AT-3: Role-Based Security Training
Control Family:
Baselines:
- Low
- AT-3
- Moderate
- AT-3
- High
- AT-3
Next Version:
- NIST Special Publication 800-53 Revision 5:
- AT-3: Role-based Training
Control Statement
The organization provides role-based security training to personnel with assigned security roles and responsibilities:
- Before authorizing access to the information system or performing assigned duties;
- When required by information system changes; and
- [Assignment: organization-defined frequency] thereafter.
Supplemental Guidance
Organizations determine the appropriate content of security training based on the assigned roles and responsibilities of individuals and the specific security requirements of organizations and the information systems to which personnel have authorized access. In addition, organizations provide enterprise architects, information system developers, software developers, acquisition/procurement officials, information system managers, system/network administrators, personnel conducting configuration management and auditing activities, personnel performing independent verification and validation activities, security control assessors, and other personnel having access to system-level software, adequate security-related technical training specifically tailored for their assigned duties. Comprehensive role-based training addresses management, operational, and technical roles and responsibilities covering physical, personnel, and technical safeguards and countermeasures. Such training can include for example, policies, procedures, tools, and artifacts for the organizational security roles defined. Organizations also provide the training necessary for individuals to carry out their responsibilities related to operations and supply chain security within the context of organizational information security programs. Role-based security training also applies to contractors providing services to federal agencies.
Control Enhancements
AT-3(1): Environmental Controls
Baseline(s):
The organization provides [Assignment: organization-defined personnel or roles] with initial and [Assignment: organization-defined frequency] training in the employment and operation of environmental controls.
AT-3(2): Physical Security Controls
Baseline(s):
The organization provides [Assignment: organization-defined personnel or roles] with initial and [Assignment: organization-defined frequency] training in the employment and operation of physical security controls.
AT-3(3): Practical Exercises
Baseline(s):
The organization includes practical exercises in security training that reinforce training objectives.
AT-3(4): Suspicious Communications And Anomalous System Behavior
Baseline(s):
The organization provides training to its personnel on [Assignment: organization-defined indicators of malicious code] to recognize suspicious communications and anomalous behavior in organizational information systems.