FISMA Security Awareness Training Requirements (2026)
FISMA training requirements mean annual AT-2 awareness plus AT-3 role-based training under NIST 800-53. See what auditors check in 2026 and how to document it.
DefendWise
DefendWise
FISMA requires every federal agency and every contractor operating on its behalf to complete security awareness training at least annually, plus role-based training for anyone with privileged or significant security responsibilities, under NIST SP 800-53's AT control family. The catch most contractors miss: general annual training satisfies control AT-2, but privileged users — administrators, security officers, anyone with elevated system access — need separate AT-3 role-based training, and skipping that second layer is one of the most common findings cited in FISMA-driven audits in 2026.
TL;DR
- FISMA security awareness training requirements come from NIST SP 800-53 controls AT-2 (annual, all users) and AT-3 (role-based, privileged users).
- No FISMA-specific vendor list or price mandate exists — the agency's system security plan sets frequency and content.
- Contractors inherit the requirement the moment a contract references NIST 800-53 or a FedRAMP-authorized system, not just federal employees.
- AT-4 documentation is the actual audit evidence auditors ask for, not just proof training happened somewhere.
- DefendWise packages annual and role-based training with completion logs MSPs can hand straight to a contracting officer.
Why this matters
FISMA isn't a checkbox you clear once. Agencies report compliance status annually to OMB, and Inspectors General test those controls during yearly FISMA audits — a missing AT-3 record for a privileged user shows up as a finding, not a warning.
For contractors and MSPs supporting federal systems, the exposure is contractual, not academic: a security clause referencing NIST 800-53 training requirements usually flows straight through subcontracts. If a client's authority to operate (ATO) depends on documented training and that documentation doesn't exist, the ATO renewal stalls — and so does the contract.
What are the FISMA security awareness training requirements?
FISMA itself is short on training specifics. The detail lives in NIST SP 800-53's Awareness and Training (AT) family, which is what auditors actually test against.
| Control | Requirement | Who it covers | Frequency |
|---|---|---|---|
| AT-2 | General security awareness training | All system users, including contractor staff | Annually, plus at onboarding |
| AT-3 | Role-based security training | Privileged users, security personnel, incident responders | Annually, tailored to role |
| AT-4 | Training records | Documented proof of completion | Retained per agency policy, produced on audit |
Every organization touching a federal system needs all three — general training covers the workforce, role-based training covers the people with access that could do real damage if compromised, and the records prove both actually happened.
AT-2: annual awareness training for every user
AT-2 is the baseline. It covers phishing recognition, password hygiene, insider threat basics, and incident reporting procedures, delivered at onboarding and then repeated annually for every user with system access — federal employee or contractor, no exceptions.
Content has to reflect current attack methods, not a static slideshow written in 2019. NIST SP 800-50 (the companion guidance on building an awareness program) expects the material to stay current, which is why agencies increasingly favor platforms that update simulation and course content on a rolling basis rather than a fixed annual refresh.
AT-3: role-based training for privileged and security personnel
AT-3 is where most gaps show up. System administrators, security officers, incident responders, and anyone with elevated or privileged access need training tailored to that role — deeper technical content than the general AT-2 course covers.
This is a separate control with its own evidence trail. An organization that runs one annual training for everyone and calls it done has satisfied AT-2 and left AT-3 unaddressed — auditors flag this constantly, and it's a frequent overlap point with CMMC requirements for defense contractors, which layer similar role-based expectations on top of FISMA-adjacent frameworks.
AT-4: training records as your audit evidence
AT-4 is the part that turns training into compliance. Records need completion dates, user identities, and the specific content each person received — not a generic "training completed" line item.
This is where most in-house tracking breaks down: spreadsheets go stale, seat-count licensing creates gaps when headcount changes, and nobody notices until an IG audit asks for six months of history. A security awareness training platform that logs completion automatically solves the AT-4 problem before it becomes a finding — DefendWise runs on a flat-fee, unlimited-seat model specifically so contractors and the MSPs serving them can add users mid-year without re-licensing, and every completion generates the record an auditor expects.
