# AT-02 Literacy Training and Awareness

NIST SP 800-53 control. Family: AT Awareness and Training. Function: preventative. Baselines: low, moderate, high, privacy. Mapping licence: CC BY-SA 4.0.

Statement: a. Provide security and privacy literacy training to system users (including managers, senior executives, and contractors): 1. As part of initial training for new users and [Assignment: organization-defined frequency] thereafter; and 2. When required by system changes or following [Assignment: organization-defined events]; b. Employ the following techniques to increase the security and privacy awareness of system users [Assignment: organization-defined awareness techniques]; c. Update literacy training and awareness content [Assignment: organization-defined frequency] and following [Assignment: organization-defined events]; and d. Incorporate lessons learned from internal or external security incidents or breaches into literacy training and awareness techniques.
Guidance: Organizations provide basic and advanced levels of literacy training to system users, including measures to test the knowledge level of users. Organizations determine the content of literacy training and awareness based on specific organizational requirements, the systems to which personnel have authorized access, and work environments (e.g., telework). The content includes an understanding of the need for security and privacy as well as actions by users to maintain security and personal privacy and to respond to suspected incidents. The content addresses the need for operations security and the handling of personally identifiable information. Awareness techniques include displaying posters, offering supplies inscribed with security and privacy reminders, displaying logon screen messages, generating email advisories or notices from organizational officials, and conducting awareness events. Literacy training after the initial training described in AT-02a.01 is conducted at a minimum frequency consistent with applicable laws, directives, regulations, and policies. Subsequent literacy training may be satisfied by one or more short ad hoc sessions and include topical information on recent attack schemes, changes to organizational security and privacy policies, revised security and privacy expectations, or a subset of topics from the initial training. Updating literacy training and awareness content on a regular basis helps to ensure that the content remains relevant. Events that may precipitate an update to literacy training and awareness content include, but are not limited to, assessment or audit findings, security incidents or breaches, or changes in applicable laws, executive orders, directives, regulations, policies, standards, and guidelines.

## Enhancements (6)
- AT-02(01) Practical Exercises
- AT-02(02) Insider Threat. Baselines: low, moderate, high
- AT-02(03) Social Engineering and Mining. Baselines: moderate, high
- AT-02(04) Suspicious Communications and Anomalous System Behavior
- AT-02(05) Advanced Persistent Threat
- AT-02(06) Cyber Threat Environment
Each enhancement's statement: /api/v1/controls/AT-02?fields=enhancements

## Patterns that use it (25)
- Critical (2): SP-014 Awareness and Training Pattern; SP-048 Offensive AI and Deepfake Defence (draft)
- Important (12): SP-011 Cloud Computing Pattern; SP-015 Secure Remote Working; SP-018 Information Security Management System; SP-019 Secure Ad-Hoc File Exchange Pattern; SP-024 iPhone Pattern; SP-027 Secure LLM Usage; SP-035 Offensive Security Testing; SP-036 Incident Response; SP-039 Client-Side Encryption and Data Privacy; SP-043 Security Metrics and Measurement; SP-045 AI Governance and Responsible AI; SP-049 AI in Security Operations (draft)
- Standard (11): SP-001 Client Module; SP-013 Data Security Pattern; SP-021 Realtime Collaboration Pattern; SP-028 Secure DevOps Pipeline Pattern; SP-029 Zero Trust Architecture; SP-030 API Security; SP-031 Security Monitoring and Response; SP-032 Modern Authentication; SP-033 Passkey Authentication; SP-044 SaaS Identity Lifecycle Management; SP-050 Mobile Security Architecture (draft)

