# Awareness and Training Policy

**Template version:** 1.0.0 · **Baseline:** Moderate · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/policies/at/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The sections before and after Policy statements meet AT-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the AT-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

## Purpose

This policy states what [Organization name] requires for Awareness and Training, and who is accountable for meeting those requirements. (AT-1a.1(a))

## Scope

This policy applies at the [Select one or more: organization-level; mission/business process-level; system-level. Typical: organization-level] to every system that [Organization name] owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (AT-1a.1(a))

## Roles and responsibilities

- The [Chief Information Security Officer] is accountable for this policy and shall approve exceptions to it. (AT-1a.1(a))
- The [Fill in: an official to manage the awareness and training policy and procedures. Typical: Chief Information Security Officer] shall manage the development, documentation and dissemination of this policy and its procedures. (AT-1b)
- Each [System owner] shall implement this policy for their system and document how in the system security plan. (AT-1a.1(a))
- Each person within scope shall follow this policy and report suspected violations to the [Chief Information Security Officer]. (AT-1a.1(a))

## Management commitment

The [Senior leader] approves this policy and shall provide the resources needed to implement it. (AT-1a.1(a))

## Coordination

The [Chief Information Security Officer] shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (AT-1a.1(a))

## Compliance

- This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to [Organization name], including [Fill in: laws, regulations and standards that apply to the organization]. (AT-1a.1(b))
- The [Chief Information Security Officer] shall review compliance with this policy through the organization's assessment and continuous monitoring activities. (AT-1a.1(a))
- An exception to this policy shall be requested in writing, approved by the [Chief Information Security Officer], time-limited and recorded with its compensating measures. (AT-1a.1(a))
- Violations of this policy shall be handled through the organization's sanctions process. (AT-1a.1(a))

## Procedures

The [Fill in: an official to manage the awareness and training policy and procedures. Typical: Chief Information Security Officer] shall ensure that documented procedures exist to implement this policy and its associated controls. (AT-1a.2)

## Dissemination

- The [Fill in: an official to manage the awareness and training policy and procedures. Typical: Chief Information Security Officer] shall disseminate this policy to [Fill in: personnel or roles to whom the awareness and training policy is to be disseminated. Typical: everyone within its scope, through the policy library]. (AT-1a)
- The [Fill in: an official to manage the awareness and training policy and procedures. Typical: Chief Information Security Officer] shall disseminate the procedures that implement this policy to [Fill in: personnel or roles to whom the awareness and training procedures are to be disseminated. Typical: the people who carry them out, and the system owners]. (AT-1a)

## Policy statements

> **Guidance:** Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

### Literacy training and awareness (AT-2)

> **Guidance:** Literacy training is the course every user takes; awareness is what keeps the message alive between courses. Assessors compare completion records with account creation dates, so require the initial course before access (AC-2) and track it for employees, contractors and executives alike. The [training plan](https://kston83.github.io/nist-guide/templates/plans/security-and-privacy-training-plan/) sets out the courses and schedule.

- The [Chief Information Security Officer] shall provide security literacy training to all system users, including managers, senior executives and contractors, as part of initial training before they are given access, and [Fill in: the frequency at which to provide security literacy training to system users (including managers, senior executives, and contractors) after initial training. Typical: annually] thereafter. (AT-2a.1)
- The [Senior privacy official] shall provide privacy literacy training to all system users, including managers, senior executives and contractors, as part of initial training before they are given access, and [Fill in: the frequency at which to provide privacy literacy training to system users (including managers, senior executives, and contractors) after initial training. Typical: annually] thereafter. (AT-2a.1)
- The [Chief Information Security Officer] shall provide security literacy training when system changes require it, and following [Fill in: events that require security literacy training for system users. Typical: a significant system change, or an incident caused by user error]. (AT-2a.2)
- The [Senior privacy official] shall provide privacy literacy training when system changes require it, and following [Fill in: events that require privacy literacy training for system users. Typical: a significant change in how the organization processes personally identifiable information, or a privacy breach]. (AT-2a.2)
- The [Chief Information Security Officer] shall increase users' security and privacy awareness through [Fill in: techniques to be employed to increase the security and privacy awareness of system users. Typical: phishing simulations, short awareness messages and posters]. (AT-2b)
- The [Chief Information Security Officer] shall update literacy training and awareness content [Fill in: the frequency at which to update literacy training and awareness content. Typical: annually] and following [Fill in: events that would require literacy training and awareness content to be updated. Typical: a significant incident, or a significant change in threats]. (AT-2c)
- The [Chief Information Security Officer] shall incorporate lessons learned from internal and external security incidents and breaches into literacy training and awareness techniques. (AT-2d)

