AT-6 is a short control with a pointed purpose: training results should reach people who can act on them.
NIST SP 800-53 Rev 5 binds US federal systems and others by contract. For other organizations it is a reference point for what a customer might ask about.
What the control asks
Provide feedback on organizational training results to specific personnel, at a frequency you define. Both of those are organization-defined values. NIST's guidance says feedback covers awareness training and role-based training results, and that failures by people in critical roles can signal a serious problem. Senior managers should know about those so they can respond. The feedback also supports updating training under AT-2 and AT-3.
What it means in practice
A quarterly note to a security lead or leadership group is enough to start. It should say who completed what, who did not, where assessment scores were weak, and what you plan to change.
Evidence to collect
- Dated training reports sent to named recipients.
- Completion rates and assessment results by course and role.
- A list of follow up actions and who owns them.
- Evidence that results changed course content.
Common gaps
- Reports produced but never sent.
- Only completion counted, with no look at results.
- No separate view for admins and developers.
How to implement it
Set a cadence, name the recipients in policy, and use the same template each time so trends are visible.
Quick check
Who should receive the feedback?
Whoever you name in your policy. NIST leaves the recipients to you, but guidance stresses that senior managers should hear about failures by people in critical roles.
