AT-4—Training Records

Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and

Retain individual training records for a minimum of three years.