Awareness and Training Decision Worksheet

Awareness and Training Decision Worksheet template: Every decision the Awareness and Training family of NIST SP 800-53 Rev. 5 forces, with typical values and who decides, per baseline, as a spreadsheet.

Type	Program stage	Status	Template version	NIST basis
Decision worksheet	Core	Draft	1.0.0	SP 800-53 release 5.2.0

What it is

Every decision the Awareness and Training family asks your organization to make before its policy and procedures can be final: the family’s key questions, then each organization-defined parameter of every AT control in the baseline, with a typical value where the Awareness and Training Policy gives one. Download the spreadsheet, fill the “Your value” column with the people who decide, and carry the values into the policy’s highlighted fields.

Typical values are starting points, not recommendations for every system. “Who decides” defaults to the role accountable for the family policy; many organizations delegate system-level values to the system owner.

Downloads

Variant	Spreadsheet
Low	CSV
Moderate	CSV
High	CSV
Privacy	CSV

Decisions (Moderate baseline)

24 decisions.

Decision	Control	Typical value	Who decides
Who builds and runs security and privacy training, and where are completions tracked?	AT-2, AT-3, AT-4	The security team owns security content and the privacy office owns privacy content; courses are assigned and tracked in the learning management system.	Chief Information Security Officer
What happens when someone does not complete required training on time?	AT-2, AT-3	Reminders to the person and their supervisor, then suspension of system access until the training is complete.	Chief Information Security Officer
Which roles need role-based training, and what does each role’s training cover?	AT-3	A table in the training plan listing each role with significant security or privacy duties and its courses.	Chief Information Security Officer
Personnel or roles to whom the awareness and training policy is to be disseminated	AT-1	Everyone within its scope, through the policy library	Chief Information Security Officer
Personnel or roles to whom the awareness and training procedures are to be disseminated	AT-1	The people who carry them out, and the system owners	Chief Information Security Officer
Select one or more: organization-level; mission/business process-level; system-level	AT-1	Organization-level	Chief Information Security Officer
An official to manage the awareness and training policy and procedures	AT-1	Chief Information Security Officer	Chief Information Security Officer
The frequency at which the current awareness and training policy is reviewed and updated	AT-1	Annually	Chief Information Security Officer
Events that would require the current awareness and training policy to be reviewed and updated	AT-1	Assessment or audit findings, security incidents or breaches, and changes in applicable laws, executive orders, directives, regulations, policies, standards or guidelines	Chief Information Security Officer
The frequency at which the current awareness and training procedures are reviewed and updated	AT-1	Annually	Chief Information Security Officer
Events that would require procedures to be reviewed and updated	AT-1	The same events as the policy, and changes to the systems, tools or services the procedures describe	Chief Information Security Officer
The frequency at which to provide security literacy training to system users (including managers, senior executives, and contractors) after initial training	AT-2	Annually	Chief Information Security Officer
The frequency at which to provide privacy literacy training to system users (including managers, senior executives, and contractors) after initial training	AT-2	Annually	Chief Information Security Officer
Events that require security literacy training for system users	AT-2	A significant system change, or an incident caused by user error	Chief Information Security Officer
Events that require privacy literacy training for system users	AT-2	A significant change in how the organization processes personally identifiable information, or a privacy breach	Chief Information Security Officer
Techniques to be employed to increase the security and privacy awareness of system users	AT-2	Phishing simulations, short awareness messages and posters	Chief Information Security Officer
The frequency at which to update literacy training and awareness content	AT-2	Annually	Chief Information Security Officer
Events that would require literacy training and awareness content to be updated	AT-2	A significant incident, or a significant change in threats	Chief Information Security Officer
Roles and responsibilities for role-based security training	AT-3	System administrators, developers, security staff, incident responders, system owners and authorizing officials	Chief Information Security Officer
Roles and responsibilities for role-based privacy training	AT-3	Staff who handle personally identifiable information as part of their duties, the privacy office, and owners of systems that process it	Chief Information Security Officer
The frequency at which to provide role-based security and privacy training to assigned personnel after initial training	AT-3	Annually	Chief Information Security Officer
The frequency at which to update role-based training content	AT-3	Annually	Chief Information Security Officer
Events that require role-based training content to be updated	AT-3	A significant incident, a change in a role’s tools or duties, or a new legal or policy requirement	Chief Information Security Officer
Time period for retaining individual training records	AT-4	3 years after completion, or longer where a law, the records retention schedule or a business need requires it	Chief Information Security Officer