AT-04-727 Security Training Records

Security Training Records

Control ID

AT-04-727

Control Name

Security Training Records

Control Category

Awareness and Training

Functional Areas

Identify, Protect

Sub-Areas

Control Oversight and Safeguard Assurance, Security Awareness and Training

NIST Baseline Level(s)

LOW, MOD, HIGH

NIST Priority

State Implementation Required

Yes

Agency Last Implemented Date

August 17, 2016

Agency Implementation

TAMUS TrainTraq is the system of record for information security awareness training. These records are maintained in accordance with the TAMUS records retention schedule.

Risk Statement

Service Management objectives are not achieved since personnel performing work within service management have inappropriate education, training, skills, and experience.

Control Description

The organization: a. Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and b. Retains individual training records for [Assignment: organization-defined time period].

Control Example

The organization maintains records of information security training and monitored them for compliance.

State Implementation

State organizations shall maintain information security awareness and training records.

Testing Procedures

Obtain Security awareness and training policy; procedures addressing security training records; security awareness and training records; other relevant documents or records and ascertain if the organization monitors and documents basic security awareness training and specific information system security training.