RMFInsider

AT-2 is the control that asks whether your users are trained. In NIST SP 800-53 Revision 5 it carries the name Literacy Training and Awareness, and in a DoD package it is usually satisfied by the annual Cyber Awareness Challenge plus whatever awareness program your organization layers on top. That is why it looks easy. The course takes about an hour and the certificate prints itself.

It fails anyway, and it fails during validation more reliably than controls that are genuinely hard to engineer. The reason is structural: AT-2 has four separate requirements and the typical implementation statement answers one of them. The assessor asks for a completion roster that reconciles against the current user list for the system, and the roster is four months old, missing the contractor accounts, and carries no completion dates.

Here is what Revision 5 actually requires, what DoD accepts as evidence, and the specific gaps that turn a one-hour click-through into a POA&M item with a six-month milestone.

What AT-2 Actually Requires in Revision 5

Revision 4 called this control Security Awareness Training. Revision 5 renamed it Literacy Training and Awareness and folded privacy into the scope, so the control now covers security literacy and privacy literacy for the same population. Search traffic still runs on the old name, which is why half the guidance you find online is written against text that was superseded. Check the control name in your baseline before you copy a statement from a template.

The control has four discrete requirements, and each one is scored:

• Part a: provide security and privacy literacy training to system users, including managers, senior executives, and contractors, as part of initial training for new users, at an organization-defined frequency after that, and again when system changes or organization-defined events require it.
• Part b: employ organization-defined techniques to increase the security and privacy awareness of system users. This is a separate obligation from the training course itself.
• Part c: update the literacy training and awareness content at an organization-defined frequency and following organization-defined events.
• Part d: incorporate lessons learned from internal or external security incidents or breaches into the training and awareness techniques.

Part a is the one everybody writes about. Parts b, c, and d are where packages lose points, because they describe a program, not a course, and a program leaves a different kind of paper trail.

The Enhancements and Which Baselines Pull Them In

Six enhancements hang off AT-2 in Revision 5. Which ones apply depends on your categorization, and this catches people who assume a Low system gets a pass:

• AT-2(1) Practical Exercises. Not in any baseline. Picked up by overlay or by AO direction.
• AT-2(2) Insider Threat. Low, Moderate, and High baselines. Yes, Low.
• AT-2(3) Social Engineering and Mining. Moderate and High baselines.
• AT-2(4) Suspicious Communications and Anomalous System Behavior. Pulled in by the operational technology overlays.
• AT-2(5) Advanced Persistent Threat. Not in any baseline.
• AT-2(6) Cyber Threat Environment. Not in any baseline.

AT-2(2) sitting in the Low baseline is the detail worth memorizing. A Low confidentiality, Low integrity, Low availability system still owes documented insider threat awareness, and the Cyber Awareness Challenge does cover it, so the fix is usually a sentence in your statement rather than new training. You just have to say it. If you are still building intuition for how the families divide the work, the walkthrough in NIST 800-53 Controls Explained lays out where each obligation lands.

What DoD Accepts as the Implementation

For general users, the answer is the DoD Cyber Awareness Challenge, hosted on the DoD Cyber Exchange and on Joint Knowledge Online. It is reissued on an annual cycle. The 2026 version went live in November 2025 and moved to a mission-based format, with a knowledge-check option that lets a user skip ahead through a section when every answer is correct. Annual completion for every authorized user, plus completion before initial account issuance, covers part a for a DoD system on the standard baseline.

One scoping error shows up constantly: AT-2 is general user awareness. Role-based training for privileged users, ISSOs, ISSMs, and developers belongs to AT-3. Do not dump your workforce qualification evidence into the AT-2 body. An assessor who opens AT-2 and finds a stack of certification records will ask why the general user roster is missing, and now you have two findings instead of zero.

Why the Easiest Control Fails

The roster does not reconcile against the system

This is the number one cause. Your training completion report comes out of the enterprise learning system, which is organized by personnel record. Your user account list comes out of the system in the authorization boundary, which is organized by account. Those two lists never match on their own, and the assessor is going to compare them.

