Awareness and Training Procedure

Approval #

Revision History #

Review cycle: Every year, under the Policy and Procedure Management Policy.

1. Purpose #

The people named in this procedure use it to carry out the AT control family policy (POL-AT). It covers every control in the awareness and training family. The steps, the people responsible, and the evidence below show how the Organization meets those National Institute of Standards and Technology (NIST) SP 800-53 Rev. 5 controls. They also support the Inspector General (IG) Federal Information Security Modernization Act (FISMA) reporting metrics.

This general procedure covers every control in the AT family. A system that departs from it, or adds to it, has its own system-specific procedure for those controls.

2. Scope #

This procedure applies to every information system that the Organization operates, or that others operate for it, under the high security baseline.

2.1 CSF 2.0 Alignment #

The steps in this procedure support these NIST Cybersecurity Framework (CSF) 2.0 categories:

• PR.AT — Awareness and Training (Protect function)

3. Controls Covered #

This procedure covers the following 7 controls in the AT family:

3.1 Derived Governance Requirements #

The requirements below come from federal governance sources and apply to the AT control family. They add to the NIST SP 800-53 control requirements that the Procedure section carries out.

OMB M-25-04: FY 2025 FISMA Guidance

• The organization must apply the National Cyber Workforce and Education Strategy to build and maintain a skilled cybersecurity workforce. Training must be tracked through FISMA metrics and aligned with emerging threats. Deadline: FY 2025. (OMB M-25-04, §2)

5 CFR § 930.301: Information Systems Security Awareness Training Program

• The organization must provide security awareness training to all users before access and at least annually, and role-based training to personnel with significant information security responsibilities before they take up those duties and at least annually thereafter, identifying the roles with the National Initiative for Cybersecurity Education (NICE) Workforce Framework (NIST SP 800-181) and designing the program to NIST SP 800-50. (5 CFR § 930.301; NIST SP 800-50 Rev. 1; NIST SP 800-181 Rev. 1)
• The organization must give role-based training to executives, program and functional managers, CIOs, IT security program managers, auditors, other security personnel, and IT function managers and operators. (5 CFR § 930.301(b))

OMB M-25-32: Preventing Improper Payments and Protecting Privacy Through Do Not Pay

• The organization should give officials who take part in Do Not Pay matching programs role-based Privacy Act training every year. Deadline: Annually. (OMB M-25-32)

4. Procedure #

4.1 General Implementation Approach #

The Organization implements the AT controls in two ways: as organization-wide common controls that systems inherit, and as system-specific implementations where a system needs them. The control-specific procedures below cover each control in the Awareness and Training family.

The Common Control Provider (CCP) implements controls marked inherited for the whole Organization. The CCP and each System Owner share the work for controls marked hybrid. Each System Owner implements controls marked customer-configured for the system.

Responsible party: The Security Training Coordinator carries out the steps in this procedure unless a control-specific procedure names someone else. The System Owner is accountable for funding and completing the work. The CISO oversees the procedure and receives its performance measures. See the AT policy (POL-AT) for the role definitions.

4.2 Control-Specific Procedures #

AT-01 — Policy and Procedures #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.AT (Awareness and Training)

1. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles — to be defined]:

1. [Selection (one or more): organization-level; mission/business process-level; system-level — to be defined] awareness and training policy that:

1. Addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and
2. Is consistent with applicable laws, executive orders, directives, regulations, policies, standards, and guidelines; and

2. Procedures to facilitate the implementation of the awareness and training policy and the associated awareness and training controls;

2. Designate an [Assignment: organization-defined official — to be defined] to manage the development, documentation, and dissemination of the awareness and training policy and procedures; and
3. Review and update the current awareness and training:

1. Policy at least annually and following significant changes; and
2. Procedures at least annually and following [Assignment: organization-defined events — to be defined].

Procedure:

The policy owner the CISO designates maintains the awareness and training policy and this procedure as controlled documents with a version history. The CISO’s office schedules the review every year and opens the review in the policy library in the document management system. The policy owner collects input from the Authorizing Official, System Owners, and Information System Security Officers (ISSOs), and records the disposition of every comment before the CISO approves the revision. A major incident or a major change to applicable policy opens an out-of-cycle review that follows the same steps.

