NIST SP 800-53 Rev 5
AT - Awareness and Training

NIST SP 800-53 Rev 5 NIST800-AT-3: AT-3 Role-based Training

a. Provide role-based security and privacy training to personnel with the following roles and responsibilities: [Assignment: organization-defined roles and responsibilities]: 1. Before authorizing access to the system, information, or performing assigned duties, and [Assignment: organization-defined frequency] thereafter; and 2. When required by system changes; b. Update role-based training content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and c. Incorporate lessons learned from internal or external security incidents or breaches into role-based training.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 168 controls across 78 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

PCI DSS 4.0 · 16 controls

  • 11.1.2 11.1.2 Roles for security testing assigned and understood
  • 12.10.4 12.10.4 Periodic training for incident response personnel
  • 12.10.4.1 12.10.4.1 Responder training frequency set by targeted risk analysis
  • 12.4.2 12.4.2 Quarterly reviews that personnel follow security procedures
  • 12.6.3 12.6.3 Security awareness training on hire and annually with acknowledgment
  • 12.6.3.1 12.6.3.1 Awareness training covers phishing and social engineering
  • 12.6.3.2 12.6.3.2 Awareness training covers acceptable use of end-user technologies
  • 2.1.2 2.1.2 Requirement 2 roles and responsibilities assigned
  • 3.7.8 3.7.8 Key custodians formally acknowledge responsibilities
  • 4.1.2 4.1.2 Requirement 4 roles and responsibilities assigned
  • 5.1.2 5.1.2 Requirement 5 roles and responsibilities assigned
  • 6.2.2 6.2.2 Annual secure software training for developers
  • 7.1.2 7.1.2 Requirement 7 roles and responsibilities assigned
  • 9.1.2 9.1.2 Requirement 9 roles and responsibilities assigned
  • 9.5.1.3 9.5.1.3 Training for personnel in POI environments
  • 8.1.2 8.1.2 Requirement 8 roles and responsibilities assigned

CIS Controls v8 · 10 controls

  • CIS-14.1 Establish and Maintain a Security Awareness Program
  • CIS-14.3 Train Workforce Members on Authentication Best Practices
  • CIS-14.4 Train Workforce on Data Handling Best Practices
  • CIS-14.5 Train Workforce Members on Causes of Unintentional Data Exposure
  • CIS-14.7 Train Workforce on How to Identify and Report if Their Enterprise Assets are Missing Security Updates
  • CIS-14.8 Train Workforce on the Dangers of Connecting to and Transmitting Enterprise Data Over Insecure Networks
  • CIS-14.9 Conduct Role-Specific Security Awareness and Skills Training
  • CIS-16.1 Establish and Maintain a Secure Application Development Process
  • CIS-16.9 Train Developers in Application Security Concepts and Secure Coding
  • CIS-17.7 Conduct Routine Incident Response Exercises

FedRAMP High · 5 controls

  • AT-2 Literacy Training and Awareness
  • AT-3 Role-Based Training
  • IR-9(2) Information Spillage Response | Training (IR-9(2))
  • IR-9(4) Information Spillage Response | Exposure to Unauthorized Personnel (IR-9(4))
  • SR-11(1) Component Authenticity | Anti-counterfeit Training (SR-11(1))

FedRAMP Moderate · 5 controls

  • AT-2 Literacy Training and Awareness
  • AT-3 Role-Based Training
  • IR-9(2) Information Spillage Response | Training (IR-9(2))
  • IR-9(4) Information Spillage Response | Exposure to Unauthorized Personnel (IR-9(4))
  • SR-11(1) Component Authenticity | Anti-counterfeit Training (SR-11(1))

ISO/IEC 42001:2023 · 5 controls

  • 5.3 Roles, responsibilities and authorities
  • 7.2 Competence
  • A.3.2 AI roles and responsibilities
  • A.4.6 Human resources
  • A.8.2 System documentation and information for users

SOC 2 · 5 controls

  • SOC2-CC1.4 CC1.4 Attracting, developing and retaining competent people (COSO principle 4)
  • SOC2-CC1.5 CC1.5 Accountability for internal control responsibilities (COSO principle 5)
  • SOC2-CC2.2 CC2.2 Internal communication of objectives and control responsibilities (COSO principle 14)
  • SOC2-CC6.2 CC6.2 Registering and authorising users before issuing credentials
  • SOC2-CC6.3 CC6.3 Role-based access, least privilege and segregation of duties

