Awareness and Training Policy

Awareness and Training Policy template: Ready-to-adopt Awareness and Training policy template for NIST SP 800-53 Rev. 5, with a statement group for each control and a variant per baseline (Low, Moderate, High, Privacy).

Type	Program stage	Status	Template version	NIST basis
Policy	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

The Awareness and Training policy states what the organization requires for awareness and training and who is accountable for it. It meets AT-1 through the sections every family policy shares, and adds one statement group per control. Each baseline variant includes only the controls in that baseline, taken from the NIST SP 800-53B profiles.

Adopt the ready-to-adopt edition: fill every highlighted field, delete any “Federal systems” section that does not apply, and have the accountable official approve it. The annotated edition adds guidance on why each section exists and what assessors look for.

Controls satisfied

“Yes” marks the baseline variants that include the control’s statements. AT-1 is met by the common sections.

Control	Title	Low	Moderate	High	Privacy
AT-1	Policy and Procedures	Yes	Yes	Yes	Yes
AT-2	Literacy Training and Awareness	Yes	Yes	Yes	Yes
AT-2(2)	Insider Threat	Yes	Yes	Yes
AT-2(3)	Social Engineering and Mining		Yes	Yes
AT-3	Role-based Training	Yes	Yes	Yes	Yes
AT-3(5)	Processing Personally Identifiable Information				Yes
AT-4	Training Records	Yes	Yes	Yes	Yes

Decisions to make first

The policy has 23 organization-defined parameters across all variants; each appears as a highlighted field with its typical value where one is given. Settle these first:

Decision	Controls	Typical	Who decides
Who builds and runs security and privacy training, and where are completions tracked?	AT-2, AT-3, AT-4	The security team owns security content and the privacy office owns privacy content; courses are assigned and tracked in the learning management system.	Chief Information Security Officer
What happens when someone does not complete required training on time?	AT-2, AT-3	Reminders to the person and their supervisor, then suspension of system access until the training is complete.	Chief Information Security Officer
Which roles need role-based training, and what does each role’s training cover?	AT-3	A table in the training plan listing each role with significant security or privacy duties and its courses.	Chief Information Security Officer

Record your values in the Awareness and Training decision worksheet, which lists every parameter with its typical value.

Downloads

Variant	Ready to adopt	Annotated
Low	Word · Markdown	Word · Markdown
Moderate	Word · Markdown	Word · Markdown
High	Word · Markdown	Word · Markdown
Privacy	Word · Markdown	Word · Markdown

Everything for this family in one file: AT pack (.zip), with every variant and edition of the policy and the decision worksheets.

Preview (Moderate baseline, annotated)

Guidance

The sections before and after Policy statements meet AT-1, which asks for a policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination and compliance, plus procedures, dissemination, a designated official and a review cycle. Assessors check each element, so keep every section even when it is short. Each statement cites the AT-1 item it meets. If you adopt several family policies, the same sections repeat in each; that is expected, and it lets each policy stand alone.

Purpose

This policy states what Organization name requires for Awareness and Training, and who is accountable for meeting those requirements. (AT-1a.1(a))

Scope

This policy applies at the Select one or more: organization-level; mission/business process-level; system-level Typical: organization-level to every system that Organization name owns or operates, or that is operated on its behalf, and to every person with access to those systems, including employees, contractors and partners. (AT-1a.1(a))

Roles and responsibilities

• The Chief Information Security Officer is accountable for this policy and shall approve exceptions to it. (AT-1a.1(a))
• The Fill in: an official to manage the awareness and training policy and procedures Typical: Chief Information Security Officer shall manage the development, documentation and dissemination of this policy and its procedures. (AT-1b)
• Each System owner shall implement this policy for their system and document how in the system security plan. (AT-1a.1(a))
• Each person within scope shall follow this policy and report suspected violations to the Chief Information Security Officer. (AT-1a.1(a))

Management commitment

The Senior leader approves this policy and shall provide the resources needed to implement it. (AT-1a.1(a))

Coordination

The Chief Information Security Officer shall coordinate this policy with the legal, privacy, human resources and procurement functions, and with the owners of related policies, before each approval. (AT-1a.1(a))

Compliance

• This policy shall be consistent with the laws, executive orders, directives, regulations, policies, standards and guidelines that apply to Organization name, including Fill in: laws, regulations and standards that apply to the organization. (AT-1a.1(b))
• The Chief Information Security Officer shall review compliance with this policy through the organization’s assessment and continuous monitoring activities. (AT-1a.1(a))
• An exception to this policy shall be requested in writing, approved by the Chief Information Security Officer, time-limited and recorded with its compensating measures. (AT-1a.1(a))
• Violations of this policy shall be handled through the organization’s sanctions process. (AT-1a.1(a))

