Navigate

AT-3

AT-3: Role-based Security Training

The organization provides role-based security training to personnel with assigned security roles and responsibilities:

a: Before authorizing access to the information system or performing assigned duties;

b: When required by information system changes; and

c: [organization-defined frequency] thereafter.

Supplemental

Organizations determine the appropriate content of security training based on the assigned roles and responsibilities of individuals and the specific security requirements of organizations and the information systems to which personnel have authorized access. In addition, organizations provide enterprise architects, information system developers, software developers, acquisition/procurement officials, information system managers, system/network administrators, personnel conducting configuration management and auditing activities, personnel performing independent verification and validation activities, security control assessors, and other personnel having access to system-level software, adequate security-related technical training specifically tailored for their assigned duties. Comprehensive role-based training addresses management, operational, and technical roles and responsibilities covering physical, personnel, and technical safeguards and countermeasures. Such training can include for example, policies, procedures, tools, and artifacts for the organizational security roles defined. Organizations also provide the training necessary for individuals to carry out their responsibilities related to operations and supply chain security within the context of organizational information security programs. Role-based security training also applies to contractors providing services to federal agencies.

CIA Levels
Confidentiality	high
Integrity	high
Availability	high

Overlays
Privacy (CNSSI 1253), Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

CSF Categories
PR.AT-2, PR.AT-4, PR.AT-5

Related Controls

The controls below (if any) were marked by NIST as being related to AT-3.

Control	Description
AT-2	The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors): a: As part of initial training for new users; b: When required by information system changes; and c: [organization-defined frequency] thereafter.
AT-4	The organization: a: Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and b: Retains individual training records for [organization-defined time period].
PL-4	The organization: a: Establishes and makes readily available to individuals requiring access to the information system, the rules that describe their responsibilities and expected behavior with regard to information and information system usage; b: Receives a signed acknowledgment from such individuals, indicating that they have read, understand, and agree to abide by the rules of behavior, before authorizing access to information and the information system; c: Reviews and updates the rules of behavior [organization-defined frequency]; and d: Requires individuals who have signed a previous version of the rules of behavior to read and re-sign when the rules of behavior are revised/updated.
PS-7	The organization: a: Establishes personnel security requirements including security roles and responsibilities for third-party providers; b: Requires third-party providers to comply with personnel security policies and procedures established by the organization; c: Documents personnel security requirements; d: Requires third-party providers to notify [organization-defined personnel or roles] of any personnel transfers or terminations of third-party personnel who possess organizational credentials and/or badges, or who have information system privileges within [organization-defined time period]; and e: Monitors provider compliance.
SA-3	The organization: a: Manages the information system using [organization-defined system development life cycle] that incorporates information security considerations; b: Defines and documents information security roles and responsibilities throughout the system development life cycle; c: Identifies individuals having information security roles and responsibilities; and d: Integrates the organizational information security risk management process into system development life cycle activities.
SA-12	The organization protects against supply chain threats to the information system, system component, or information system service by employing [organization-defined security safeguards] as part of a comprehensive, defense-in-breadth information security strategy.
SA-16	The organization requires the developer of the information system, system component, or information system service to provide [organization-defined training] on the correct use and operation of the implemented security functions, controls, and/or mechanisms.

Enhancements

The controls below (if any) add on to the requirements of AT-3.

Control	Description
AT-3(1)	The organization provides [organization-defined personnel or roles] with initial and [organization-defined frequency] training in the employment and operation of environmental controls.
AT-3(2)	The organization provides [organization-defined personnel or roles] with initial and [organization-defined frequency] training in the employment and operation of physical security controls.
AT-3(3)	The organization includes practical exercises in security training that reinforce training objectives.
AT-3(4)	The organization provides training to its personnel on [organization-defined indicators of malicious code] to recognize suspicious communications and anomalous behavior in organizational information systems.

Related CCIs

The CCIs below are tied to AT-3.

CCI	Definition
CCI-000108	Provide role-based security training to personnel with organization-defined roles and responsibilities before authorizing access to the system, information, or performing assigned duties.
CCI-000109	Provide role-based security training to personnel with organization-defined roles and responsibilities when required by system changes.
CCI-000110	The organization provides refresher role-based security training to personnel with assigned security roles and responsibilities in accordance with organization-defined frequency.
CCI-000111	The organization defines a frequency for providing refresher role-based security training.