PR.AT-01 asks one thing: that everyone who uses your non-public resources has the knowledge and skills to do their ordinary tasks with cybersecurity risk in mind. "Everyone" includes employees, contractors, partners and suppliers, not only the people on payroll.
CSF is voluntary guidance. There is no CSF certification, so nobody can hand you a badge for this outcome. What you can do is show that the training exists, that people took it, and that it changed something.
What good looks like
A new person gets a short, practical session in their first week, before they have broad access. It covers the things that actually cause incidents at small companies: phishing and other social engineering, how to report something odd, acceptable use, and basic hygiene such as patching and credential handling.
Training is not a one time event. People are tested on it, and refreshers come around at least once a year. Everyone also knows the consequence of ignoring policy, for themselves and for the company, because it was said plainly.
How to implement it
- List who counts as personnel. Pull employees, contractors and any outside party with an account on your systems into one roster.
- Write a short curriculum. Four or five topics is enough: social engineering, reporting, acceptable use, passwords and credentials, patching.
- Assign it at onboarding and set a yearly refresher date.
- Add a short quiz. A passed assessment says more than a click on "complete".
- Give people one obvious place to report suspicious messages, and thank them when they do.
- Review results once a year. If most people miss the same question, fix the material.
Evidence to collect
- The roster of people in scope, with start dates
- Training content or a syllabus with a version date
- Completion and assessment records per person
- Refresher schedule and last run date
- A sample of reported suspicious messages and how they were handled
Common gaps
- Contractors and suppliers are left out because they are not on the HR system
- Completion is tracked but nobody is assessed
- The refresher date slips for a year and then nobody can say when it was last done
- Training covers theory but never says where to report
Quick check
Do we need to train contractors who only touch one system?
Yes. The outcome covers all users of your non-public resources. A shorter version scoped to what they touch is a reasonable approach.
Sources
- NIST Cybersecurity Framework 2.0 (CSWP 29): https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 Reference Tool, implementation examples for PR.AT-01: https://csrc.nist.gov/projects/cybersecurity-framework/filters
