AT-2 Literacy training and awareness
What the standard requires
a. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): 1. As part of initial training for new users and [organization-defined frequency] thereafter; and 2. When required by system changes or following [organization-defined events]; b. Employ the following techniques to increase the security and privacy awareness of system users [awareness techniques]; c. Update literacy training and awareness content [frequency] and following [events] ; and d. Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.
Quoted verbatim from NIST SP 800-53 Rev 5 (OSCAL catalog), which is in the public domain.
Maps to 2 controls in 2 other frameworks
| Framework | Control |
|---|---|
| HITRUST CSF v11 | 02.b.02 Information security awareness, education and training is provided |
| TISAX (VDA ISA v6) | 2.3.1 Information security awareness programme is in place |
Mappings are CMDash’s own, seeded with the product and shown on both frameworks they connect. In the product they mean evidence you attach here also counts against the controls listed above.
In CMDash this control is a row with an owner, a status, uploaded evidence kept with its full history, and an export an assessor can read.