Which security control is addressed by NIST SP 800-16?

• A. AT-2 Security Awareness
• B. AT-1 Security Awareness and Training Policy and Procedures
• C. AT-3 Role-Based Training
• D. AT-4 Security Training Records

Answer: (A)

NIST SP 800-16 focuses on security awareness training for federal information systems. It provides guidance for creating and running an organization-wide awareness program that educates users about common threats, safe practices, and their security responsibilities, with ongoing updates and refreshers to keep awareness current. This emphasis on broad-based awareness and education is what aligns with the security awareness concept, rather than policy development (AT-1), role-based training tailored to specific jobs (AT-3), or maintaining training records (AT-4). So the best match is Security Awareness, since 800-16 aims to ensure that all users understand security risks and how to act to mitigate them.