#### Federal systems

[5 CFR 930.301](https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-930/subpart-C/section-930.301) (OPM) requires that all users of federal information systems be exposed to security awareness materials at least annually, and that new employees receive awareness material before they are allowed access. [44 U.S.C. § 3554(b)(4)](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim) requires security awareness training for personnel, including contractors and other users. [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf) (July 28, 2016), Appendix II, section 5.g, requires mandatory agency-wide privacy awareness and training for all employees and contractors. Checked September 2026.

- The [Chief Information Security Officer] shall give new employees security awareness material before they are allowed access to federal information systems. (AT-2a.1)
- The [Chief Information Security Officer] shall expose every user of federal information systems, including contractors, to security awareness materials at least annually. (AT-2a.1)
- The [Senior privacy official] shall maintain mandatory privacy awareness and training for all employees and contractors, as OMB Circular A-130 Appendix II requires. (AT-2a.1)

### Insider threat (AT-2(2))

> **Guidance:** Teach users what potential insider threat indicators look like, such as attempts to get access beyond one's job, unexplained removal of information, or ignoring security rules repeatedly, and where to report them. Keep the reporting channel the same one the insider threat program (PM-12) uses.

- The [Chief Information Security Officer] shall include in literacy training how to recognize and report potential indicators of insider threat. (AT-2(2))

### Social engineering and mining (AT-2(3))

> **Guidance:** Social engineering tricks people into giving up information or access, by email, phone, text or in person; social mining gathers information about the organization from public sources and social media to plan an attack. Phishing simulations (AT-2b) are a common way to practice recognizing it.

- The [Chief Information Security Officer] shall include in literacy training how to recognize and report potential and actual instances of social engineering and social mining. (AT-2(3))

### Role-based training (AT-3)

> **Guidance:** Role-based training goes beyond what every user learns: administrators learn secure configuration, developers secure coding, authorizing officials how to weigh risk. List each role and its courses in the [training plan](https://kston83.github.io/nist-guide/templates/plans/security-and-privacy-training-plan/). The NICE Workforce Framework for Cybersecurity ([SP 800-181 Rev. 1](https://csrc.nist.gov/pubs/sp/800/181/r1/final), with its [components](https://www.nist.gov/itl/applied-cybersecurity/nice/nice-framework-resource-center/nice-framework-current-versions) at v2.2.0 as of September 2026) describes work roles and the knowledge and skills each needs, a useful starting point for the course list. Incident response training is covered by IR-2 and contingency training by CP-3.

- The [Chief Information Security Officer] shall provide role-based security training to personnel with these roles and responsibilities: [Fill in: roles and responsibilities for role-based security training. Typical: system administrators, developers, security staff, incident responders, system owners and authorizing officials]. (AT-3a)
- The [Senior privacy official] shall provide role-based privacy training to personnel with these roles and responsibilities: [Fill in: roles and responsibilities for role-based privacy training. Typical: staff who handle personally identifiable information as part of their duties, the privacy office, and owners of systems that process it]. (AT-3a)
- Role-based training shall be completed before the person is authorized to access the system or information, or to perform the assigned duties, and [Fill in: the frequency at which to provide role-based security and privacy training to assigned personnel after initial training. Typical: annually] thereafter. (AT-3a.1)
- Role-based training shall also be provided when system changes require it. (AT-3a.2)
- The [Chief Information Security Officer] and the [Senior privacy official] shall update role-based training content [Fill in: the frequency at which to update role-based training content. Typical: annually] and following [Fill in: events that require role-based training content to be updated. Typical: a significant incident, a change in a role's tools or duties, or a new legal or policy requirement]. (AT-3b)
- The [Chief Information Security Officer] and the [Senior privacy official] shall incorporate lessons learned from internal and external security incidents and breaches into role-based training. (AT-3c)

