NIST CSF security awareness training
NIST CSF 2.0 is voluntary, but its PR.AT category asks for awareness training for all personnel and for specialised roles, and buyers, insurers and agencies keep asking how you meet it.
Five-to-ten-minute 3D exercises mapped to each NIST CSF duty, with completion evidence your auditor can export.
At a glance
- Framework
- NIST CSWP 29, CSF 2.0, published 26 February 2024
- Training outcomes
- PR.AT-01 all personnel; PR.AT-02 specialised roles
- Status
- Voluntary; no fines of its own
- Structure
- Six Functions: Govern, Identify, Protect, Detect, Respond, Recover
Where people show up in all six Functions
Training lives in Protect, but every Function has an outcome that depends on what staff notice and do.
- GV Govern GV.RR: leadership is accountable, and roles and responsibilities are set and communicated.
- ID Identify Staff know which data and devices matter, so they can tell when something is off.
- PR Protect PR.AT-01 and PR.AT-02: awareness and training for everyone and for specialised roles.
- DE Detect A suspicious email or login prompt is often first spotted by the person who received it.
- RS Respond RS.CO-02: internal and external stakeholders are notified of incidents.
- RC Recover Staff follow the recovery plan and avoid reopening the hole the attacker used.
The CSF lists outcomes. It leaves the how, including the training format, to you.
The NIST CSF 2.0 path, eleven steps
One learning path covers the PR.AT-01 baseline, from your policies to incident reporting, and repeats every 12 months.
- Policy first
- Security Policies & Your Role opens the path and ties it to GV.RR.
- Reporting built in
- Incident Reporting and Real-World Incidents cover the RS.CO hand-off.
- Annual by default
- The path reassigns every 12 months, with a PDF certificate per learner.
PR.AT and its neighbours, matched to exercises
The CSF subcategories a reviewer is most likely to ask about, next to the scenario that covers each one.
GV.OC / PR.AT-1 Awareness & Training ID.RA Risk Assessment (incl. AI risk) PR.AA Identity Management & Authentication PR.DS Data Security PR.IR Infrastructure Resilience & Backup DE.AE / DE.CM Anomaly & Event Detection RS.MA / RS.CO Incident Response & Communication PR.PS Platform Security CSF outcomes your staff carry outside PR.AT
Subcategories outside PR.AT that still depend on trained staff.
GV.RR-02: roles and responsibilities are known
Security Policies & Your Role gives every learner the policy basics and their part in them.
That makes GV.RR-02 something people can describe, not just a document on a shared drive.
GV.SC-06: due diligence before new suppliers
Payment change requests and fake vendor emails test whether staff check a supplier before acting.
The Business Email Compromise and Verification Procedures scenarios rehearse the call-back.
DE.CM-03: personnel activity and technology use
Detection tools catch a lot, but a learner who spots an odd MFA prompt or a fake login page is often faster.
The phishing, smishing and MFA fatigue exercises practise that first look.
RS.CO-02 and RS.CO-03: notify and share
Incident Reporting walks through what to report and to whom.
Real-World Incidents shows what happened in cases where the report came late or never came.
How a CSF program reaches PR.AT
How the Core, Profiles and Tiers turn PR.AT into something you can show.
01 Stage 1: Set roles under Govern (GV.RR)
GV.RR-01 makes organisational leadership responsible and accountable for cybersecurity risk. GV.RR-02 asks that roles and responsibilities be established, communicated and enforced.
This is where you decide who owns the training program and which roles count as specialised for PR.AT-02.
02 Stage 2: Write a Current and Target Profile
A CSF Organizational Profile describes where you are now and where you want to be, outcome by outcome.
For PR.AT, the gap is usually concrete: training exists but is not role-based, or it happens but leaves no record.
03 Stage 3: Deliver the PR.AT-01 baseline
Everyone gets the same core: policies, phishing, passwords, data handling, devices, browsing and reporting.
Running it as an assigned learning path gives each person a start date, a due date and a completion record.
