that describe a process nobody runs are a common gap, so compare them with the reports you actually produced.

Security plan entry and recurring log

The system security plan should name the AT-6 implementation, the parameter values and the responsible roles. Between audits, maintain a dated report calendar that lists each scheduled feedback report, its owner and its recipients, plus a retained log of what was sent and what was done. Reviewing this calendar at each reporting cycle keeps the evidence current, so the audit does not become a reconstruction exercise.

What meeting AT-6 costs in money and effort

This table breaks AT-6 feedback costs into components, showing who is paid for each, whether it is one-time or recurring, and what pushes it up or down. No public price or effort figures exist for AT-6, so use the table to build the questions you put to a quote and to see where self-hosted open source can remove license spend.

Cost component	One-time or recurring	Who is paid or who spends time	What drives it and how to keep it down
Learning platform or reporting licenses	Recurring	Software vendor, if training runs on a commercial learning platform	Named users and reporting modules. Self-hosted open-source learning platforms can remove this license line, but hosting and support remain
Engineering time to build feedback reports	One-time build, recurring upkeep	Internal platform team or implementation partner	Number of data sources and report formats. Reusing one scheduled report template for every critical role reduces build effort
Data pipeline and storage of training results	Recurring	Internal IT or hosting provider	How training completion and assessment data is stored and joined to role records. Clean role mapping lowers rework
Management time to review and act on feedback	Recurring, per review cycle	Senior managers and role owners in critical functions	Number of critical roles and recipients, and the defined frequency. Fewer, clearer thresholds for escalation reduce review load
Evidence upkeep	Recurring	Compliance lead or security team	Retention of feedback reports, meeting minutes and escalation records for the period your assessor will sample
External review and readiness support	Usually one-time, repeatable for reassessment	Independent assessor, or an implementation partner preparing evidence	Scope of the written readiness engagement. Ask for a fixed scope naming the roles, reports and evidence covered
Auditor sampling effort	Recurring with each assessment cycle	Independent assessor's fees, billed as agreed with the assessor	Number of feedback cycles and recipients the assessor samples. Consistent, dated reports make sampling faster

Who owns AT-6 and what a partner can prepare

Your organization owns AT-6 in full. The control asks you to give feedback on training results to defined personnel at a defined frequency, and only you can decide who those personnel are, how often feedback goes out, and what happens when training results show a problem. The parameters are organization-defined, so AT-06_ODP[01] and AT-06_ODP[02] in SP 800-53A are yours to set and justify in writing.

Parameters: Decide the defined personnel (typically senior managers and the owners of critical roles) and the defined frequency, then record both in the system security plan or the training policy.
Critical role list: Maintain the list of roles whose training failures matter most. Without it, feedback has no clear trigger.
Management response: Define what senior managers must do after receiving feedback, such as reviewing the role holder, setting remediation or documenting acceptance of risk.
Policy and procedures: Keep the awareness and training policy and procedures current so that AT-6 is traceable to an owner.
Decision records: Keep dated records of each feedback cycle and each management decision.

Confirm that a named role in your organization is accountable for the feedback cycle and that the parameter values appear in documents an assessor can examine.

Common AT-6 gaps and how to close them

What frequency should AT-6 feedback follow?

AT-6 requires the organization to define the frequency itself, so the first gap is usually a frequency nobody wrote down. Assessors look for a value that appears in the policy or procedures and matches what actually happens. Close it by setting a specific cadence, such as quarterly or after each training cycle, and recording it as the value for the organization-defined parameter that SP 800-53A labels AT-06_ODP[01]. Then have the training owner confirm each cycle that the feedback was sent on time. A frequency that exists only in a slide deck will not satisfy an examine method.

Who should receive AT-6 training feedback?

Feedback sent to the wrong audience is the most common reason the control fails in practice. AT-6 names defined personnel, so the organization must decide who receives the results, typically senior managers over critical roles and the managers who own those roles. Close the gap by writing the recipient list into the procedures, mapping each critical role to a named manager, and keeping distribution records that show the message reached them. Review the list whenever reporting lines change, because a list built from an old org chart will quietly route feedback to people who no longer own the risk.

How should an organization define failure in critical roles?

Without failure criteria, the training team decides case by case what is worth escalating, and assessors cannot tell whether the feedback reached senior managers when it mattered. Define a threshold for each critical role, such as a completion deadline missed or an assessment score below a stated pass mark, and specify the escalation action that follows. The thresholds should come from the organization's own risk decisions and training design, not from a generic benchmark. Record the criteria in the AT-6 procedures so that the decision to escalate, or not, can be traced to a rule.

Why does training feedback stop at the training team?

Feedback that stays inside the training function means the people accountable for critical roles never see that their staff are failing the training. Close the gap by adding a named senior manager as a required recipient of the summary, and by making the summary cover results by role rather than only by course. Ask the senior manager to acknowledge receipt and to record a decision or action for any role below threshold. The acknowledgment becomes evidence that the feedback was received by someone with authority to act on it.

How do training records get tied to specific roles?

Many training platforms store completions by user and course but not by job role, so an assessor asking which critical roles failed cannot get an answer without manual work. Close the gap by recording each user's role or position in the training record, and by linking the role to the courses it requires. Confirm with the platform vendor or in your own test environment that role attributes can be exported with completion data. Records that can be filtered by role let the feedback report be produced from the same source as the training records covered by AT-4.

What evidence shows that someone followed up on the feedback?

The control asks for feedback, but assessors also look for what happened after it was received, because feedback that changes nothing does not reduce risk. Close the gap by keeping a simple log that lists each escalation, the senior manager who received it, the action agreed, the owner and the date the action closed. Retain the feedback report, the distribution record and the action log together. Where the platform can export completion data, a dated export placed alongside the log gives an assessor a clear chain from result to response.

How DeployOpen prepares AT-6 feedback evidence

DeployOpen starts AT-6 work by agreeing the scope in writing before any build begins. The written scope should name the organization-defined parameters the client must set, namely who receives training feedback (for example, named senior managers or a risk committee) and how often it is delivered. Because AT-6 is not selected in any SP 800-53B baseline, the scope should also record the baseline or overlay that adds the control, so the assessor can see why it applies. DeployOpen then identifies the systems, training platform and reporting tools that hold the training results, and confirms with the client who owns each control decision.

In the client's own environment, DeployOpen configures the reporting path and assembles the evidence pack that an assessor would expect to see. For a self-hosted learning platform such as Moodle, this may involve setting activity completion conditions so that the completion data behind feedback is meaningful, documenting how results are exported, and scheduling the feedback reports. The pack typically covers the training feedback procedure, sample reports delivered to the defined personnel, records showing delivery dates and recipients, and the documented follow-up on failures in critical roles. The client should confirm which of these artifacts their assessor will accept and where the organization's own policy and records must be cross-referenced.

DeployOpen supports the client through the assessment by walking through the evidence with the client's control owners and answering the questions an examiner or interviewer is likely to ask, such as who maintains the feedback records and how failures are escalated. DeployOpen does not issue audit reports, attestations or certifications. Those come only from an independent assessor, auditor or certification body that the organization selects and engages directly. Organizations should ask any partner to state this boundary in the statement of work and should confirm with their assessor, before work starts, which evidence formats and sampling periods they will test.

AT-6 Training feedback