The policy owner publishes each approved revision to the internal digital resources that all personnel use. The review record shows the distribution to the Authorizing Official, System Owners, ISSOs, and key stakeholders, so the reach of each version can be shown. The policy owner archives superseded versions and does not delete them.

Evidence: the review records with comment dispositions and approvals, the published versions with their dates, the distribution records, and the archive of superseded documents.

AT-02 — Literacy Training and Awareness #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.AT (Awareness and Training)

1. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors):

1. As part of initial training for new users and at least annually thereafter; and
2. When required by system changes or following [Assignment: organization-defined events — to be defined];

2. Employ the following techniques to increase the security and privacy awareness of system users [Assignment: organization-defined awareness techniques — to be defined];
3. Update literacy training and awareness content at least annually and following [Assignment: organization-defined events — to be defined]; and
4. Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.

Procedure:

Literacy training happens during onboarding. A new user’s ticketing system access request does not complete until the learning management system (LMS) shows a passing result for the assigned course, so access and training happen in the same step. Every user then repeats the course every year. The LMS records each completion against the individual. Supervisors receive an escalation notice for anyone who is overdue, and continued non-completion ends in access suspension.

The CISO’s training staff refresh the course content every year and whenever a major change to applicable policy changes the message. They draw material from recent internal and external incidents so that the examples are real. Between courses, the staff run awareness activities continuously: broadcast announcements, physical signage in Organization spaces, internal digital resources, and awareness events. They log each activity when they deliver it.

Evidence: the completion records tied to access requests, the yearly completion roster, the content change history, and the log of awareness activities.

AT-02(2) — Insider Threat #

Baselines: Low / Moderate / High

Provide literacy training on recognizing and reporting potential indicators of insider threat.

Procedure:

The literacy course includes the insider threat module, so every user sees it before access is granted and each year after that. The training staff tailor the content by audience. General staff learn the observable indicators and the reporting path. Supervisors receive a version focused on behavioral change within their teams. A report of a potential indicator opens a restricted ticketing system record routed to the CISO’s office instead of the general queue. The CISO’s office protects the reporter’s identity throughout. Evidence: the module completion records, the current course content with the indicator and reporting material, and the restricted intake records with their dispositions.

AT-02(3) — Social Engineering and Mining #

Baselines: Moderate / High

Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining.

Procedure:

The annual literacy course delivers the social engineering content. The training staff revise it when reported attempts show a new technique in circulation. A user who suspects an approach reports it through the channel the training names. Each report opens a ticketing system record. The CISO’s staff review the record for patterns and spread, and a confirmed campaign triggers a broadcast warning to all personnel. Reports of information-gathering approaches, such as unusual questions about staff, structure, or systems, follow the same path. Evidence: the course content that shows the module, the report records with their review dispositions, and the warning announcements issued.

AT-03 — Role-based Training #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.AT (Awareness and Training)

1. Provide role-based security and privacy training to personnel with the following roles and responsibilities: [Assignment: organization-defined roles and responsibilities — to be defined]:

1. Before authorizing access to the system, information, or performing assigned duties, and at least annually thereafter; and
2. When required by system changes;

2. Update role-based training content at least annually and following [Assignment: organization-defined events — to be defined]; and
3. Incorporate lessons learned from internal or external security incidents or breaches into role-based training.

Procedure:

The CISO’s office maintains the role catalog and the training matrix in the Role-Based Training and Cybersecurity Workforce Plan (PLAN-WF-001). It maps each covered role to a curriculum aligned with the NICE Workforce Framework for Cybersecurity in NIST SP 800-181 Rev. 1. When a person is appointed to a covered role or receives privileged access, the appointment opens a ticketing system request that assigns the training. The LMS must show the training complete before the duties or the access start. The yearly refresh runs on the fiscal year. Assignments go out at the start of the cycle, supervisors follow up on completion, and the CISO’s office publishes the roster of covered personnel with their status.

A system change that alters a role’s duties generates a targeted assignment to the affected role holders. Curriculum owners revise the content every year and after a major change to applicable policy. After a significant incident, they add what the incident taught.

Evidence: the role catalog with its 5 CFR 930.301 mapping, the assignment and completion records tied to appointments, the yearly status roster, and the content revision history.