• Contractor accounts training under a different company learning system, so the records live somewhere your export does not reach.
• Service accounts and shared accounts on the user list with no human behind them and no explanation in the package.
• Departed users still active in the system, which is an AC-2 problem that surfaces as an AT-2 finding.
• Completion records with a course name but no completion date, which makes annual compliance unprovable.
• A roster pulled six weeks before the assessment date, so it cannot show currency on the day of the review.

Nobody documents part b

Part b asks for awareness techniques, which is deliberately separate from the training course. If your statement says the Cyber Awareness Challenge satisfies AT-2 and stops there, you have answered part a and left part b blank. The techniques are usually already happening in your organization and simply going undocumented: phishing simulation campaigns and their reporting rates, login banners, security newsletters, posters in the passageway, spot checks, awareness briefings at all-hands. Name the ones your organization actually runs, name the office that runs them, and state the cadence.

Parts c and d get skipped silently

Part c wants proof the content gets refreshed. In DoD that is easy, because the Cyber Awareness Challenge version number rolls every year, so cite the version and the annual release cycle. Part d wants incident lessons learned fed back into awareness. If your organization sent a follow-up advisory after a real phishing incident, that advisory is your part d artifact. If nothing has been fed back, say what the process is and who owns it, and be honest that the trigger has not fired yet.

The Evidence Package That Passes

Assemble these before the assessment rather than during it:

1. The organizational awareness and training policy and procedure, cited by document number and date, covering AT-1 and anchoring the AT-2 frequency.
2. A training completion export listing user name, course title, course version, and completion date.
3. A user account list pulled from the system in the boundary, dated the same day as the training export.
4. A short reconciliation memo explaining the delta between the two lists, account by account, including every service account.
5. Awareness technique artifacts: the phishing campaign summary report, a login banner screenshot, and one awareness communication from the current year.
6. A content update record showing the current Cyber Awareness Challenge version and the date it was fielded in your organization.
7. A lessons-learned memo tying at least one incident or external advisory to an awareness action.

Upload them as separate artifacts and attach each one to AT-2 and its enhancements rather than dropping a single merged PDF into the package. The mechanics of doing that cleanly are covered in how to upload artifacts in eMASS, and the difference matters because a validator reviewing AT-2(2) should not have to scroll a forty-page combined file to find the insider threat evidence.

Writing the Statement So It Passes the First Time

Structure the implementation statement to mirror the control structure. Four parts in the control, four labeled segments in your statement. The assessor is working a checklist, and a statement that maps one to one against that checklist gets validated instead of returned. The general pattern is covered in how to write a control implementation statement, and AT-2 is a clean case for it.

A statement that survives review reads roughly like this: the organization provides security and privacy literacy training through the DoD Cyber Awareness Challenge, completed before account issuance and annually thereafter for all authorized users including managers, senior executives, and contractors, tracked in the enterprise learning management system and reconciled monthly against the system account list. Awareness techniques include quarterly phishing simulations run by the cybersecurity office, DoD warning banners at every logon, and monthly security advisories. Content is refreshed annually with each Cyber Awareness Challenge release and out of cycle when the cybersecurity office issues a directed advisory. Incident lessons learned are incorporated through advisories issued after each reportable incident.

Four sentences, four parts, no adjectives. That statement can be validated by somebody who has never seen your system.

When You Fail It Anyway

An AT-2 finding is the cheapest finding on the board to close, which means the AO expects a short milestone, not a twelve-month one. Write the POA&M against the actual gap. If the gap is a stale roster, the milestone is a reconciliation procedure with a named owner and a monthly cadence, closable in thirty to sixty days. If the gap is fifteen users past due, the milestone is completion by a specific date, closable in two weeks. Padding an AT-2 milestone out to six months tells the AO you are not paying attention, and it invites scrutiny on the controls where you actually needed the benefit of the doubt.

The wry part of AT-2 is that the control almost never fails on training. It fails on spreadsheets. The users took the course, the certificates exist, and the package still takes a hit because nobody could produce one dated list that matched another dated list. Fix the reconciliation and the control fixes itself. If you want the full sequence of what has to be in the package before validation starts, the RMF Checklist walks it end to end so AT-2 is not the thing that holds up your ATO.