THREATNOIR
Subscribe
NIST SP 800-53 Rev. 5 · AT-2

Literacy Training and Awareness

US National Institute of Standards and Technology (NIST) · cited in 494 of our lessons

Explanation

What it asks for. Users, including managers, senior executives and contractors, must receive security and privacy literacy training when they start and at a defined frequency afterwards, as well as after relevant changes. Training should cover recognising and reporting insider threat, social engineering and similar risks, and be updated over time.

In practice. Doing this well means short, relevant training tied to real threats the organisation sees, phishing simulations with a clear reporting button, and targeted content for high-risk groups. Auditors expect completion records, the training content, and evidence that it is reviewed and updated. This lines up with CIS Control 14 and the management training duties in NIS2.

Common gaps. Common problems are an annual tick-box course with low engagement, executives exempting themselves and no measurement of behaviour change. Contractors are often missing from training records.

Open SP 800-53 at NIST
The official text
a. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): 1. As part of initial training for new users and [Assignment: organization-defined organization-defined frequency] thereafter; and 2. When required by system changes or following [Assignment: organization-defined organization-defined events]; b. Employ the following techniques to increase the security and privacy awareness of system users [Assignment: organization-defined awareness techniques]; c. Update literacy training and awareness content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events] ; and d. Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques. Discussion: Organizations provide basic and advanced levels of literacy training to system users, including measures to test the knowledge level of users. Organizations determine the content of literacy training and awareness based on specific organizational requirements, the systems to which personnel have authorized access, and work environments (e.g., telework). The content includes an understanding of the need for security and privacy as well as actions by users to maintain security and personal privacy and to respond to suspected incidents. The content addresses the need for operations security and the handling of personally identifiable information. Awareness techniques include displaying posters, offering supplies inscribed with security and privacy reminders, displaying logon screen messages, generating email advisories or notices from organizational officials, and conducting awareness events. Literacy training after the initial training described in [AT-2a.1](#at-2_smt.a.1) is conducted at a minimum frequency consistent with applicable laws, directives, regulations, and policies. Subsequent literacy training may be satisfied by one or more short ad hoc sessions and include topical information on recent attack schemes, changes to organizational security and privacy policies, revised security and privacy expectations, or a subset of topics from the initial training. Updating literacy training and awareness content on a regular basis helps to ensure that the content remains relevant. Events that may precipitate an update to literacy training and awareness content include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

From NIST SP 800-53 Rev. 5, a work of the US government in the public domain.

Lessons that cite it

Real incidents where this item mattered: the latest 12 of 494.