Awareness and Training Policy

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose and Scope #

In this policy, the CISO sets the Organization’s requirements for awareness and training in every information system that the Organization operates or that others operate for it. The CISO issues the policy under these authorities:

• The Federal Information Security Modernization Act (FISMA) of 2014.
• National Institute of Standards and Technology (NIST) Special Publication 800-53 Revision 5.
• Office of Management and Budget (OMB) Circular A-130, Managing Information as a Strategic Resource.
• The OMB memoranda and Executive Orders that apply.

The Organization also uses this policy to carry out the NIST Cybersecurity Framework (CSF) 2.0, which Executive Order 13800 and OMB Circular A-130 require.

1.1 Program Objectives #

This policy covers security awareness and role-based training for the workforce. Phishing and social engineering continue to defeat technical safeguards across the federal enterprise, so trained people are part of the Organization’s defense. Every user must complete literacy training before receiving access and every year after that. Personnel in privileged and security-significant roles must complete role-based training. The Organization tracks completion in the Agency Learning Management System (LMS), and completion is a condition of continued access. The Organization must update training content to reflect current threats.

This policy applies to everyone in the program: executives who accept risk, System Owners who fund the controls, security officers who run them, and every user. By following it, the Organization meets its FISMA obligations for this control family and shows its maturity in the annual Inspector General (IG) FISMA evaluation. The Organization’s target is Level 4 (Managed and Measurable). The CISO tracks progress with the performance measures and the improvement commitments later in this policy.

1.2 CSF 2.0 Alignment #

The controls in this policy support these CSF 2.0 categories:

• PR.AT — Awareness and Training (Protect function)

These categories fall under the Protect function(s) of CSF 2.0. The Organization’s CSF 2.0 Profile maps each category to the NIST SP 800-53 controls in this policy.

This policy covers every awareness and training control in the low baseline of FIPS 200 and NIST SP 800-53B:

• AT-01 — Policy and Procedures
• AT-02 — Literacy Training and Awareness
• AT-02(2) — Insider Threat
• AT-03 — Role-based Training
• AT-03(5) — Processing Personally Identifiable Information
• AT-04 — Training Records

2. Authority and References #

The CISO issues this policy under the authority of:

• FISMA 2014 (44 U.S.C. § 3551 et seq.) — Statutory mandate for federal information security programs
• NIST SP 800-53 Rev 5 — Security and Privacy Controls for Information Systems and Organizations
• OMB Circular A-130 — Managing Information as a Strategic Resource
• OMB Circular A-123 — Management’s Responsibility for Internal Control (revised March 10, 2026)
• NIST CSF 2.0 — Cybersecurity Framework (mandated by EO 13800 and OMB Circular A-130)
• EO 13800 — Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure
• OMB M-16-15: Federal Cybersecurity Workforce Strategy, July 12, 2016.
• NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program, September 2024.
• 5 CFR § 930.301: Information Systems Security Awareness Training Program — role-based training for personnel with significant security responsibilities, June 17, 2004.

2.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the AT control family. They add to the NIST SP 800-53 control requirements in the Policy section.

OMB M-25-04: FY 2025 FISMA Guidance

• The organization must apply the National Cyber Workforce and Education Strategy to build and maintain a skilled cybersecurity workforce. Training must be tracked through FISMA metrics and aligned with emerging threats. Deadline: FY 2025. (OMB M-25-04, §2)

5 CFR § 930.301: Information Systems Security Awareness Training Program

• The organization must provide security awareness training to all users before access and at least annually, and role-based training to personnel with significant information security responsibilities before they take up those duties and at least annually thereafter, identifying the roles with the National Initiative for Cybersecurity Education (NICE) Workforce Framework (NIST SP 800-181) and designing the program to NIST SP 800-50. (5 CFR § 930.301; NIST SP 800-50 Rev. 1; NIST SP 800-181 Rev. 1)
• The organization must give role-based training to executives, program and functional managers, CIOs, IT security program managers, auditors, other security personnel, and IT function managers and operators. (5 CFR § 930.301(b))

OMB M-25-32: Preventing Improper Payments and Protecting Privacy Through Do Not Pay

• The organization should give officials who take part in Do Not Pay matching programs role-based Privacy Act training every year. Deadline: Annually. (OMB M-25-32)

3. Policy #

The Organization must implement and maintain its awareness and training controls to meet the following requirements:

AT-01 — Policy and Procedures #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.AT (Awareness and Training)

Requirement:

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] awareness and training policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the awareness and training policy and procedures; and
3. Review and update the current awareness and training:

1. Policy at least every 3 years and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Implementation guidance:

The Organization must keep an organization-level awareness and training policy and the procedures that put it into practice. The CISO must designate the officials accountable for developing, publishing, and maintaining both documents. Those officials must distribute the documents to the Authorizing Official, System Owners, Information System Security Officers (ISSOs), and the other stakeholders who carry their obligations. Distribution is part of the obligation, because a policy that no one has read governs nothing. The designated officials must review and update the policy and the procedures at least every year. They must also review both documents sooner when a major incident or a major change to applicable policy exposes a gap. Consistent with OMB M-25-04, the program aligns its content with the National Cyber Workforce and Education Strategy and reports its coverage through FISMA metrics.

