# Security and Privacy Training Plan

**Template version:** 1.0.0 · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/plans/security-and-privacy-training-plan/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The training plan turns the awareness and training policy into a schedule: who gets which course, when, how completion is tracked, and how content stays current. Keep it short and keep the course tables accurate; assessors test it by picking a few users and roles and checking their records against it. It also serves as the organization's training plan under PM-14. [NIST SP 800-50 Rev. 1](https://csrc.nist.gov/pubs/sp/800/50/r1/final), Building a Cybersecurity and Privacy Learning Program (September 2024, current as of September 2026), describes how to plan, build and run such a program; it replaced SP 800-50 (2003) and SP 800-16.

| Plan owner | Approved by | Version | Effective date |
| --- | --- | --- | --- |
| [Chief Information Security Officer] | [Fill in: name and title] | [Fill in: version] | [Fill in: date] |

## 1. Purpose and scope

This plan sets out how [Organization name] gives every system user security and privacy literacy training, keeps them aware between courses, and gives people in security and privacy roles the training their duties need. It covers employees, contractors, managers and senior executives with access to organizational systems or information.

## 2. Roles

| Role | Responsibilities |
| --- | --- |
| [Chief Information Security Officer] | Owns this plan and the security content; reports completion |
| [Senior privacy official] | Owns the privacy content and privacy role-based training |
| [Human resources office] | Tells the training team about new hires, role changes and departures |
| [Supervisor] | Makes sure their staff complete training on time |
| [Account manager] | Checks that initial training is complete before creating an account |
| [Fill in: training administrator, for example the learning management system team] | Assigns courses, sends reminders and keeps the training records |

## 3. Literacy training for all users

Every user completes the courses below before being given access, and security literacy training [Fill in: the frequency at which to provide security literacy training to system users (including managers, senior executives, and contractors) after initial training. Typical: annually] and privacy literacy training [Fill in: the frequency at which to provide privacy literacy training to system users (including managers, senior executives, and contractors) after initial training. Typical: annually] after that (AT-2a.1).

| Course | Covers | Audience | When | Length and format |
| --- | --- | --- | --- | --- |
| [Fill in: security and privacy awareness course] | [Fill in: for example acceptable use and the rules of behavior, passwords and multifactor authentication, phishing and social engineering (AT-2(3)), insider threat indicators (AT-2(2)), handling personally identifiable information, reporting incidents] | All users | [Fill in: before access, then at the refresher interval] | [Fill in: for example 45 minutes online, with a short test] |
| [Fill in: course] | [Fill in: topics] | [Fill in: audience] | [Fill in: when] | [Fill in: length and format] |

Users also receive training when system changes require it, or after the events the awareness and training policy names (AT-2a.2), for example [Fill in: a new system, a change to how users sign in, or an incident caused by user error].

## 4. Awareness activities

Between courses, the organization keeps security and privacy in view through [Fill in: techniques to be employed to increase the security and privacy awareness of system users. Typical: phishing simulations, short awareness messages and posters] (AT-2b).

| Activity | Audience | Frequency | Measure |
| --- | --- | --- | --- |
| [Fill in: for example phishing simulation] | [Fill in: all users] | [Fill in: for example monthly] | [Fill in: for example report rate and click rate] |
| [Fill in: for example awareness newsletter or message] | [Fill in: all users] | [Fill in: for example monthly] | [Fill in: measure, if any] |

## 5. Role-based training

People in the roles below complete role-based training before being authorized to access the system or information, or to perform their duties, and [Fill in: the frequency at which to provide role-based security and privacy training to assigned personnel after initial training. Typical: annually] after that, and when system changes require it (AT-3a).

| Role | Security or privacy | Course or training | Source | Hours |
| --- | --- | --- | --- | --- |
| [Fill in: for example system administrator] | [Fill in: security] | [Fill in: for example secure configuration and privileged account use] | [Fill in: internal, vendor or external] | [Fill in: hours] |
| [Fill in: for example developer] | [Fill in: security] | [Fill in: for example secure coding] | [Fill in: source] | [Fill in: hours] |
| [Fill in: for example authorizing official] | [Fill in: security and privacy] | [Fill in: for example the RMF and risk acceptance] | [Fill in: source] | [Fill in: hours] |
| [Fill in: for example staff who handle personally identifiable information] | [Fill in: privacy] | [Fill in: for example privacy requirements and privacy controls (AT-3(5))] | [Fill in: source] | [Fill in: hours] |

## 6. Keeping content current

- The [Chief Information Security Officer] and the [Senior privacy official] review and update literacy and awareness content [Fill in: the frequency at which to update literacy training and awareness content. Typical: annually] and following [Fill in: events that would require literacy training and awareness content to be updated. Typical: a significant incident, or a significant change in threats] (AT-2c).
- They review and update role-based content [Fill in: the frequency at which to update role-based training content. Typical: annually] (AT-3b).
- Lessons learned from internal and external incidents and breaches are added to the content, with the change and its date recorded in section 9 (AT-2d, AT-3c).

## 7. Tracking and records

Assignments and completions are recorded in [Fill in: for example the learning management system], and in the [training record log](https://kston83.github.io/nist-guide/templates/forms/training-record-log/) for training given outside it (AT-4a). Records are kept for the period the awareness and training policy sets (AT-4b).

| Situation | Action |
| --- | --- |
| Initial training not complete | [Fill in: for example no account is created] |
| Refresher overdue | [Fill in: for example reminders to the user and supervisor; access suspended after 30 days overdue] |
| Role-based training overdue | [Fill in: for example privileged access suspended until complete] |

## 8. Measures

| Measure | Target | Reported to | Frequency |
| --- | --- | --- | --- |
| Users with current literacy training | [Fill in: for example 100 percent; 95 percent within the reporting month] | [Fill in: role] | [Fill in: for example monthly] |
| Role-based training current, by role | [Fill in: target] | [Fill in: role] | [Fill in: frequency] |
| Phishing simulation report rate | [Fill in: target] | [Fill in: role] | [Fill in: frequency] |

### Federal systems

Federal agencies set the schedule in sections 3 and 5 to meet [5 CFR 930.301](https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-930/subpart-C/section-930.301) (OPM): awareness material for new employees before access, exposure of every user to awareness materials at least annually, role-specific training for employees with significant information security responsibilities, and training when the environment changes significantly or an employee moves into a role that needs more of it. [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix II, section 5.g, adds mandatory privacy awareness and training for all employees and contractors, and role-based privacy training before access for those with privacy roles. Training records follow NARA [GRS 2.6](https://www.archives.gov/files/records-mgmt/grs/grs02-6.pdf) item 030. Checked September 2026.

## 9. Approval and change history

| Name | Title | Signature | Date |
| --- | --- | --- | --- |
| [Fill in: name] | [Chief Information Security Officer] | | [Fill in: date] |
| [Fill in: name] | [Senior privacy official] | | [Fill in: date] |

| Version | Date | Change | Approved by |
| --- | --- | --- | --- |
| [Fill in: version] | [Fill in: date] | [Fill in: summary of change] | [Fill in: name and title] |