AT-03(5) — Processing Personally Identifiable Information #

Baselines: Privacy

Provide [Assignment: organization-defined personnel or roles — to be defined] with initial and [Assignment: organization-defined frequency — to be defined] training in the employment and operation of personally identifiable information processing and transparency controls.

Procedure:

Before each training cycle, the Privacy Officer updates the personally identifiable information (PII) training module and sends it to the Senior Agency Official for Privacy (SAOP) for approval. The Privacy Officer loads the approved module into the LMS and assigns it to [AT-03(5) parameter 1 — to be defined] when an account is requested and again [AT-03(5) parameter 2 — to be defined]. The Privacy Officer also assigns privacy role-based training to staff in privacy roles and Privacy Act training to Do Not Pay matching officials.

Supervisors check completion status in the LMS and follow up with staff who have not finished. The System Owner withholds PII access from a user until the LMS shows a completed course. The Privacy Officer sends completion rates to the SAOP for the FISMA metrics the Organization reports.

Evidence: the SAOP approval of the training module, the assignment and completion records in the LMS, and the completion report sent to the SAOP.

AT-04 — Training Records #

Baselines: Low / Moderate / High / Privacy CSF 2.0: PR.AT (Awareness and Training)

1. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and
2. Retain individual training records for five (5) years or 5 years after completion of a specific training program.

Procedure:

The LMS records every assignment, completion, and result against the named individual at the time it occurs. This covers literacy courses, role-based curricula, and out-of-cycle retraining. During each training cycle, the CISO’s training staff reconcile the records against the current user population, so that separations close out and new arrivals appear with their onboarding status. Supervisors view their team’s status on demand. Overdue items escalate through the ticketing system tickets until they close.

Completion data feeds the FISMA metrics submissions that Office of Management and Budget (OMB) M-25-04 requires, so the records are always ready for reporting. The training staff retain records for the periods the Organization Records Control Schedules prescribe and dispose of them under the schedule. They log each disposition.

Evidence: the individual training transcripts, the reconciliation results for each cycle, the escalation tickets, the metrics extracts, and the retention and disposition log.

5. Parameters (ODP Values) #

The following organization-defined parameters apply to controls in this family:

6. Evidence Artifacts #

Carrying out this procedure produces these records:

• Procedure execution records for AT
• Configuration documentation
• Periodic review records
• Evidence for IG FISMA metric ST.01
• Evidence for IG FISMA metric ST.25

7. Performance Measurement #

The CISO measures this procedure with the indicators below, which meet IG FISMA Level 4 (Managed and Measurable). The ISSO collects the data, and the CISO trends and reports it. When a measure moves away from its target, the CISO starts corrective action through the plan of action and milestones (POA&M) process.

8. Training Requirements #

Before they carry out the steps in this procedure, and every year after, the people who perform them must complete:

• General security awareness training, which all personnel take under POL-AT.
• Role-based training on this procedure’s steps, tools, and evidence.
• Training on the technology platforms listed under Technology Implementation, matched to their duties.

Completion is a condition of continued access. The Agency Learning Management System (LMS) holds the completion records.

9. Governance References #

• 5 CFR § 930.301: Information Systems Security Awareness Training Program — role-based training for personnel with significant security responsibilities, June 17, 2004.
• OMB Circular A-130: Managing Information as a Strategic Resource, July 28, 2016.
• Federal Information Security Modernization Act of 2014 (44 U.S.C. § 3551 et seq.), December 18, 2014.
• OMB M-16-15: Federal Cybersecurity Workforce Strategy, July 12, 2016.
• NIST SP 800-50 Rev. 1: Building a Cybersecurity and Privacy Learning Program, September 2024.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• NIST Cybersecurity Framework 2.0, February 26, 2024.
• NIST SP 800-181 Rev. 1: Workforce Framework for Cybersecurity (NICE Framework), November 2020.
• OMB M-25-04: FY 2025 Guidance on Federal Information Security and Privacy Management Requirements, January 15, 2025.
• OMB M-25-32: Preventing Improper Payments and Protecting Privacy Through Do Not Pay, August 20, 2025.
• Privacy Act of 1974 (5 U.S.C. § 552a), December 31, 1974.