---

id: "AT-02" title: "Literacy Training and Awareness" family: "AT" family_name: "Awareness and Training" sort_id: "at-02" priority: "P2" implementation_level: "organization" enhancements: - at-2.1 - at-2.2 - at-2.3 - at-2.4 - at-2.5 - at-2.6

---

Provide security and privacy literacy training to system users (including managers, senior executives, and contractors):

As part of initial training for new users and {{ insert: param, at-2_prm_1 }} thereafter; and

When required by system changes or following {{ insert: param, at-2_prm_2 }};

Employ the following techniques to increase the security and privacy awareness of system users {{ insert: param, at-02_odp.05 }};

Update literacy training and awareness content {{ insert: param, at-02_odp.06 }} and following {{ insert: param, at-02_odp.07 }} ; and

Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.

Guidance

Organizations provide basic and advanced levels of literacy training to system users, including measures to test the knowledge level of users. Organizations determine the content of literacy training and awareness based on specific organizational requirements, the systems to which personnel have authorized access, and work environments (e.g., telework). The content includes an understanding of the need for security and privacy as well as actions by users to maintain security and personal privacy and to respond to suspected incidents. The content addresses the need for operations security and the handling of personally identifiable information.

Awareness techniques include displaying posters, offering supplies inscribed with security and privacy reminders, displaying logon screen messages, generating email advisories or notices from organizational officials, and conducting awareness events. Literacy training after the initial training described in AT-2a.1 is conducted at a minimum frequency consistent with applicable laws, directives, regulations, and policies. Subsequent literacy training may be satisfied by one or more short ad hoc sessions and include topical information on recent attack schemes, changes to organizational security and privacy policies, revised security and privacy expectations, or a subset of topics from the initial training. Updating literacy training and awareness content on a regular basis helps to ensure that the content remains relevant. Events that may precipitate an update to literacy training and awareness content include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

Assessment Objective: security literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;

Assessment Objective: privacy literacy training is provided to system users (including managers, senior executives, and contractors) as part of initial training for new users;

Assessment Objective: security literacy training is provided to system users (including managers, senior executives, and contractors) {{ insert: param, at-02_odp.01 }} thereafter;

Assessment Objective: privacy literacy training is provided to system users (including managers, senior executives, and contractors) {{ insert: param, at-02_odp.02 }} thereafter;

Assessment Objective: security literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following {{ insert: param, at-02_odp.03 }};

Assessment Objective: privacy literacy training is provided to system users (including managers, senior executives, and contractors) when required by system changes or following {{ insert: param, at-02_odp.04 }};

Assessment Objective: {{ insert: param, at-02_odp.05 }} are employed to increase the security and privacy awareness of system users;

Assessment Objective: literacy training and awareness content is updated {{ insert: param, at-02_odp.06 }};

Assessment Objective: literacy training and awareness content is updated following {{ insert: param, at-02_odp.07 }};

Assessment Objective: lessons learned from internal or external security incidents or breaches are incorporated into literacy training and awareness techniques.

System security plan

privacy plan

literacy training and awareness policy

procedures addressing literacy training and awareness implementation

appropriate codes of federal regulations

security and privacy literacy training curriculum

security and privacy literacy training materials

training records

other relevant documents or records

Organizational personnel with responsibilities for literacy training and awareness

organizational personnel with information security and privacy responsibilities

organizational personnel comprising the general system user community

Mechanisms managing information security and privacy literacy training