Procedures

The Fill in: an official to manage the awareness and training policy and procedures Typical: Chief Information Security Officer shall ensure that documented procedures exist to implement this policy and its associated controls. (AT-1a.2)

Dissemination

• The Fill in: an official to manage the awareness and training policy and procedures Typical: Chief Information Security Officer shall disseminate this policy to Fill in: personnel or roles to whom the awareness and training policy is to be disseminated Typical: everyone within its scope, through the policy library. (AT-1a)
• The Fill in: an official to manage the awareness and training policy and procedures Typical: Chief Information Security Officer shall disseminate the procedures that implement this policy to Fill in: personnel or roles to whom the awareness and training procedures are to be disseminated Typical: the people who carry them out, and the system owners. (AT-1a)

Policy statements

Guidance

Each statement below comes from the clause for one control or enhancement in the chosen baseline. The reference at the end of each statement names the control item it meets.

Literacy training and awareness (AT-2)

Guidance

Literacy training is the course every user takes; awareness is what keeps the message alive between courses. Assessors compare completion records with account creation dates, so require the initial course before access (AC-2) and track it for employees, contractors and executives alike. The training plan sets out the courses and schedule.

• The Chief Information Security Officer shall provide security literacy training to all system users, including managers, senior executives and contractors, as part of initial training before they are given access, and Fill in: the frequency at which to provide security literacy training to system users (including managers, senior executives, and contractors) after initial training Typical: annually thereafter. (AT-2a.1)
• The Senior privacy official shall provide privacy literacy training to all system users, including managers, senior executives and contractors, as part of initial training before they are given access, and Fill in: the frequency at which to provide privacy literacy training to system users (including managers, senior executives, and contractors) after initial training Typical: annually thereafter. (AT-2a.1)
• The Chief Information Security Officer shall provide security literacy training when system changes require it, and following Fill in: events that require security literacy training for system users Typical: a significant system change, or an incident caused by user error. (AT-2a.2)
• The Senior privacy official shall provide privacy literacy training when system changes require it, and following Fill in: events that require privacy literacy training for system users Typical: a significant change in how the organization processes personally identifiable information, or a privacy breach. (AT-2a.2)
• The Chief Information Security Officer shall increase users’ security and privacy awareness through Fill in: techniques to be employed to increase the security and privacy awareness of system users Typical: phishing simulations, short awareness messages and posters. (AT-2b)
• The Chief Information Security Officer shall update literacy training and awareness content Fill in: the frequency at which to update literacy training and awareness content Typical: annually and following Fill in: events that would require literacy training and awareness content to be updated Typical: a significant incident, or a significant change in threats. (AT-2c)
• The Chief Information Security Officer shall incorporate lessons learned from internal and external security incidents and breaches into literacy training and awareness techniques. (AT-2d)

Federal systems

5 CFR 930.301 (OPM) requires that all users of federal information systems be exposed to security awareness materials at least annually, and that new employees receive awareness material before they are allowed access. 44 U.S.C. § 3554(b)(4) requires security awareness training for personnel, including contractors and other users. OMB Circular A-130 (July 28, 2016), Appendix II, section 5.g, requires mandatory agency-wide privacy awareness and training for all employees and contractors. Checked September 2026.

• The Chief Information Security Officer shall give new employees security awareness material before they are allowed access to federal information systems. (AT-2a.1)
• The Chief Information Security Officer shall expose every user of federal information systems, including contractors, to security awareness materials at least annually. (AT-2a.1)
• The Senior privacy official shall maintain mandatory privacy awareness and training for all employees and contractors, as OMB Circular A-130 Appendix II requires. (AT-2a.1)

Insider threat (AT-2(2))

Guidance

Teach users what potential insider threat indicators look like, such as attempts to get access beyond one’s job, unexplained removal of information, or ignoring security rules repeatedly, and where to report them. Keep the reporting channel the same one the insider threat program (PM-12) uses.

• The Chief Information Security Officer shall include in literacy training how to recognize and report potential indicators of insider threat. (AT-2(2))

Social engineering and mining (AT-2(3))

Guidance

Social engineering tricks people into giving up information or access, by email, phone, text or in person; social mining gathers information about the organization from public sources and social media to plan an attack. Phishing simulations (AT-2b) are a common way to practice recognizing it.

• The Chief Information Security Officer shall include in literacy training how to recognize and report potential and actual instances of social engineering and social mining. (AT-2(3))

Role-based training (AT-3)

Guidance

Role-based training goes beyond what every user learns: administrators learn secure configuration, developers secure coding, authorizing officials how to weigh risk. List each role and its courses in the training plan. The NICE Workforce Framework for Cybersecurity (SP 800-181 Rev. 1, with its components at v2.2.0 as of September 2026) describes work roles and the knowledge and skills each needs, a useful starting point for the course list. Incident response training is covered by IR-2 and contingency training by CP-3.

