ComplianceNIST 800-53 control

NIST-AT-2 Literacy Training and Awareness

Official page ↗
Framework
NIST SP 800-53 rev5 (5.2.0)
Family
AT Awareness and Training
Control
AT-2

Control statement

a. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): 1. As part of initial training for new users and [Assignment: organization-defined frequency] thereafter; and 2. When required by system changes or following [Assignment: organization-defined events]; b. Employ the following techniques to increase the security and privacy awareness of system users [Assignment: awareness techniques]; c. Update literacy training and awareness content [Assignment: frequency] and following [Assignment: events] ; and d. Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.

Discussion

Organizations provide basic and advanced levels of literacy training to system users, including measures to test the knowledge level of users. Organizations determine the content of literacy training and awareness based on specific organizational requirements, the systems to which personnel have authorized access, and work environments (e.g., telework). The content includes an understanding of the need for security and privacy as well as actions by users to maintain security and personal privacy and to respond to suspected incidents. The content addresses the need for operations security and the handling of personally identifiable information. Awareness techniques include displaying posters, offering supplies inscribed with security and privacy reminders, displaying logon screen messages, generating email advisories or notices from organizational officials, and conducting awareness events. Literacy training after the initial training described in [AT-2a.1](#at-2_smt.a.1) is conducted at a minimum frequency consistent with applicable laws, directives, regulations, and policies. Subsequent literacy training may be satisfied by one or more short ad hoc sessions and include topical information on recent attack schemes, changes to organizational security and privacy policies, revised security and privacy expectations, or a subset of topics from the initial training. Updating literacy training and awareness content on a regular basis helps to ensure that the content remains relevant. Events that may precipitate an update to literacy training and awareness content include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

Related

Related control · Compliance (17)

  • NIST-AC-17 Remote Access NIST 800-53 control
  • NIST-AC-22 Publicly Accessible Content NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AT-3 Role-based Training NIST 800-53 control
  • NIST-AT-4 Training Records NIST 800-53 control
  • NIST-CP-3 Contingency Training NIST 800-53 control
  • NIST-IA-4 Identifier Management NIST 800-53 control
  • NIST-IR-2 Incident Response Training NIST 800-53 control
  • NIST-IR-7 Incident Response Assistance NIST 800-53 control
  • NIST-IR-9 Information Spillage Response NIST 800-53 control
  • NIST-PL-4 Rules of Behavior NIST 800-53 control
  • NIST-PM-13 Security and Privacy Workforce NIST 800-53 control
  • NIST-PM-21 Accounting of Disclosures NIST 800-53 control
  • NIST-PS-7 External Personnel Security NIST 800-53 control
  • NIST-PT-2 Authority to Process Personally Identifiable Information NIST 800-53 control
  • NIST-SA-16 Developer-provided Training NIST 800-53 control
  • NIST-SA-8 Security and Privacy Engineering Principles NIST 800-53 control

Referenced by Compliance · enhancement of (6)

  • NIST-AT-2(1) Practical Exercises NIST 800-53 enhancement
  • NIST-AT-2(2) Insider Threat NIST 800-53 enhancement
  • NIST-AT-2(3) Social Engineering and Mining NIST 800-53 enhancement
  • NIST-AT-2(4) Suspicious Communications and Anomalous System Behavior NIST 800-53 enhancement
  • NIST-AT-2(5) Advanced Persistent Threat NIST 800-53 enhancement
  • NIST-AT-2(6) Cyber Threat Environment NIST 800-53 enhancement

Referenced by Compliance · has member (1)

  • NIST-AT Awareness and Training NIST 800-53 family

Referenced by Compliance · related control (19)

  • NIST-AC-17(6) Protection of Mechanism Information NIST 800-53 enhancement
  • NIST-AC-22 Publicly Accessible Content NIST 800-53 control
  • NIST-AC-3 Access Enforcement NIST 800-53 control
  • NIST-AT-3 Role-based Training NIST 800-53 control
  • NIST-AT-4 Training Records NIST 800-53 control
  • NIST-CP-3 Contingency Training NIST 800-53 control
  • NIST-IA-4(1) Prohibit Account Identifiers as Public Identifiers NIST 800-53 enhancement
  • NIST-IR-2 Incident Response Training NIST 800-53 control
  • NIST-IR-7 Incident Response Assistance NIST 800-53 control
  • NIST-IR-9(2) Training NIST 800-53 enhancement
  • NIST-PL-4 Rules of Behavior NIST 800-53 control
  • NIST-PM-12 Insider Threat Program NIST 800-53 control
  • NIST-PM-13 Security and Privacy Workforce NIST 800-53 control
  • NIST-PM-14 Testing, Training, and Monitoring NIST 800-53 control
  • NIST-PM-23 Data Governance Body NIST 800-53 control
  • NIST-PS-7 External Personnel Security NIST 800-53 control
  • NIST-RA-3(3) Dynamic Threat Awareness NIST 800-53 enhancement
  • NIST-SA-16 Developer-provided Training NIST 800-53 control
  • NIST-SA-8(32) Sufficient Documentation NIST 800-53 enhancement