Training Record Log template: The record of each person's security and privacy training, literacy and role-based, with dates and results, as SP 800-53 AT-4 requires.
Record each training activity each person completes: literacy training, awareness activities that are tracked individually, and role-based training (AT-4a).
Check the log Fill in: for example monthly for training that is overdue or due soon, and tell the person and their supervisor (AT-4a).
Keep each person’s records for Fill in: time period for retaining individual training records Typical: 3 years after completion, or longer where a law, the records retention schedule or a business need requires it (AT-4b).
Keep the evidence of completion, such as a certificate or sign-in sheet, where the log says it is.
Field
What to record
Person
Name, or employee or contractor identifier
Organizational unit
Where the person works
Role
The role that makes the training required, or “all users”
Training
Course or activity title and version
Type
Security literacy, privacy literacy, awareness, role-based security or role-based privacy
Reason
Initial, refresher, system change, or another event the policy names
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.