ASD Strategies to Mitigate Cyber Security Incidents · 3 controls

  • ASD37-18 Restrict administrative privileges (Essential)
  • ASD37-20 Multi-factor authentication (Essential)
  • ASD37-37 Personnel management (Very Good)

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 3 controls

ISO 27002:2022 · 3 controls

  • 5.2 Information security roles and responsibilities
  • 6.3 Information security awareness, education and training
  • 8.28 Secure coding

NIST Cybersecurity Framework 2.0 · 3 controls

  • NIST-CSF-PR.AA-05 Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties
  • NIST-CSF-PR.AT-01 Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
  • NIST-CSF-PR.AT-02 Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind

NIST SP 800-181 · 3 controls

3GPP 5G Security Architecture (TS 33.501) · 2 controls

AWS Well-Architected Security Pillar · 2 controls

  • SEC11-BP01 Train for application security
  • SEC11-BP08 Build a program that embeds security ownership in workload teams

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

  • AWWA-1.3 Security Awareness and Training
  • AWWA-2.1 User Access Management

CMMC 2.0 · 2 controls

EU AI Act · 2 controls

ISO 22301:2019 · 2 controls

  • 7.2 Competence
  • 8.5 Exercise programme

ISO 27701:2019 · 2 controls

NIST Privacy Framework · 2 controls

  • NISTPF-3 Control-P - Privacy Controls, Data Management, and Disassociated Processing
  • NISTPF-5 Protect-P Access Control (PR.AC-P)

SSAE 18 - Attestation Standards (SOC Reporting) · 2 controls

  • SSAE18-CC6.2 CC6.2 - New User Registration and Authorization
  • SSAE18-SOC1-06 Transaction Processing Controls

Samoa Telecommunications Act 2005 · 2 controls

  • SAM-1 Customer Information Confidentiality (Section 48)
  • SAM-6 Legal Authorization Requirements

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

  • ANSSI-HYG-01 Train Operational Teams in Information System Security

APPI · 1 control

APRA CPS 234 · 1 control

  • CPS234-P33 Skill of Personnel Providing Control Assurance

ASIC Cyber Resilience Good Practices · 1 control

Australia Consumer Data Right - Banking (CDR) · 1 control

  • AUCDR-IS-6 Information security training and awareness program

Australia My Health Records Act 2012 · 1 control

Authorised Economic Operator (AEO) Programmes - Global Standards · 1 control

BSI IT-Grundschutz · 1 control

  • BSI-02 Access enforcement and least privilege

C5 (Germany) · 1 control

  • C5-DEV-04 Safety training and awareness programme regarding continuous software delivery and associated systems, components or tools

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 1 control

  • CFTC-SS-5 Systems Development and Quality Assurance Category

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 1 control

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 1 control

  • DSO-3 Data Access Management

DORA · 1 control

FFIEC Cybersecurity Assessment Tool (CAT) · 1 control

  • CAT-IRP-4 Organizational characteristics

GDPR · 1 control

HIPAA Security Rule · 1 control

IEC 62351 - Power Systems Communication Security · 1 control

  • 62351-8 Role-based access control (RBAC)

ISO 15189:2022 - Medical Laboratories Requirements for Quality and Competence · 1 control

  • ISO-15189-6.2 Personnel

ISO 19650 - Organisation and Digitisation of Information about Buildings and Civil Engineering Works (BIM) · 1 control

  • ISO-19650-2-5.7 Information model delivery

ISO 27001:2022 · 1 control

  • 6.3 Information security awareness, education and training

ISO 27799:2025 · 1 control

  • ISO27799-01 ePHI access controls and authorization

ISO/IEC 27011:2024 · 1 control

  • 27011-8.1 User Endpoint Devices

ISO/IEC 27043:2015 · 1 control

  • ISO27043-14 Privileged access management

ISO/IEC 27400:2022 · 1 control

  • 27400-6.1 Secure Device Design

ISO/SAE 21434 · 1 control

  • ISO21434-14 Privileged access management

NIS2 Directive · 1 control

  • Art.20.2 Train the management body, and offer equivalent training to staff on a regular basis