• The Chief Information Security Officer shall provide role-based security training to personnel with these roles and responsibilities: Fill in: roles and responsibilities for role-based security training Typical: system administrators, developers, security staff, incident responders, system owners and authorizing officials. (AT-3a)
• The Senior privacy official shall provide role-based privacy training to personnel with these roles and responsibilities: Fill in: roles and responsibilities for role-based privacy training Typical: staff who handle personally identifiable information as part of their duties, the privacy office, and owners of systems that process it. (AT-3a)
• Role-based training shall be completed before the person is authorized to access the system or information, or to perform the assigned duties, and Fill in: the frequency at which to provide role-based security and privacy training to assigned personnel after initial training Typical: annually thereafter. (AT-3a.1)
• Role-based training shall also be provided when system changes require it. (AT-3a.2)
• The Chief Information Security Officer and the Senior privacy official shall update role-based training content Fill in: the frequency at which to update role-based training content Typical: annually and following Fill in: events that require role-based training content to be updated Typical: a significant incident, a change in a role’s tools or duties, or a new legal or policy requirement. (AT-3b)
• The Chief Information Security Officer and the Senior privacy official shall incorporate lessons learned from internal and external security incidents and breaches into role-based training. (AT-3c)

Federal systems

5 CFR 930.301 (OPM) requires agencies to identify employees with significant information security responsibilities and give them role-specific training in accordance with NIST standards and guidance; refresher training as often as the agency determines necessary, based on the sensitivity of the information; and training when the system environment or procedures change significantly, or when an employee enters a position that needs more role-specific training. OMB Circular A-130, Appendix II, section 5.g, requires role-based privacy training, before access or assigned duties, for employees and contractors with privacy roles, including managers. Checked September 2026.

• The Chief Information Security Officer shall identify employees with significant information security responsibilities and give them role-specific training in accordance with NIST standards and guidance. (AT-3a)
• The Chief Information Security Officer shall provide role-specific training when an employee enters a position that requires more of it, and when the system environment or procedures change significantly. (AT-3a.2)
• The Senior privacy official shall provide role-based privacy training to employees and contractors with privacy roles, including managers, before they are authorized to access federal information or systems or to perform their duties. (AT-3a.1)

Training records (AT-4)

Guidance

Keep records in the learning management system where possible, and in the training record log for training given outside it. Monitoring means someone checks the records for overdue training and acts on it, not just that the records exist.

• The Chief Information Security Officer shall document security and privacy training activities, including literacy training, awareness activities and role-based training, for each person. (AT-4a)
• The Chief Information Security Officer shall monitor training records for training that is overdue, and report overdue training to the person’s supervisor. (AT-4a)
• The Chief Information Security Officer shall retain individual training records for Fill in: time period for retaining individual training records Typical: 3 years after completion, or longer where a law, the records retention schedule or a business need requires it. (AT-4b)

Federal systems

The NARA General Records Schedule 2.6, Employee Training Records (Transmittal 35, May 2024), item 030, covers individual employee training records: “Destroy when superseded, 3 years old, or 1 year after separation, whichever comes first, but longer retention is authorized if required for business use.” Checked September 2026.

• The Chief Information Security Officer shall retain and dispose of individual training records as GRS 2.6 item 030, or the agency’s own approved records schedule, requires. (AT-4b)

Review and update

• The Fill in: an official to manage the awareness and training policy and procedures Typical: Chief Information Security Officer shall review and update this policy Fill in: the frequency at which the current awareness and training policy is reviewed and updated Typical: annually and following Fill in: events that would require the current awareness and training policy to be reviewed and updated Typical: assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines. (AT-1c.1)
• The Fill in: an official to manage the awareness and training policy and procedures Typical: Chief Information Security Officer shall review and update the procedures that implement this policy Fill in: the frequency at which the current awareness and training procedures are reviewed and updated Typical: annually and following Fill in: events that would require procedures to be reviewed and updated Typical: the same events as the policy, and changes to the systems, tools or services the procedures describe. (AT-1c.2)

Federal systems

For federal information systems, this policy also carries out the agency’s information security responsibilities under the Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3554, Federal agency responsibilities) and OMB Circular A-130, Appendix I, Responsibilities for Protecting and Managing Federal Information Resources.

• Where the agency’s organization-wide policy sets a value for a parameter in this policy, each system shall use that value or a stricter one. (AT-1a.1(b))