Training is the control every auditor checks, and the one most often reduced to a completion percentage. AT-2 asks for more than that. It wants literacy training for system users, awareness techniques in between, regular content updates, and lessons from real incidents fed back in.
SP 800-53 binds US federal systems and, by contract, other organizations. For everyone else it is a reference, and training evidence appears in almost every customer questionnaire and audit. Mappings to other frameworks vary by source, so check the one you use.
What the control asks
Provide security and privacy literacy training to system users, including managers, senior executives and contractors. Give it as part of initial training for new users, and again at a frequency you set. Give it also when system changes require it or after events you define.
Use awareness techniques you choose. Update the content on a schedule and after defined events. And incorporate lessons learned from internal or external security incidents or breaches.
What it means in practice
The guidance says to offer basic and advanced levels, with measures to test what users know. Content depends on your systems, work environments such as remote work, and requirements. It should cover why security and privacy matter, what users do to protect themselves and data, how to respond to suspected incidents, operations security, and handling of personal information.
Awareness techniques it lists include posters, logon screen messages, email advisories from officials and awareness events. Refresher training can be short sessions covering recent attack methods, policy changes or a subset of the initial topics.
The enhancements show where advanced programs go: AT-2.1 Practical Exercises, AT-2.2 Insider Threat, AT-2.3 Social Engineering and Mining, AT-2.4 Suspicious Communications and Anomalous System Behavior, AT-2.5 Advanced Persistent Threat and AT-2.6 Cyber Threat Environment. Practical exercises, such as simulated phishing, are the easiest to start with.
Evidence to collect
- The training content, with a version and date.
- A roster of everyone in scope, including contractors and executives.
- Completion records per person with dates, for new starters within your set window and for the periodic cycle.
- Assessment scores or pass records, not only attendance.
- Records of content updates and what triggered them.
- Evidence that an incident led to a change in training.
- Examples of awareness material, such as emails or banners.
Common gaps
- New starters trained weeks after getting access.
- Contractors and executives left off the roster.
- Completion tracked but no test of understanding.
- Content unchanged for years.
- No link between an incident and what people are taught next.
- Evidence kept in screenshots that cannot be traced to a person and date.
How to implement it
Train people before or at the moment they get access, and put it in the onboarding checklist. Add a short assessment with a pass mark. Run a refresher on the cycle you wrote in AT-1.
After any incident, write a few lines on what went wrong and add a short lesson. Keep the roster, scores and dates in one system, so you can answer an auditor's sample request in minutes.
Collecting this evidence by hand is where programs wobble. Pulling it automatically from the tools where it already lives keeps it current and traceable.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does AT-2 cover contractors and executives?
Yes. The control names managers, senior executives and contractors as system users to train.
What must feed back into training content?
Lessons learned from internal or external security incidents or breaches.
Sources
- NIST SP 800-53 Rev 5, AT-2: https://csrc.nist.gov/projects/cprt/catalog#/cprt/framework/version/SP_800_53_5_1_1/home?element=AT-2
- NIST OSCAL catalog of SP 800-53 Rev 5: https://raw.githubusercontent.com/usnistgov/oscal-content/main/nist.gov/SP800-53/rev5/json/NIST_SP-800-53_rev5_catalog.json
