# SP-014 Awareness and Training Pattern

Status: published. Release 26.02. Modified 2026-02-06. Licence: CC BY-SA 4.0.

Scope: Security architecture for building and sustaining an effective security awareness and training program. Covers role-based training, phishing simulation, security culture, third-party personnel, incident reporting behaviour, and compliance training obligations.
Use when: All organisations that employ people or engage third parties with system access should implement this pattern. It is universally applicable and is a mandatory requirement under virtually every compliance framework (ISO 27001 A.6.3, NIST CSF GV.AT, PCI DSS 12.6, SOC 2 CC1.4, CIS Control 14).
Not when: There are no legitimate contra-indications for this pattern.

## Controls (17, NIST SP 800-53 ids)
- Critical (3): AT-02, AT-03, PS-06
- Important (10): AT-01, AT-04, IR-02, PL-04, PS-01, PS-02, PS-03, PS-07, PS-08, RA-03
- Standard (4): AT-05, CP-03, PS-04, PS-05
- Withdrawn from SP 800-53 by NIST: AT-05 (now in PM-15)

## What each critical control mitigates (3)
- AT-02 Literacy Training and Awareness: T-AT-001, T-AT-002, T-AT-003, T-AT-004, T-AT-005, T-AT-006, T-AT-007, T-AT-008
- AT-03 Role-based Training: T-AT-001, T-AT-003, T-AT-005, T-AT-009
- PS-06 Access Agreements: T-AT-002, T-AT-003, T-AT-005, T-AT-007, T-AT-010

## Threats and the controls that mitigate them (10)
- T-AT-001 Social Engineering and Phishing: AT-02, AT-03, IR-02, PL-04
- T-AT-002 Insider Threat (Malicious or Negligent): PS-02, PS-03, PS-06, PS-08, AT-02
- T-AT-003 Credential Compromise (Weak Passwords, Sharing, Reuse): AT-02, AT-03, PL-04, PS-06
- T-AT-004 Policy Non-Compliance and Shadow IT: AT-02, PL-04, PS-08, AT-01
- T-AT-005 Data Handling Errors (Misclassification, Misdirection): AT-03, AT-02, PL-04, PS-06
- T-AT-006 Physical Security Breaches (Tailgating, Clean Desk Failures): AT-02, PL-04, PS-08
- T-AT-007 Third-Party Personnel Security Failures: PS-07, PS-03, AT-02, PS-06
- T-AT-008 Delayed Incident Reporting: IR-02, AT-02, PL-04, AT-01
- T-AT-009 Business Continuity Failures Due to Untrained Personnel: CP-03, AT-03, IR-02
- T-AT-010 Regulatory Non-Compliance (Training Obligations): AT-01, AT-04, PS-06, RA-03

## More
- The critical controls and what each mitigates, as JSON (a few KB): /api/v1/patterns/SP-014/crosswalk?emphasis=critical
- The same for every control, with its clauses in a framework: /api/v1/patterns/SP-014/crosswalk?framework={framework id}. Framework ids are listed in /llms.txt
- The pattern's prose, examples and references as JSON, 22 KB: /api/v1/patterns/SP-014
- Page for people: /patterns/sp-014/
- Found an error? Open an issue at https://github.com/opensecurityarchitecture/osa-data/issues with the id, what OSA says and what the source says.
- Related: SP-010 Identity Management Pattern; SP-013 Data Security Pattern; SP-018 Information Security Management System; SP-025 Advanced Monitoring and Detection; SP-027 Secure LLM Usage

This card, the API and the page are generated from one file. Checking one against another adds no evidence.