PR.AT-02 asks you to give extra awareness and training to people whose jobs carry more cyber risk than average, so they can do those specific tasks safely. Think finance staff approving payments, executives who are targeted by impersonation, and anyone with access to business critical data.
CSF is voluntary guidance and there is no CSF certification. The aim is a defensible answer to "who needs more than the basics, and did they get it?"
What good looks like
You have a short list of specialized roles, named by job and not by person. Each role has training that matches its real risks. Finance gets payment fraud and invoice change scenarios. Engineers with production access get secrets handling and safe change practices. Leadership gets targeted impersonation and decision making during an incident.
Contractors and third parties in those roles are included. People are tested, and refreshers happen at least yearly.
How to implement it
- Identify the roles: physical and cybersecurity staff, finance, senior leadership, anyone with access to business critical data.
- For each role, write down the two or three attacks most likely to reach it.
- Build or buy a short module per role and assign it by role in your training tool.
- Test understanding with a scenario quiz.
- Set a yearly refresher and re-run the role list when people change jobs.
Evidence to collect
- The list of specialized roles and who holds each one
- Role training content with version dates
- Assessment results and refresher dates per person
- Proof that third parties in those roles were included
Common gaps
- Everyone gets the same generic course, so the role specific risks are never covered
- Role changes are not tracked, so a new finance hire never gets the finance module
- Leaders are exempted from training
Quick check
How is PR.AT-02 different from PR.AT-01?
PR.AT-01 is the baseline for everyone. PR.AT-02 adds role specific training on top for people whose work carries more risk.
Sources
- NIST Cybersecurity Framework 2.0 (CSWP 29): https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf
- NIST CSF 2.0 Reference Tool, implementation examples for PR.AT-02: https://csrc.nist.gov/projects/cybersecurity-framework/filters