## Clauses by framework (66 frameworks)
- iso_27001_2022: 7.2, 7.3, A.6.3, A.8.7. OSA's own, not in NIST's crosswalk: 7.2
- iso_27002_2022: 6.3
- cobit_2019: APO07, APO13, BAI08
- pci_dss_v4: 5.4, 12.6
- nist_csf_2: GV.RR-01, GV.RR-04, PR.AT-01. OSA's own, not in NIST's crosswalk: GV.RR-01, GV.RR-04
- cis_controls_v8: CIS 14, CIS 14.1, CIS 14.2, CIS 14.3, CIS 14.4, CIS 14.5, CIS 14.6, CIS 14.7, CIS 14.8
- iso_42001_2023: A.4.6, A.9.2
- nis2: Art. 21(2)(g)
- apra_cps_234: Para 19-20
- bsi_grundschutz: ORP.2, ORP.3
- anssi: Hygiene.1, Hygiene.3, SecNumCloud.8.3
- osfi_b13: B-13.1.1
- finma_circular: IV.B.a(48), IV.B.a(49), IV.B.b(50), IV.B.b(51)
- gdpr: Art.39(1)(b), Art.47(2)(n)
- dora: Art.5(4), Art.13(6)
- bio2: 6.3
- rbi_csf: Annex1.14, Annex1.23, Annex1.24
- fisc: FISC.O8
- lgpd_bcb: BCB.Art.4, LGPD.Art.47, LGPD.Art.50
- mlps_2: 8.1.8.2
- dnb_good_practice: DNB.8.2, DNB.9.1, DNB.9.3
- swift_cscf: SWIFT.7.2
- cbb_tm: TM-3
- cbuae: CR-11
- nca_ecc: 1-10
- qatar_nia: HR
- sama_csf: 1.6
- uae_ia: T5
- bog_cisd: CISD-X, CISD-XV
- bom_ctrm: 3.8, 5.3
- cbe_csf: CTO-8, GOV-4
- cbn_csf: Part3.8, Part8
- sa_js2: JS2-8.6
- bcbs_239: Principle 1
- bot_cyber: Ch7.1
- cpmi_pfmi: CG.GOV, CG.LE
- eba_ict: 3.4.7, 3.8(a)
- ecb_croe: CROE.2.1.2, CROE.2.3.2, CROE.2.8.2
- ffiec_is: I.A, I.C, II.C.7, II.C.7(e), II.C.12, II.C.13(e)
- hipaa_sr: §164.308(a)(5)(i), §164.308(a)(5)(ii)(A), §164.308(a)(5)(ii)(B)
- iosco_cyber: PROT-4
- nydfs_500: 500.10, 500.14
- sebi_cscrf: CAPACITY, PR.AT
- cmmc_2: AT
- nerc_cip: CIP-004-7
- nrc_73_54: RG5.71-C-AT
- tsa_psd: SD-2 Sec H
- ferc_cip: Order 888
- doe_c2m2: WORKFORCE
- api_1164: Sec 13
- awia: AWWA Sec 8
- iaea_nss: Sec 9
- fca_sysc_13: SYSC 13.5.1, SYSC 13.6.1
- fda_21_cfr_11: §11.10(i)
- hitrust_csf: 02.b
- iso_27799: 7.2
- lloyds_ms: MS8.13
- naic_ds: 4-training, 4B
- nhs_dspt: NDG-1.3, NDG-2.1, NDG-2.2, NDG-2.3, NDG-3.1
- pra_ss1_23: P2.3, P3.6
- solvency_ii: DR.266
- csa_ccm_v4: HRS-11, HRS-12, HRS-13
- csa_aicm: HRS-11, HRS-12, HRS-13, HRS-14
- mica: Art.62(7)
- basel_sco60: SCO60.3, SCO60.60
- bssc: GSP-03
OSA's mapping for iso_27001_2022 and nist_csf_2 takes NIST's published crosswalk as its base. A clause not marked as OSA's own is in that crosswalk.

## More
- This control as JSON, with guidance and ATT&CK techniques: /api/v1/controls/AT-02
- Clauses only: /api/v1/controls/AT-02?fields=mappings
- Page for people: /controls/at-02/