AT-4: Security Training Records

Control Family:

Awareness And Training


  • Low
    • AT-4
  • Moderate
    • AT-4
  • High
    • AT-4

Next Version:

Control Statement

The organization:

  1. Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and
  2. Retains individual training records for [Assignment: organization-defined time period].

Supplemental Guidance

Documentation for specialized training may be maintained by individual supervisors at the option of the organization.