Training that nobody can prove did not happen, as far as an auditor is concerned. AT-4 is the control that asks you to keep the proof.
NIST SP 800-53 Rev 5 applies to US federal systems and to organizations bound by contract. Everyone else can use it as a reference when a customer asks about training evidence.
What the control asks
Two things. First, document and monitor information security and privacy training activities, covering both general awareness training and role-based training. Second, retain individual training records for a period you define.
The retention period is an organization-defined value. NIST's guidance points federal agencies to National Archives records retention schedules, and adds that records for specialized training may be kept by individual supervisors at the organization's discretion.
What it means in practice
You need a record per person, per course, that survives staff turnover and tool changes. Monitoring means someone looks at completion regularly and chases overdue people, rather than discovering gaps at audit time.
Evidence to collect
- A training roster that lists every employee and contractor in scope.
- Per person records: course name, version, completion date, and score if there is a test.
- A report of overdue or incomplete training, and the follow up it triggered.
- Your written retention period and proof that old records still exist.
- Records for role-based courses, not only the annual awareness course.
Common gaps
- Records live only in a vendor portal that you lose when the contract ends.
- Specialized training kept in a manager's inbox.
- No defined retention period.
- Leavers deleted from the roster, taking their history with them.
- Nobody reviews the overdue list.
How to implement it
Pick one system of record and export it on a schedule to storage you control. Define the retention period in policy; many organizations keep records for the length of employment plus a set number of years, but your legal and customer obligations decide the number. Assign an owner to review overdue training monthly and keep a note of what was done.
Quick check
Do records of role-based training need the same retention as awareness records?
AT-4 covers both. Use one retention rule unless you have a documented reason to split them.