AT-02 — Literacy Training and Awareness #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.AT (Awareness and Training)

Requirement:

1. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors):

1. As part of initial training for new users and at least annually thereafter; and
2. When required by system changes or following [Assignment: organization-defined events — to be defined];

2. Employ the following techniques to increase the security and privacy awareness of system users [Assignment: organization-defined awareness techniques — to be defined];
3. Update literacy training and awareness content at least annually and following [Assignment: organization-defined events — to be defined]; and
4. Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.

Implementation guidance:

Every system user, from senior executives to contractors, must complete security and privacy literacy training before receiving access to Organization information and systems. Literacy training is a condition of access because most compromises begin with a user’s action. Every user must repeat the training every year and must retrain when a system change alters what safe behavior looks like. The CISO must own the curriculum and must refresh it every year and after a major change to applicable policy. The CISO must add lessons learned from internal and external incidents while they are still current. Between courses, the program must reinforce awareness through broadcast announcements, physical signage, internal digital resources, and awareness events. Supervisors must not let staff whose training has lapsed keep their access. The Organization tracks completion rates through FISMA metrics, as OMB M-25-04 directs.

AT-02(2) — Insider Threat #

Baselines: Low / Moderate / High

Requirement:

Provide literacy training on recognizing and reporting potential indicators of insider threat.

Implementation guidance:

Literacy training must teach every user to recognize the warning signs of insider risk and exactly where to report a concern. The warning signs include requests for access beyond job need, hostile or coercive conduct toward colleagues, and sudden and sustained disaffection. The CISO must keep the insider threat module in the core curriculum. Supervisors must receive material on how change within a team looks from the supervisor’s position. The training itself must name the reporting channels. The CISO’s office must handle every report through those channels without retaliation.

AT-03 — Role-based Training #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.AT (Awareness and Training)

Requirement:

1. Provide role-based security and privacy training to personnel with the following roles and responsibilities: [Assignment: organization-defined roles and responsibilities — to be defined]:

1. Before authorizing access to the system, information, or performing assigned duties, and at least annually thereafter; and
2. When required by system changes;

2. Update role-based training content at least annually and following [Assignment: organization-defined events — to be defined]; and
3. Incorporate lessons learned from internal or external security incidents or breaches into role-based training.

Implementation guidance:

The CISO must keep a role catalog that maps each role group in 5 CFR 930.301 to Organization roles. The covered groups are executives and Authorizing Officials; program and functional managers and System Owners; and the Chief Information Officer (CIO), CISO, Information System Security Manager (ISSM), and ISSO. They also include auditors and Security Control Assessors; system and network administrators and other privileged users; developers; and incident responders. People in these roles must complete role-based security and privacy training before they take on the duty or the access it carries. They must repeat the training every year. When a system change alters a role’s responsibilities, the affected role holders must retrain without waiting for the yearly cycle. The CISO must update the content every year and after a major change to applicable policy, and must build incident lessons learned into the material. Consistent with OMB M-25-04, the Organization tracks role-based training through FISMA metrics. The supervisor is accountable when a person holds a covered role with lapsed training. The Role-Based Training and Cybersecurity Workforce Plan (PLAN-WF-001) sets the training matrix, the hours for each role, and the steps when training is late.

AT-03(5) — Processing Personally Identifiable Information #

Baselines: Privacy

Requirement:

Provide [Assignment: organization-defined personnel or roles — to be defined] with initial and [Assignment: organization-defined frequency — to be defined] training in the employment and operation of personally identifiable information processing and transparency controls.

Implementation guidance:

The Organization must train its people on how it handles personally identifiable information (PII). The Senior Agency Official for Privacy (SAOP) must approve the training content. [AT-03(5) parameter 1 — to be defined] must complete this training before they receive access to PII and again [AT-03(5) parameter 2 — to be defined]. The training must cover the legal authority for each collection, the purposes for which the Organization may use PII, and the notices that tell individuals about that use. Staff in privacy roles, such as Privacy Officers and System Owners of systems that hold PII, must also complete privacy role-based training. Officials who take part in Do Not Pay matching programs must complete Privacy Act training every year, per OMB M-25-32.