04 Stage 4: Add PR.AT-02 role scenarios
Specialised roles face specific attacks. Finance gets invoice and payment fraud, the help desk gets password reset pretexts, executives get deepfake calls.
Pick the roles from your GV.RR decisions so the two outcomes line up.
05 Stage 5: Connect training to reporting (RS.CO)
RS.CO-02 expects internal and external stakeholders to be notified of incidents. That chain starts when an employee reports what they saw.
Train the reporting route itself: who to tell, how fast, and what to keep.
06 Stage 6: Choose a Tier and keep evidence
CSF Tiers run from Partial (Tier 1) through Risk Informed and Repeatable to Adaptive (Tier 4).
A one-off session with no records reads as Tier 1. Scheduled, recurring assignments with completion data are what a Repeatable claim needs.
07 Training that reads well against PR.AT
PR.AT-01 asks for knowledge and skills, not attendance. Interactive exercises make learners act: open the inbox, judge the link, decide whether to report.
The result is a record of a decision, which says more than a video view.
PR.AT-02 needs a role split. A practical version:
- All staff: the eleven-step CSF path.
- Finance and accounts payable: business email compromise and verification.
- IT and help desk: MFA fatigue and reset pretexts.
- Executives: deepfake voice and video drills.
Keep the proof where reviewers can read it. RansomLeak gives a PDF certificate per learner, a tenant CSV export and a compliance report page, and can sync completions to Vanta or Drata.
Recommended exercises
A shared baseline for PR.AT-01, then role scenarios for PR.AT-02.
- Phishing The core PR.AT-01 scenario: judging an email before clicking. Try the exercise
- Smishing Text message lures, which skip the email filter entirely. Try the exercise
- MFA Fatigue Attack For IT and help desk under PR.AT-02: repeated push prompts and reset pretexts. Try the exercise
- Business Email Compromise For finance under PR.AT-02 and GV.SC-06: changed bank details from a known supplier. Try the exercise
- Verification Procedures The call-back habit that turns a suspicious request into a checked one. Try the exercise
- Whaling With A Deepfake For executives under PR.AT-02: a cloned voice or face asking for money. Try the exercise
- General Incident Reporting The first link in the RS.CO-02 notification chain. Try the exercise
Further reading
Related glossary terms
References
Give PR.AT an answer you can export
Assign the CSF path once, and pull completion records whenever a customer or insurer asks.
Frequently asked questions
What is NIST CSF security awareness training?
The NIST Cybersecurity Framework (CSF) 2.0 is a voluntary set of cybersecurity outcomes published by the US National Institute of Standards and Technology in February 2024. Its Awareness and Training category, PR.AT, expects all personnel and those in specialised roles to get the knowledge and skills to do their work with cybersecurity risk in mind.
Does NIST CSF require security awareness training?
CSF 2.0 includes it as an outcome. The Awareness and Training category (PR.AT) has two subcategories: PR.AT-01 for all personnel and PR.AT-02 for individuals in specialised roles.
Because the CSF is voluntary, "require" only applies if you, a customer contract or a regulator adopts it.
What are PR.AT-01 and PR.AT-02?
PR.AT-01: personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind.
PR.AT-02: individuals in specialised roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind.
Are there penalties for not following NIST CSF?
Not from NIST. The framework has no fines, audits or certification of its own.
Consequences come from whoever adopted it: a customer contract, a federal agency policy or an internal commitment you made to your board.
How often should NIST CSF training happen?
The CSF does not set a frequency. Annual training for all staff is a common baseline, with extra scenarios after a role change or an incident.
The RansomLeak CSF path reassigns every 12 months.
What changed for training in CSF 2.0?
In version 2.0, awareness and training is the PR.AT category with two subcategories. The new Govern Function adds GV.RR, which puts accountability for cybersecurity on leadership and asks that roles be set and communicated.
That makes it easier to link who gets PR.AT-02 training to decisions made under Govern.
Can I get certified against NIST CSF?
NIST does not certify organisations against the CSF. Organisations describe their alignment through Profiles and Tiers, and some ask a third party to assess it.
Training records are one of the easiest pieces of that assessment to prove.