AT – Awareness And Training

The RMF Control Family AT, Awareness and Training, addresses the need for organizations to educate their employees on cybersecurity best practices.

Controls in the AT Control Family

The AT Control Family includes the following controls:

AT-1: Security Awareness and Training: This control requires organizations to provide security awareness and training to all employees. The training should cover topics such as security policies and procedures, password management, and phishing awareness.
AT-2: Security Training for System Administrators: This control requires organizations to provide security training to system administrators. The training should cover topics such as system security configuration, vulnerability management, and incident response.
AT-3: Security Training for Developers: This control requires organizations to provide security training to developers. The training should cover topics such as secure coding practices, security testing, and vulnerability management.

There are a number of benefits to implementing the AT Control Family, including:

Improved security: The AT Control Family helps to improve the security of information systems by educating employees on cybersecurity best practices. This can help to reduce the risk of human error, which is a leading cause of security incidents.
Reduced risk: The AT Control Family helps to reduce the risk of security incidents by making employees more aware of security threats and how to mitigate them.
Compliance: The AT Control Family can help organizations comply with applicable laws and regulations, such as the Federal Information Security Management Act (FISMA) and the Health Insurance Portability and Accountability Act (HIPAA).
Increased trust: By implementing the AT Control Family, organizations can demonstrate to their customers and partners that they are taking steps to protect their data.

To implement the AT Control Family, organizations should follow these steps:

Develop a security awareness and training program. This program should identify the target audience for the training, the training topics, and the training delivery methods.
Implement the security awareness and training program. This includes delivering the training to the target audience and tracking employee participation.
Monitor and audit the security awareness and training program to ensure that it is effective.
Regularly review and update the security awareness and training program to ensure that it is aligned with the changing needs of the organization and the latest security threats.

Make security awareness and training a continuous effort. Cybersecurity threats are constantly evolving, so it is important to provide employees with regular security training.
Tailor security awareness and training to the needs of the audience. Different employees will have different levels of cybersecurity knowledge and experience. Tailor the training to the specific needs of each audience to ensure that it is relevant and effective.
Use a variety of training delivery methods. Some employees may prefer to learn in a classroom setting, while others may prefer to learn online or through self-paced training. Offer a variety of training delivery methods to meet the needs of all employees.
Make security awareness and training engaging. Use interactive training methods, such as games and simulations, to keep employees engaged and interested in the material.
Test employee knowledge. After completing security awareness and training, test employee knowledge to ensure that they have understood the material.

By following these tips, you can effectively implement the AT Control Family and improve the security of your organization’s information systems.