BaselineWatch
1196 requirements
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

NIST SP 800-53 (controls) 5.2.0

1196 requirements · published 2026-10-22
Changes in this version
AllACATAUCACMCPIAIRMAMPPEPLPMPSPTRASASCSISR
RefTitleText
AT-01 Policy and Procedures a. Develop, document, and disseminate to [Assignment: organization-defined personnel or roles]: 1. [Selection (one or more): organization-level; mission/business process-level; system-level] awareness and training policy that: (a) Addresses
AT-02 Literacy Training and Awareness a. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): 1. As part of initial training for new users and [Assignment: organization-defined frequency] thereafter; and 2. Whe
AT-02(01)
in AT-2
 Practical Exercises Provide practical exercises in literacy training that simulate events and incidents.
AT-02(02)
in AT-2
 Insider Threat Provide literacy training on recognizing and reporting potential indicators of insider threat.
AT-02(03)
in AT-2
 Social Engineering and Mining Provide literacy training on recognizing and reporting potential and actual instances of social engineering and social mining.
AT-02(04)
in AT-2
 Suspicious Communications and Anomalous System Behavior Provide literacy training on recognizing suspicious communications and anomalous behavior in organizational systems using [Assignment: indicators of malicious code].
AT-02(05)
in AT-2
 Advanced Persistent Threat Provide literacy training on the advanced persistent threat.
AT-02(06)
in AT-2
 Cyber Threat Environment (a) Provide literacy training on the cyber threat environment; and (b) Reflect current cyber threat information in system operations.
AT-03 Role-based Training a. Provide role-based security and privacy training to personnel with the following roles and responsibilities: [Assignment: organization-defined roles and responsibilities]: 1. Before authorizing access to the system, information, or perfo
AT-03(01)
in AT-3
 Environmental Controls Provide [Assignment: personnel or roles] with initial and [Assignment: frequency] training in the employment and operation of environmental controls.
AT-03(02)
in AT-3
 Physical Security Controls Provide [Assignment: personnel or roles] with initial and [Assignment: frequency] training in the employment and operation of physical security controls.
AT-03(03)
in AT-3
 Practical Exercises Provide practical exercises in security and privacy training that reinforce training objectives.
AT-03(04)
in AT-3
 Suspicious Communications and Anomalous System Behavior withdrawn
AT-03(05)
in AT-3
 Processing Personally Identifiable Information Provide [Assignment: personnel or roles] with initial and [Assignment: frequency] training in the employment and operation of personally identifiable information processing and transparency controls.
AT-04 Training Records a. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and b. Retain individual training records for [Assignment
AT-05 Contacts with Security Groups and Associations withdrawn
AT-06 Training Feedback Provide feedback on organizational training results to the following personnel [Assignment: frequency]: [Assignment: personnel].

17 of 1196.