Why FISMA training scope varies by organization
The controls are the same across agencies; how deep each one goes is not. Factors that change the scope:
- System security categorization under FIPS 199 (low, moderate, high impact) shapes how much depth AT-3 content needs
- Overlap with FedRAMP or CMMC-aligned programs, which reference the same NIST 800-53 control family but add their own documentation expectations
- Number of privileged-access users — more admins and security staff means more AT-3 records to maintain
- Contract language citing a specific NIST 800-53 revision — Rev 5 tightened some AT expectations compared to Rev 4
- Cadence set in the system security plan — some agencies require training more often than the annual minimum
- Contractor workforce size and turnover, which drives how often AT-2 onboarding training gets triggered
See how the evidence trail works
Flat-fee training built to produce AT-2, AT-3, and AT-4 records automatically.
Does FISMA require annual security awareness training?
Yes — FISMA requires annual security awareness training at minimum, under NIST SP 800-53 control AT-2, for every user with access to a federal information system. Agencies can require more frequent training in their system security plan, but annual is the floor, not a suggestion.
Who has to complete FISMA security awareness training?
Every user of a federal information system has to complete FISMA security awareness training, including federal employees, contractors, subcontractors, and MSP technicians with access under a client contract. Privileged users additionally need AT-3 role-based training on top of the general course.
How is FISMA training different from NIST 800-53 training?
FISMA is the law; NIST SP 800-53 is the control catalog agencies and contractors use to prove they comply with it. There's no separate "FISMA training" course distinct from the AT-2 and AT-3 controls — meeting NIST 800-53's Awareness and Training family is how FISMA training requirements get satisfied in practice.
FAQ
What is FISMA security awareness training?
FISMA security awareness training is the annual and role-based training required under NIST SP 800-53 controls AT-2 and AT-3 for anyone with access to a federal information system. It covers phishing recognition, password hygiene, and incident reporting at minimum, with deeper technical content for privileged users.
How much security awareness training does FISMA require?
FISMA does not set an hours minimum. It requires annual completion under NIST SP 800-53 AT-2, with each agency's system security plan defining course length and specific content.
Do government contractors need FISMA training?
Yes, government contractors need FISMA training whenever a contract gives them access to a federal information system or references NIST 800-53 controls. The requirement flows through subcontracts the same way it applies to federal employees.
What's the difference between FISMA and FedRAMP training requirements?
FedRAMP references the same NIST SP 800-53 Awareness and Training controls FISMA uses, so the training content overlaps heavily. FedRAMP adds its own authorization and continuous monitoring documentation on top of the same AT-2 and AT-3 baseline.
Is phishing simulation required under FISMA?
FISMA does not name phishing simulation by title, but AT-2 general awareness content commonly includes phishing recognition, and CISA guidance recommends simulated phishing as a practical way to satisfy that intent.
How often must role-based FISMA training happen?
Role-based FISMA training under AT-3 happens at least annually, the same minimum as general AT-2 training, though agencies can require more frequent refreshers when a user's role or system risk level changes.
What happens if an agency fails FISMA training requirements?
A missed AT-2 or AT-3 requirement shows up as a finding in the agency's annual FISMA report to OMB or during an Inspector General audit, and it can hold up authority-to-operate renewal for the affected system.
Can MSPs deliver FISMA-compliant training for contractor clients?
Yes, MSPs can deliver FISMA-compliant training for contractor clients using a white-label security awareness training platform that logs AT-2 and AT-3 completion per subclient without per-seat licensing friction as headcount changes.
One last thing
The part most contractors get wrong isn't the training itself — it's that AT-2 and AT-3 are treated as one control instead of two, and AT-3's role-based record is the one auditors ask for first in 2026 FISMA reviews. If a system security plan lists privileged users, there needs to be a separate, dated record for each one, not a line item buried inside the general annual course. Check whether your current training vendor tracks AT-2 and AT-3 as distinct records — if it doesn't, that's the gap an IG audit finds.