AT-6 Training Feedback
Guidance: nonePolicy clause: noneWhat these mean
at6ctl| Baselines | Implementation level | Enhancements |
|---|---|---|
| Not in a baseline | Organization | None |
Control statement
Section titled “Control statement”Provide feedback on organizational training results to the following personnel [Assignment: organization-defined frequency]: [Assignment: organization-defined personnel].
NIST discussion
Training feedback includes awareness training results and role-based training results. Training results, especially failures of personnel in critical roles, can be indicative of a potentially serious problem. Therefore, it is important that senior managers are made aware of such situations so that they can take appropriate response actions. Training feedback supports the evaluation and update of organizational training described in AT-2b and AT-3b.
Assessment objectives (SP 800-53A)
Section titled “Assessment objectives (SP 800-53A)”Objectives and methods for AT-6
Determine if feedback on organizational training results is provided [Assignment: organization-defined frequency] to [Assignment: organization-defined personnel].
Examine: Security awareness and training policy; procedures addressing security training records; security awareness and training records; security plan; other relevant documents or records.
Interview: Organizational personnel with information security training record retention responsibilities.
Test: Mechanisms supporting the management of security training records.
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.