NIST SP 800-160 · 1 control

NIST SP 800-161 Rev 1 · 1 control

NIST SP 800-171 Rev 3 · 1 control

NIST SP 800-172 · 1 control

  • 3.2.2e Practical Exercises in Awareness Training

NIST SP 800-190 · 1 control

  • NIST190-08 Privileged access in cloud environments

NIST SP 800-218 · 1 control

NIST SP 800-53 Rev 5 HIGH · 1 control

  • AT-3 AT-3 Role-based Training

NIST SP 800-53 Rev 5 LOW · 1 control

  • AT-3 AT-3 Role-based Training

NIST SP 800-53 Rev 5 MODERATE · 1 control

  • AT-3 AT-3 Role-based Training

NIST SP 800-66 Rev 2 · 1 control

NIST SP 800-82 Revision 3: Guide to Industrial Control Systems (ICS) Security · 1 control

  • NISTSP82-4 OT Access Control, Identity, Authentication, and Remote Access

NIST SP 800-88 · 1 control

  • NISTSP88-1 Media Sanitization Policy, Roles, and Decision Framework

NIST SP 800-92 · 1 control

  • NISTSP92-4 Log Management: Time Synchronisation, Parsing, Storage, Integrity, Access Control

NRC 10 CFR 73.54 - Nuclear Facility Cybersecurity · 1 control

O-RAN WG11 Security Specification · 1 control

  • ORANWG11-2 O-RAN Interface Security: E2, A1, O1, O2, Open Fronthaul

OWASP SAMM · 1 control

  • OWASPSAMM-2 Design: Threat Assessment, Security Requirements, Security Architecture

Oman National Cybersecurity Framework · 1 control

  • OMANCS-3 Identity and Access Management, Authentication, Privileged Access

OpenSSF Scorecard · 1 control

  • OSSFSC-3 Build, CI/CD Security, Workflow Permissions, Dangerous Patterns

PTES · 1 control

  • PTESPHASE-2 Intelligence Gathering (OSINT)

SIG (Shared Assessments) · 1 control

  • SHAREASSESS-2 Access Control, Identity, Authentication

SLSA · 1 control

  • SUPCHAIN-2 Source Integrity - Branch Protection, Code Review, Two-Person Rule

Secure by Design: A Guide for Manufacturers (CISA) · 1 control

  • CISABD-1 Take Ownership of Customer Security Outcomes

Security of Critical Infrastructure Act 2018 (SOCI) · 1 control

  • SOCI-CIRMP-SUPPLY CIRMP hazard vector: Supply chain

Sigstore - Software Artifact Signing and Verification · 1 control

  • SIGSTORE-2 Transparency Log (Rekor) and Verification

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

  • IM8-SEC.2 Access Control

South Korea ISMS-P · 1 control

  • ISMSP-AC-01 Access Control Policy

TISAX - Trusted Information Security Assessment Exchange · 1 control

TSA Pipeline Cybersecurity Directives · 1 control

  • TSAPIPE-2 OT/IT Network Segmentation and Access Control

UK Telecommunications (Security) Act 2021 · 1 control

  • UK-TSA-NET-02 Access Control and Authentication

US Automated Commercial Environment (ACE) - CBP Trade Data Requirements · 1 control

  • ACE-CR-4 Cargo Release Authorization

Uganda Data Protection and Privacy Act (2019) · 1 control

  • UGA-10 Sensitive Personal Data Prohibition

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Other controls in AT - Awareness and Training

You are reading one control. How much of NIST SP 800-53 Rev 5 have you already done?

NIST SP 800-53 Rev 5 NIST800-AT-3 is one control. If you already hold one of the frameworks below, a reviewed crosswalk already says how much of NIST SP 800-53 Rev 5 your existing evidence covers. Hold ISO 27001:2022 and 163 of 1014 NIST SP 800-53 Rev 5 controls already carry evidence.

If you hold ISO 27001:202216.1% covered · 851 gapsIf you hold ISO 27002:202210.8% covered · 904 gapsIf you hold Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.110.2% covered · 911 gapsIf you hold CIS Controls v810.1% covered · 912 gapsIf you hold NIST SP 800-171 Rev 310.1% covered · 912 gapsIf you hold C5 (Germany)9.6% covered · 917 gaps

Each report names every control your existing framework evidences, every one it does not, the reasoning behind each claim, and the claims that were argued against and rejected. 342 were rejected on the ISO 27001:2022 pair alone.

See the released pairs, $299 eachBrowse the graph free

Query this from an agent

The graph holds this control, the 168 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll NIST SP 800-53 Rev 5 controls