|

controlAT-3

Role-based Training (AT-3)

Provide role-based security and privacy training to personnel with the following roles and responsibilities: [organization-defined]: Update role-based training content [organization-defined] and following [organization-defined] ; and Incorporate lessons learned from internal or external security incidents or breaches into role-based training.

Security Baselines

LOWMODERATEHIGH

awarenesstrainingworkforce

Why These Connect

Maps To6

These are equivalent or closely aligned requirements in other frameworks.

Baselined In3

This control is included in the linked security baseline (LOW, MODERATE, or HIGH).

Supports51

These related controls work together — a change to one may affect the others.

Mitigates2

This control helps defend against or reduce the risk of the linked threat technique.

Enhances5

These enhancements add specific capabilities or refinements to the base control.

Related Controls(35)

AC-3Access Enforcement (AC-3)

AC-22Publicly Accessible Content (AC-22)

AT-2Literacy Training and Awareness (AT-2)

AC-17Remote Access (AC-17)

AT-4Training Records (AT-4)

CP-3Contingency Training (CP-3)

IR-2Incident Response Training (IR-2)

IR-4Incident Handling (IR-4)

IR-7Incident Response Assistance (IR-7)

IR-9Information Spillage Response (IR-9)PL-4Rules of Behavior (PL-4)

PM-13Security and Privacy Workforce (PM-13)PM-23Data Governance Body (PM-23)PS-7External Personnel Security (PS-7)

PS-9Position Descriptions (PS-9)

SA-3System Development Life Cycle (SA-3)

SA-8Security and Privacy Engineering Principles (SA-8)

SA-11Developer Testing and Evaluation (SA-11)

SA-16Developer-provided Training (SA-16)

SR-5Acquisition Strategies, Tools, and Methods (SR-5)

SR-6Supplier Assessments and Reviews (SR-6)

SR-11Component Authenticity (SR-11)

CP-4Contingency Plan Testing (CP-4)

PE-1Policy and Procedures (PE-1)

PE-2Physical Access Authorizations (PE-2)

PE-3Physical Access Control (PE-3)

PE-4Access Control for Transmission (PE-4)

PE-11Emergency Power (PE-11)

PE-13Fire Protection (PE-13)

PE-14Environmental Controls (PE-14)

PE-15Water Damage Protection (PE-15)

PM-14Testing, Training, and Monitoring (PM-14)PS-2Position Risk Designation (PS-2)

PT-3Personally Identifiable Information Processing Purposes (PT-3)SR-10Inspection of Systems or Components (SR-10)

Threat Coverage(2 ATT&CK techniques)

T1204User Execution T1598Phishing for Information

Cross-Framework Mappings(6)

PR.AT-01PR.AT-01Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

PR.AT-02PR.AT-02Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

ISO 27001ISO/IEC 27001:20221 mappingFinal

NIST OLIR informative reference — SP 800-53 Rev 5 to ISO/IEC 27001:2022

HIPAAHIPAA Security Rule5 mappingsFinal

NIST OLIR informative reference — HIPAA Security Rule to SP 800-53 Rev 5

PR.AT-01PR.AT-01Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

PR.AT-02PR.AT-02Final

NIST OLIR informative reference — Cybersecurity Framework v2.0 to SP 800-53 Rev 5

Organization-Defined Parameters(5)

Assignmentorganization-defined roles and responsibilities

Assignmentorganization-defined roles and responsibilities

Assignmentorganization-defined frequency

Assignmentorganization-defined frequency

Assignmentorganization-defined events

Control Enhancements(5)

AT-3(1)Environmental Controls (AT-3(1))

AT-3(2)Physical Security Controls (AT-3(2))

AT-3(3)Practical Exercises (AT-3(3))

AT-3(4)Suspicious Communications and Anomalous System Behavior (AT-3(4))W

AT-3(5)Processing Personally Identifiable Information (AT-3(5))

See Also

@SP 800-53 Overview ⚖Compare Baselines