The organization: AT-1a.
Develops, documents, and disseminates to Assignment: organization-defined personnel or roles: AT-1a.1.
A security awareness and training policy that addresses purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance; and AT-1a.2.
Procedures to facilitate the implementation of the security awareness and training policy and associated security awareness and training controls; and AT-1b.
Reviews and updates the current: AT-1b.1.
Security awareness and training policy Assignment: organization-defined frequency; and AT-1b.2.
Security awareness and training procedures Assignment: organization-defined frequency.