#### Federal systems

[5 CFR 930.301](https://www.ecfr.gov/current/title-5/chapter-I/subchapter-B/part-930/subpart-C/section-930.301) (OPM) requires agencies to identify employees with significant information security responsibilities and give them role-specific training in accordance with NIST standards and guidance; refresher training as often as the agency determines necessary, based on the sensitivity of the information; and training when the system environment or procedures change significantly, or when an employee enters a position that needs more role-specific training. [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix II, section 5.g, requires role-based privacy training, before access or assigned duties, for employees and contractors with privacy roles, including managers. Checked September 2026.

- The [Chief Information Security Officer] shall identify employees with significant information security responsibilities and give them role-specific training in accordance with NIST standards and guidance. (AT-3a)
- The [Chief Information Security Officer] shall provide role-specific training when an employee enters a position that requires more of it, and when the system environment or procedures change significantly. (AT-3a.2)
- The [Senior privacy official] shall provide role-based privacy training to employees and contractors with privacy roles, including managers, before they are authorized to access federal information or systems or to perform their duties. (AT-3a.1)

### Training records (AT-4)

> **Guidance:** Keep records in the learning management system where possible, and in the [training record log](https://kston83.github.io/nist-guide/templates/forms/training-record-log/) for training given outside it. Monitoring means someone checks the records for overdue training and acts on it, not just that the records exist.

- The [Chief Information Security Officer] shall document security and privacy training activities, including literacy training, awareness activities and role-based training, for each person. (AT-4a)
- The [Chief Information Security Officer] shall monitor training records for training that is overdue, and report overdue training to the person's supervisor. (AT-4a)
- The [Chief Information Security Officer] shall retain individual training records for [Fill in: time period for retaining individual training records. Typical: 3 years after completion, or longer where a law, the records retention schedule or a business need requires it]. (AT-4b)

#### Federal systems

The NARA [General Records Schedule 2.6](https://www.archives.gov/files/records-mgmt/grs/grs02-6.pdf), Employee Training Records (Transmittal 35, May 2024), item 030, covers individual employee training records: "Destroy when superseded, 3 years old, or 1 year after separation, whichever comes first, but longer retention is authorized if required for business use." Checked September 2026.

- The [Chief Information Security Officer] shall retain and dispose of individual training records as GRS 2.6 item 030, or the agency's own approved records schedule, requires. (AT-4b)

## Review and update

- The [Fill in: an official to manage the awareness and training policy and procedures. Typical: Chief Information Security Officer] shall review and update this policy [Fill in: the frequency at which the current awareness and training policy is reviewed and updated. Typical: annually] and following [Fill in: events that would require the current awareness and training policy to be reviewed and updated. Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines]. (AT-1c.1)
- The [Fill in: an official to manage the awareness and training policy and procedures. Typical: Chief Information Security Officer] shall review and update the procedures that implement this policy [Fill in: the frequency at which the current awareness and training procedures are reviewed and updated. Typical: annually] and following [Fill in: events that would require procedures to be reviewed and updated. Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe]. (AT-1c.2)

### Federal systems

For federal information systems, this policy also carries out the agency's information security responsibilities under the Federal Information Security Modernization Act of 2014 ([44 U.S.C. § 3554](https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title44-section3554&num=0&edition=prelim), Federal agency responsibilities) and [OMB Circular A-130](https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf), Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

- Where the agency's organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (AT-1a.1(b))