AT-6—Training Feedback
IL5
IL6
>Control Description
Provide feedback on organizational training results to the following personnel ⚙organization-defined frequency: ⚙organization-defined personnel.
>DoD Impact Level Requirements
No specific parameter values or requirements for this impact level.
>Discussion
Training feedback includes awareness training results and role-based training results. Training results, especially failures of personnel in critical roles, can be indicative of a potentially serious problem. Therefore, it is important that senior managers are made aware of such situations so that they can take appropriate response actions.
Training feedback supports the evaluation and update of organizational training described in AT-2b and AT-3b.
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What formal policies and procedures govern the implementation of AT-6 (Training Feedback)?
- •Who are the designated roles responsible for implementing, maintaining, and monitoring AT-6?
- •How frequently is the AT-6 policy reviewed and updated, and what triggers policy changes?
- •What training or awareness programs ensure personnel understand their responsibilities related to AT-6?
Technical Implementation:
- •Describe the specific technical mechanisms or controls used to enforce AT-6 requirements.
- •What automated tools, systems, or technologies are deployed to implement AT-6?
- •How is AT-6 integrated into your system architecture and overall security posture?
- •What configuration settings, parameters, or technical specifications enforce AT-6 requirements?
Evidence & Documentation:
- •What documentation demonstrates the complete implementation of AT-6?
- •What audit logs, records, reports, or monitoring data validate AT-6 compliance?
- •Can you provide evidence of periodic reviews, assessments, or testing of AT-6 effectiveness?
- •What artifacts would you present during a FedRAMP assessment to demonstrate AT-6 compliance?
Ask AI
Configure your API key to use AI features.