# Training Record Log

**Template version:** 1.0.0 · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/forms/training-record-log/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** Most organizations keep training records in a learning management system; this log is for training given outside it, such as instructor-led sessions, vendor courses and conference training, or for an organization with no such system. Assessors sample users and check that each has current literacy training, that people in security and privacy roles have their role-based training, and that initial training came before access. The register below is also downloadable as a CSV file.

| Organization | Log owner | Last updated | Updated by |
| --- | --- | --- | --- |
| [Organization name] | [Fill in: training administrator] | [Fill in: date] | [Fill in: name and title] |

## How to use this log

- Record each training activity each person completes: literacy training, awareness activities that are tracked individually, and role-based training (AT-4a).
- Check the log [Fill in: for example monthly] for training that is overdue or due soon, and tell the person and their supervisor (AT-4a).
- Keep each person's records for [Fill in: time period for retaining individual training records. Typical: 3 years after completion, or longer where a law, the records retention schedule or a business need requires it] (AT-4b).
- Keep the evidence of completion, such as a certificate or sign-in sheet, where the log says it is.

| Field | What to record |
| --- | --- |
| Person | Name, or employee or contractor identifier |
| Organizational unit | Where the person works |
| Role | The role that makes the training required, or "all users" |
| Training | Course or activity title and version |
| Type | Security literacy, privacy literacy, awareness, role-based security or role-based privacy |
| Reason | Initial, refresher, system change, or another event the policy names |
| Due date | When the training was due |
| Completion date | When it was completed |
| Result | Completed, passed with a score, or not completed |
| Provider | Internal, vendor or external body |
| Evidence | Where the certificate or other evidence is kept |
| Next due | When the next refresher is due |

## Register

| Person | Organizational unit | Role | Training | Type | Reason | Due date | Completion date | Result | Provider | Evidence | Next due |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: name or identifier] | [Fill in: unit] | [Fill in: role] | [Fill in: course and version] | [Fill in: type] | [Fill in: reason] | [Fill in: date] | [Fill in: date] | [Fill in: result] | [Fill in: provider] | [Fill in: location] | [Fill in: date] |