03.02.02 — Role-Based Training

Official NIST requirement content

Security requirement

a.Provide role-based security training to organizational personnel:
1. 1.Before authorizing access to the system or CUI, before performing assigned duties, and [Organization-defined: frequency] thereafter
2. 2.When required by system changes or following [Organization-defined: events].
b.Update role-based training content [Organization-defined: frequency] and following [Organization-defined: events].

Official NIST discussion

Discussion

Organizations determine the content and frequency of security training based on the assigned duties, roles, and responsibilities of individuals and the security requirements of the systems to which personnel have authorized access. In addition, organizations provide system developers, enterprise architects, security architects, software developers, systems integrators, acquisition/procurement officials, system and network administrators, personnel conducting configuration management and auditing activities, personnel performing independent verification and validation, security assessors, and personnel with access to system-level software with security-related technical training specifically tailored for their assigned duties. Comprehensive role-based training addresses management, operational, and technical roles and responsibilities that cover physical, personnel, and technical controls. Such training can include policies, procedures, tools, and artifacts for the security roles defined. Organizations also provide the training necessary for individuals to carry out their responsibilities related to operations and supply chain security within the context of organizational information security programs.

Official organization-defined parameters

Tailoring decisions required

Resolve these values through the governing organization’s approved tailoring and risk-management process before declaring the requirement implemented.

frequencyorganization-defined frequencythe frequency at which to provide role-based security training to assigned personnel after initial training is defined.

eventsorganization-defined eventsevents that require role-based security training are defined.

frequencyorganization-defined frequencythe frequency at which to update role-based security training content is defined.

eventsorganization-defined eventsevents that require role-based security training content updates are defined.

Bare Metal Cyber interpretation

Implementation perspective

Treat Role-Based Training as a CUI protection outcome that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to role-based CUI handling knowledge, awareness, and evidence that personnel understand their responsibilities.

Confirm the requirement is in scope for the CUI system components, services, users, and external connections being assessed.
Resolve every organization-defined parameter through an approved governance and tailoring process.
Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.

Questions to ask

Which CUI assets, data flows, users, and services are protected by this requirement?
Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
What change, incident, or threshold should trigger reassessment?

Evidence and validation

training plans and role assignments
completion and attendance records
exercise or simulation results
content review and approval records

Common failure patterns

generic annual training with no CUI context
completion treated as proof of competence
contractors or privileged users omitted
training not updated after incidents or policy changes

Official NIST SP 800-171A content

Assessment objectives and methods

Assessment objectives (6)

a.1.
role-based security training is provided to organizational personnel before authorizing access to the system or CUI.
a.1.
role-based security training is provided to organizational personnel before performing assigned duties.
a.1.
role-based security training is provided to organizational personnel [Organization-defined: frequency] after initial training.
a.2.
role-based security training is provided to organizational personnel when required by system changes or following [Organization-defined: events].
b.
role-based security training content is updated [Organization-defined: frequency].
b.
role-based security training content is updated following [Organization-defined: events].

Examine

security awareness and training policy and procedures
procedures for security training implementation
codes of federal regulations
security training curriculum
security training materials
training records
system security plan
other relevant documents or records

Interview

personnel with responsibilities for role-based security training
personnel with assigned system security roles and responsibilities

Test

mechanisms for managing role-based security training and awareness

Official source-control relationships

Source NIST SP 800-53 controls

These controls are referenced by the official SP 800-171 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.

Source controlAT-3Open SP 800-53 control →

Source record

Authoritative sources

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.