AT-4—Training Records

Document and monitor information security and privacy training activities, including security and privacy awareness training and specific role-based security and privacy training; and

Retain individual training records for ⚙organization-defined time period.