AT-04 — Training Records #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.AT (Awareness and Training)

Requirement:

1. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and
2. Retain individual training records for at least one (1) year or 1 year after completion of a specific training program.

Implementation guidance:

The Organization must document every literacy and role-based training activity: who was assigned, who completed it, when, and with what result. The CISO must monitor those records so that they stay current, and must not simply file them away. The CISO must own the training record system, the LMS, and the completion reporting that feeds FISMA metrics under OMB M-25-04. The CISO must retain individual training records for the periods that the Organization Records Control Schedules set and must dispose of them under the schedule, not for convenience. Supervisors must be able to see their staff’s training status at any time. A record that no one consults protects no one.

4. Roles and Responsibilities #

These roles apply across this policy. Each System Owner records the system-specific assignments in the system’s System Security and Privacy Plan (SSPP).

5. Performance Measurement #

The CISO manages this policy with the measures below, which meet the IG FISMA maturity model’s Level 4 (Managed and Measurable) criteria. The CISO collects and trends the measures and reports them to the CIO and the Authorizing Officials. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

The CISO keeps the measurement data for the annual IG FISMA evaluation and for trend analysis across reporting periods.

6. Compliance and Enforcement #

Every employee, contractor, and other user with access to an information system that the Organization operates, or that others operate for it, must comply with this policy. The CISO records each case of non-compliance as a finding in the Organization’s continuous monitoring program. The ISSO tracks the finding to resolution as a POA&M item, as OMB Circular A-130 and NIST SP 800-37 Rev. 2 describe.

A violation of this policy can lead to suspension of system access, withdrawal of the system’s authorization to operate (ATO), and administrative or disciplinary action under applicable law, regulation, and human capital policy.

The Inspector General assesses the maturity of awareness and training controls each year through the IG FISMA reporting metrics. The target maturity level for this policy area is Level 4: Managed and Measurable.

7. Continuous Improvement #

Level 4 is the minimum the Organization aims for. To meet the IG FISMA maturity model’s Level 5 (Optimized) criteria, the CISO improves awareness and training through these commitments:

1. Review the performance measures in this document at least annually; where a measure has met its target for four consecutive periods, tighten the target or replace the measure with a more demanding indicator.
2. Conduct an annual effectiveness review of this policy area using IG FISMA audit results, assessment findings, incident data, and metric trends; document resulting changes in the revision history.
3. Feed lessons learned from incidents, assessments, and exercises into updates of this document and its procedures within 90 days of the triggering event.
4. Benchmark against the IG FISMA maturity model annually and maintain a documented plan to reach and sustain Level 4 (Managed and Measurable), with a roadmap toward Level 5 (Optimized).
5. Adapt training assignments dynamically from phishing simulation and incident data, targeting content to observed weaknesses by role.

8. Exceptions and Waivers #

The CISO may grant an exception to this policy only when compliance is not technically feasible or would harm the mission. To request one, the System Owner sends the CISO a written request that includes:

1. A business justification and a risk assessment.
2. Compensating controls that reduce the risk the exception creates, following the NIST SP 800-53B guidance on compensating controls.
3. A proposed end date no more than one year away.

The CISO decides each request in coordination with the Authorizing Official. An exception that involves privacy risk also needs the agreement of the Senior Agency Official for Privacy (SAOP). The CISO re-evaluates each exception when it comes up for renewal. The System Owner records each approved exception in the system’s SSPP, and the ISSO tracks it as a POA&M item.

9. References #

These are the sources this document cites, with a link to each official text.

• 5 CFR § 930.301: Information Systems Security Awareness Training Program — role-based training for personnel with significant security responsibilities, June 17, 2004.
• Executive Order 13800: Strengthening the Cybersecurity of Federal Networks and Critical Infrastructure, May 11, 2017.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• FIPS 200: Minimum Security Requirements for Federal Information and Information Systems, March 2006.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-37 Rev. 2: Risk Management Framework for Information Systems and Organizations, December 2018.
• NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program, September 2024.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST SP 800-53B: Control Baselines for Information Systems and Organizations, September 2020.
• NIST SP 800-181 Rev. 1: Workforce Framework for Cybersecurity (NICE Framework), November 2020.
• OMB Circular A-123: Management’s Responsibility for Internal Control, March 10, 2026.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• OMB M-16-15: Federal Cybersecurity Workforce Strategy, July 12, 2016.
• OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements, January 15, 2025.
• OMB M-25-32: Preventing Improper Payments and Protecting Privacy Through Do Not Pay, August 20, 2025.
• Privacy Act of 1974 (5 U.S.C. § 552a), December 31, 1974.