AT-4 Training records
Requires training activity to be documented and monitored across both general awareness and role-based training, and requires individual training records to be kept for an organization-defined retention period.
4
artefacts
2
held by a system
1
at each review
easy
to go live
SIEM / log platform
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Monitoring report showing outstanding or overdue training being chased · SIEM / log platform
- Retained records for leavers covering the required period · Identity provider / directory
periodic reviewEvidence produced at each review
- Defined retention period for training records and evidence it is applied · HR system / LMS
governing documentDocuments that govern the control
- Training register listing individuals, courses completed and dates · HR system / LMS
First move
Automate the pull from your SIEM / log platform. Retention and alert rules exported from the SIEM; review evidence is the closed-alert record with reviewer and time.
Common gaps auditors find
- Records live inside a learning platform whose retention is shorter than the defined period
- Role-based training tracked informally by managers and never consolidated
- No monitoring of non-completion, so overdue training is invisible
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheet