AT-4

AT-4: Security Training Records

The organization:

AT-4a.: Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and

AT-4b.: Retains individual training records for [Assignment: organization-defined time period].

Documentation for specialized training may be maintained by individual supervisors at the option of the organization.

Overlays
Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

The controls below (if any) were marked by NIST as being related to AT-4.

Control	Description
AT-2	The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors): AT-2a.: As part of initial training for new users; AT-2b.: When required by information system changes; and AT-2c.: [Assignment: organization-defined frequency] thereafter.
AT-3	The organization provides role-based security training to personnel with assigned security roles and responsibilities: AT-3a.: Before authorizing access to the information system or performing assigned duties; AT-3b.: When required by information system changes; and AT-3c.: [Assignment: organization-defined frequency] thereafter.
PM-14	The organization: PM-14a.: Implements a process for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational information systems: PM-14a.1.: Are developed and maintained; and PM-14a.2.: Continue to be executed in a timely manner; PM-14b.: Reviews testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

The controls below (if any) add on to the requirements of AT-4.

Control	Description
No controls

The CCIs below are tied to AT-4.

CCI	Definition
CCI-000113	The organization documents individual information system security training activities, including basic security awareness training and specific information system security training.
CCI-000114	The organization monitors individual information system security training activities, including basic security awareness training and specific information system security training.
CCI-001336	The organization retains individual training records for an organization-defined time period.
CCI-001337	The organization defines a time period for retaining individual training records.