Security and Privacy Training Plan template: The organization's plan for security and privacy literacy training, awareness activities and role-based training, with audiences, courses, schedule and tracking, as SP 800-53 AT-2, AT-3 and AT-4 require.
The organization’s plan for security and privacy literacy training, awareness activities and role-based training, with audiences, courses, schedule and tracking, as SP 800-53 AT-2, AT-3 and AT-4 require.
This plan sets out how Organization name gives every system user security and privacy literacy training, keeps them aware between courses, and gives people in security and privacy roles the training their duties need. It covers employees, contractors, managers and senior executives with access to organizational systems or information.
Every user completes the courses below before being given access, and security literacy training Fill in: the frequency at which to provide security literacy training to system users (including managers, senior executives, and contractors) after initial training Typical: annually and privacy literacy training Fill in: the frequency at which to provide privacy literacy training to system users (including managers, senior executives, and contractors) after initial training Typical: annually after that (AT-2a.1).
Course
Covers
Audience
When
Length and format
Fill in: security and privacy awareness course
Fill in: for example acceptable use and the rules of behavior, passwords and multifactor authentication, phishing and social engineering (AT-2(3)), insider threat indicators (AT-2(2)), handling personally identifiable information, reporting incidents
All users
Fill in: before access, then at the refresher interval
Fill in: for example 45 minutes online, with a short test
Fill in: course
Fill in: topics
Fill in: audience
Fill in: when
Fill in: length and format
Users also receive training when system changes require it, or after the events the awareness and training policy names (AT-2a.2), for example Fill in: a new system, a change to how users sign in, or an incident caused by user error.
Between courses, the organization keeps security and privacy in view through Fill in: techniques to be employed to increase the security and privacy awareness of system users Typical: phishing simulations, short awareness messages and posters (AT-2b).
Activity
Audience
Frequency
Measure
Fill in: for example phishing simulation
Fill in: all users
Fill in: for example monthly
Fill in: for example report rate and click rate
Fill in: for example awareness newsletter or message
People in the roles below complete role-based training before being authorized to access the system or information, or to perform their duties, and Fill in: the frequency at which to provide role-based security and privacy training to assigned personnel after initial training Typical: annually after that, and when system changes require it (AT-3a).
Role
Security or privacy
Course or training
Source
Hours
Fill in: for example system administrator
Fill in: security
Fill in: for example secure configuration and privileged account use
Fill in: internal, vendor or external
Fill in: hours
Fill in: for example developer
Fill in: security
Fill in: for example secure coding
Fill in: source
Fill in: hours
Fill in: for example authorizing official
Fill in: security and privacy
Fill in: for example the RMF and risk acceptance
Fill in: source
Fill in: hours
Fill in: for example staff who handle personally identifiable information
Fill in: privacy
Fill in: for example privacy requirements and privacy controls (AT-3(5))
The Chief Information Security Officer and the Senior privacy official review and update literacy and awareness content Fill in: the frequency at which to update literacy training and awareness content Typical: annually and following Fill in: events that would require literacy training and awareness content to be updated Typical: a significant incident, or a significant change in threats (AT-2c).
They review and update role-based content Fill in: the frequency at which to update role-based training content Typical: annually (AT-3b).
Lessons learned from internal and external incidents and breaches are added to the content, with the change and its date recorded in section 9 (AT-2d, AT-3c).
Assignments and completions are recorded in Fill in: for example the learning management system, and in the training record log for training given outside it (AT-4a). Records are kept for the period the awareness and training policy sets (AT-4b).
Situation
Action
Initial training not complete
Fill in: for example no account is created
Refresher overdue
Fill in: for example reminders to the user and supervisor; access suspended after 30 days overdue
Role-based training overdue
Fill in: for example privileged access suspended until complete
Federal agencies set the schedule in sections 3 and 5 to meet 5 CFR 930.301 (OPM): awareness material for new employees before access, exposure of every user to awareness materials at least annually, role-specific training for employees with significant information security responsibilities, and training when the environment changes significantly or an employee moves into a role that needs more of it. OMB Circular A-130, Appendix II, section 5.g, adds mandatory privacy awareness and training for all employees and contractors, and role-based privacy training before access for those with privacy roles. Training records follow NARA GRS 2.6 item 030. Checked September 2026.
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.