# Awareness and Training Policy

**Template version:** 1.0.0 · **Baseline:** High · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/at/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

## Purpose

This policy states what [Organization name] requires for Awareness and Training, and who is accountable for meeting those requirements. (AT-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (AT-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (AT-1a.1(a))
- The [Fill in: an official to manage the awareness and training policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (AT-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (AT-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (AT-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (AT-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (AT-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (AT-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (AT-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (AT-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (AT-1a.1(a))

## Procedures

The [Fill in: an official to manage the awareness and training policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (AT-1a.2)

## Dissemination

- The [Fill in: an official to manage the awareness and training policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the awareness and training policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (AT-1a)
- The [Fill in: an official to manage the awareness and training policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the awareness and training procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (AT-1a)

## Policy statements

### Literacy training and awareness (AT-2)

- The [Chief Information Security Officer] shall provide security literacy training to all system users, including managers, senior executives and contractors, as part of initial training before they are given access, and [Fill in: the frequency at which to provide security literacy training to system users (including managers, senior executives, and contractors) after initial training. Typical: annually] thereafter. (AT-2a.1)
- The [Senior privacy official] shall provide privacy literacy training to all system users, including managers, senior executives and contractors, as part of initial training before they are given access, and [Fill in: the frequency at which to provide privacy literacy training to system users (including managers, senior executives, and contractors) after initial training. Typical: annually] thereafter. (AT-2a.1)
- The [Chief Information Security Officer] shall provide security literacy training when system changes require it, and following [Fill in: events that require security literacy training for system users. Typical: a significant system change, or an incident caused by user error]. (AT-2a.2)
- The [Senior privacy official] shall provide privacy literacy training when system changes require it, and following [Fill in: events that require privacy literacy training for system users. Typical: a significant change in how the organization processes personally identifiable information, or a privacy breach]. (AT-2a.2)
- The [Chief Information Security Officer] shall increase users' security and privacy awareness through [Fill in: techniques to be employed to increase the security and privacy awareness of system users. Typical: phishing simulations, short awareness messages and posters]. (AT-2b)
- The [Chief Information Security Officer] shall update literacy training and awareness content [Fill in: the frequency at which to update literacy training and awareness content. Typical: annually] and following [Fill in: events that would require literacy training and awareness content to be updated. Typical: a significant incident, or a significant change in threats]. (AT-2c)
- The [Chief Information Security Officer] shall incorporate lessons learned from internal and external security incidents and breaches into literacy training and awareness techniques. (AT-2d)

#### Federal systems

[5 CFR 930.301](https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-930/subpart-C/section-930.301) (OPM) requires that all users of federal information systems be exposed to security awareness materials at least annually, and that new employees receive awareness material before they are allowed access. [44 U.S.C. § 3554(b)(4)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim) requires security awareness training for personnel, including contractors and other users. [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf) (July 28, 2016), Appendix II, section 5.g, requires mandatory agency-wide privacy awareness and training for all employees and contractors. Checked September 2026.

- The [Chief Information Security Officer] shall give new employees security awareness material before they are allowed access to federal information systems. (AT-2a.1)
- The [Chief Information Security Officer] shall expose every user of federal information systems, including contractors, to security awareness materials at least annually. (AT-2a.1)
- The [Senior privacy official] shall maintain mandatory privacy awareness and training for all employees and contractors, as OMB Circular A-130 Appendix II requires. (AT-2a.1)

### Insider threat (AT-2(2))

- The [Chief Information Security Officer] shall include in literacy training how to recognize and report potential indicators of insider threat. (AT-2(2))

### Social engineering and mining (AT-2(3))

- The [Chief Information Security Officer] shall include in literacy training how to recognize and report potential and actual instances of social engineering and social mining. (AT-2(3))

### Role-based training (AT-3)

- The [Chief Information Security Officer] shall provide role-based security training to personnel with these roles and responsibilities: [Fill in: roles and responsibilities for role-based security training. Typical: system administrators, developers, security staff, incident responders, system owners and authorizing officials]. (AT-3a)
- The [Senior privacy official] shall provide role-based privacy training to personnel with these roles and responsibilities: [Fill in: roles and responsibilities for role-based privacy training. Typical: staff who handle personally identifiable information as part of their duties, the privacy office, and owners of systems that process it]. (AT-3a)
- Role-based training shall be completed before the person is authorized to access the system or information, or to perform the assigned duties, and [Fill in: the frequency at which to provide role-based security and privacy training to assigned personnel after initial training. Typical: annually] thereafter. (AT-3a.1)
- Role-based training shall also be provided when system changes require it. (AT-3a.2)
- The [Chief Information Security Officer] and the [Senior privacy official] shall update role-based training content [Fill in: the frequency at which to update role-based training content. Typical: annually] and following [Fill in: events that require role-based training content to be updated. Typical: a significant incident, a change in a role's tools or duties, or a new legal or policy requirement]. (AT-3b)
- The [Chief Information Security Officer] and the [Senior privacy official] shall incorporate lessons learned from internal and external security incidents and breaches into role-based training. (AT-3c)

#### Federal systems

[5 CFR 930.301](https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-930/subpart-C/section-930.301) (OPM) requires agencies to identify employees with significant information security responsibilities and give them role-specific training in accordance with NIST standards and guidance; refresher training as often as the agency determines necessary, based on the sensitivity of the information; and training when the system environment or procedures change significantly, or when an employee enters a position that needs more role-specific training. [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix II, section 5.g, requires role-based privacy training, before access or assigned duties, for employees and contractors with privacy roles, including managers. Checked September 2026.

- The [Chief Information Security Officer] shall identify employees with significant information security responsibilities and give them role-specific training in accordance with NIST standards and guidance. (AT-3a)
- The [Chief Information Security Officer] shall provide role-specific training when an employee enters a position that requires more of it, and when the system environment or procedures change significantly. (AT-3a.2)
- The [Senior privacy official] shall provide role-based privacy training to employees and contractors with privacy roles, including managers, before they are authorized to access federal information or systems or to perform their duties. (AT-3a.1)

### Training records (AT-4)

- The [Chief Information Security Officer] shall document security and privacy training activities, including literacy training, awareness activities and role-based training, for each person. (AT-4a)
- The [Chief Information Security Officer] shall monitor training records for training that is overdue, and report overdue training to the person's supervisor. (AT-4a)
- The [Chief Information Security Officer] shall retain individual training records for [Fill in: time period for retaining individual training records. Typical: 3 years after completion, or longer where a law, the records retention schedule or a business need requires it]. (AT-4b)

#### Federal systems

The NARA [General Records Schedule 2.6](https://www.archives.gov/files/records-mgmt/grs/grs02-6.pdf), Employee Training Records (Transmittal 35, May 2024), item 030, covers individual employee training records: "Destroy when superseded, 3 years old, or 1 year after separation, whichever comes first, but longer retention is authorized if required for business use." Checked September 2026.

- The [Chief Information Security Officer] shall retain and dispose of individual training records as GRS 2.6 item 030, or the agency's own approved records schedule, requires. (AT-4b)

## Review and update

- The [Fill in: an official to manage the awareness and training policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current awareness and training policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current awareness and training policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (AT-1c.1)
- The [Fill in: an official to manage the awareness and training policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current awareness and training procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (AT-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (AT-1a.1(b))