Assessment Objective

Determine if:

• AT-04a.
  • AT-04a.[01] information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are documented;
  • AT-04a.[02] information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training, are monitored;
• AT-04b. individual training records are retained for [Assignment: time period].

Assessment Methods

Examine

• Security and privacy awareness and training policy
• procedures addressing security and privacy training records
• security and privacy awareness and training records
• system security plan
• privacy plan
• other relevant documents or records

Interview

• Organizational personnel with information security and privacy training record retention responsibilities

Test

• Mechanisms supporting the management of security and privacy training records

Linked Issues

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final