Navigate

AT-2

AT-2: Security Awareness Training

The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors):

AT-2a.: As part of initial training for new users;

AT-2b.: When required by information system changes; and

AT-2c.: [Assignment: organization-defined frequency] thereafter.

Supplemental

Organizations determine the appropriate content of security awareness training and security awareness techniques based on the specific organizational requirements and the information systems to which personnel have authorized access. The content includes a basic understanding of the need for information security and user actions to maintain security and to respond to suspected security incidents. The content also addresses awareness of the need for operations security. Security awareness techniques can include, for example, displaying posters, offering supplies inscribed with security reminders, generating email advisories/notices from senior organizational officials, displaying logon screen messages, and conducting information security awareness events.

CIA Levels
Confidentiality	low
Integrity	low
Availability	low

Overlays
Classified, Int-A, Int-B, Int-C, Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

Related Controls

The controls below (if any) were marked by NIST as being related to AT-2.

Control	Description
AT-3	The organization provides role-based security training to personnel with assigned security roles and responsibilities: AT-3a.: Before authorizing access to the information system or performing assigned duties; AT-3b.: When required by information system changes; and AT-3c.: [Assignment: organization-defined frequency] thereafter.
AT-4	The organization: AT-4a.: Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and AT-4b.: Retains individual training records for [Assignment: organization-defined time period].
PL-4	The organization: PL-4a.: Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage; PL-4b.: Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system; PL-4c.: Reviews and updates the rules of behavior [Assignment: organization-defined frequency]; and PL-4d.: Requires individuals who have signed a previous version of the rules of behavior to read and re-sign when the rules of behavior are revised/updated.

Enhancements

The controls below (if any) add on to the requirements of AT-2.

Control	Description
AT-2 (1)	The organization includes practical exercises in security awareness training that simulate actual cyber attacks.
AT-2 (2)	The organization includes security awareness training on recognizing and reporting potential indicators of insider threat.

Related CCIs

The CCIs below are tied to AT-2.

CCI	Definition
CCI-000106	The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors) as part of initial training for new users.
CCI-000112	The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors) when required by information system changes.
CCI-001479	The organization provides refresher security awareness training to all information system users (including managers, senior executives, and contractors) in accordance with the organization-defined frequency.
CCI-001480	The organization defines the frequency for providing refresher security awareness training to all information system users (including managers, senior executives, and contractors).