AT-4

AT-4: Security Training Records

The organization:

a: Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and

Documentation for specialized training may be maintained by individual supervisors at the option of the organization.

Overlays
Privacy (CNSSI 1253), Privacy (High), Privacy (Low), Privacy (Mod), Privacy (PHI)

CSF Categories
None

The controls below (if any) were marked by NIST as being related to AT-4.

Control	Description
AT-2	The organization provides basic security awareness training to information system users (including managers, senior executives, and contractors): a: As part of initial training for new users; b: When required by information system changes; and c: [organization-defined frequency] thereafter.
AT-3	The organization provides role-based security training to personnel with assigned security roles and responsibilities: a: Before authorizing access to the information system or performing assigned duties; b: When required by information system changes; and c: [organization-defined frequency] thereafter.
PM-14	The organization: a: Implements a process for ensuring that organizational plans for conducting security testing, training, and monitoring activities associated with organizational information systems: 1: Are developed and maintained; and 2: Continue to be executed in a timely manner; b: Reviews testing, training, and monitoring plans for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

The controls below (if any) add on to the requirements of AT-4.

Control	Description
No controls

The CCIs below are tied to AT-4.

CCI	Definition
CCI-000113	Document individual security training activities, including security awareness training and specific system security training.
CCI-000114	Monitor individual information security training activities, including security awareness training and specific security training.
CCI-001336	Retain individual training records for an organization-defined time-period.
CCI-001337	Defines the time period for retaining individual training records.