What it covers. NIST guidance on designing, implementing and maintaining a cybersecurity and privacy learning programme. The revision replaced the earlier guide on awareness and training programmes and covers awareness, role-based training and the full programme life cycle, from needs assessment to evaluation.
In practice. Organisations analyse who needs what knowledge, deliver general awareness to all staff and deeper role-based training to groups such as administrators, developers and executives, and refresh content as threats change. Effectiveness is measured beyond completion rates, for example through behaviour and incident trends. Evidence includes a programme plan, training records, content review dates and evaluation results.
Common gaps. Typical gaps are one annual generic course for everyone, no role-based training for high-risk roles, and measuring only attendance.