{"data":{"id":"AT-04","name":"Training Records","family":"AT","family_name":"Awareness and Training","withdrawn":false,"description":"a. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and\nb. Retain individual training records for [Assignment: organization-defined time period].","supplemental_guidance":"Documentation for specialized training may be maintained by individual supervisors at the discretion of the organization. The National Archives and Records Administration provides guidance on records retention for federal agencies.","enhancements":[],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"nist_800_53":{"rev5":{"id":"AT-04","name":"Training Records","description":"a. Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and\nb. Retain individual training records for [Assignment: organization-defined time period].","discussion":"Documentation for specialized training may be maintained by individual supervisors at the discretion of the organization. The National Archives and Records Administration provides guidance on records retention for federal agencies.","related_controls":["AT-02","AT-03","CP-03","IR-02","PM-14","SI-12"],"baseline_low":true,"baseline_moderate":true,"baseline_high":true,"baseline_privacy":true,"new_in_rev5":false,"changes_from_rev4":"Title changed from 'Security Training Records' Adds privacy to control text, to imply training includes privacy, as well as security Discussion includes reference to NARA"}},"compliance_mappings":{"iso_27001_2022":["A.6.3"],"iso_27002_2022":["6.3"],"cobit_2019":[],"pci_dss_v4":["12.6"],"nist_csf_2":["GV.RR-04"],"cis_controls_v8":["CIS 14"],"soc2_tsc":[],"finos_ccc":[],"iso_42001_2023":["A.4.6"],"iec_62443":[],"asd_e8":[],"nis2":[],"apra_cps_234":[],"mas_trm":[],"pra_op_resilience":[],"bsi_grundschutz":["ORP.2","ORP.3"],"anssi":["Hygiene.3","Hygiene.4","SecNumCloud.8.3"],"osfi_b13":["B-13.1.1"],"finma_circular":["IV.B.a(48)","IV.B.a(49)"],"gdpr":["Art.5(2)","Art.24(1)"],"dora":["Art.13(6)"],"bio2":["6.3"],"rbi_csf":["Annex1.21","Annex1.23"],"fisc":["FISC.O8"],"lgpd_bcb":[],"hkma_tme1":[],"mlps_2":["8.1.8.2"],"dnb_good_practice":["DNB.9.2"],"cra":[],"swift_cscf":[],"cbuae":["CR-11"],"nca_ecc":["1-10"],"qatar_nia":["HR"],"sama_csf":["1.6"],"uae_ia":["T5"],"bog_cisd":["CISD-XV"],"bom_ctrm":["3.8"],"cbe_csf":["GOV-4"],"cbn_csf":["Part8"],"sa_js2":["JS2-8.6"],"bot_cyber":["Ch7.1"],"eba_ict":["3.4.7"],"ecb_croe":["CROE.2.3.2"],"ffiec_is":["I.A","II.C.7(e)"],"hipaa_sr":["§164.308(a)(5)(i)"],"iosco_cyber":["PROT-4"],"nydfs_500":["500.14"],"sebi_cscrf":["CAPACITY","PR.AT"],"cmmc_2":["AT"],"nerc_cip":["CIP-004-7"],"nrc_73_54":["RG5.71-C-AT"],"tsa_psd":["SD-2 Sec H"],"ieee_1686":[],"ferc_cip":[],"doe_c2m2":["WORKFORCE"],"api_1164":[],"awia":[],"iaea_nss":["Sec 9"],"pci_pts":[],"fips_140":[],"cbest":[],"tiber_eu":[],"pci_hsm":[],"common_criteria":[],"isae_3402":[],"fca_sysc_13":["SYSC 13.6.1"],"fda_21_cfr_11":["§11.10(i)"],"fda_cyber":[],"hitrust_csf":["02.b"],"iso_27799":["7.2"],"lloyds_ms":["MS8.13"],"naic_ds":["4-training"],"nhs_dspt":["NDG-2.1","NDG-2.2","NDG-3.1"],"pra_ss1_23":[],"solvency_ii":[],"owasp_masvs_v2":[],"csa_ccm_v4":[],"csa_aicm":[],"ccss_v9":[],"mica":[],"basel_sco60":[],"bssc":["GSP-03"],"sec_custody_digital":[],"dpdpa":[]},"attack_techniques":[],"metadata":{"last_reviewed":"2026-02-19","review_notes":"","mapping_status":"complete"},"function":"preventative","used_by_patterns":["SP-001","SP-002","SP-006","SP-007","SP-014"]}}