Which security control is addressed by NIST SP 800-50?

• A. AT-4 Security Training Records
• B. AT-1 Security Awareness and Training Policy and Procedures
• C. AT-2 Security Awareness Training
• D. AT-3 Role-Based Training

Answer: (A)

NIST SP 800-50 focuses on building an information security awareness and training program, covering policy and procedures, general security awareness training, and role-based training as components of an effective program. It also emphasizes maintaining documentation of training activities. The security training records control is about keeping evidence of who has completed training, what was completed, and when, which supports audits, accountability, and ongoing program improvement. Among the options, this records-focused control best aligns with the guidance in 800-50, since the training records provide the verifiable documentation that underpins the entire training program. The other options describe parts of the program, but they are not the element most directly associated with the program’s documentation and evidence requirements.