Security awareness training that actually satisfies auditors

Security awareness training shows up on almost every audit: CJIS audits for law enforcement, exams for community banks, and more and more cyber insurance applications. The training itself is rarely the problem. The records usually are.

Here’s what auditors look for, with CJIS as the example, since its requirements are some of the most specific.

What the CJIS Security Policy requires

Under the current CJIS Security Policy (the Awareness and Training section, AT-1 through AT-4), agencies need:

• Written policy and procedures for awareness and training, reviewed and updated regularly (AT-1).
• Literacy training for every user before they first access criminal justice information, and annually after that (AT-2). Training is also required when systems change, and within 30 days of a security event for the people involved. Older policy versions allowed training every two years; the annual requirement is a change many agencies are still catching up on.
• Role-based training matched to what people actually do, from general users to privileged users and security staff (AT-3).
• Training records kept for each person (AT-4).

It’s not just officers and dispatchers. Training applies to everyone with access to criminal justice information, including IT staff, contractors, and vendors, and people with unescorted access to secure areas, such as custodial staff.

Your state’s CJIS Systems Agency may deliver training through its own platform and set its own schedule, so always confirm specifics with them.

What auditors want to see

An auditor will usually pick a few names and ask for proof. Be ready with:

• A current list of everyone who needs training, including contractors and vendors
• Each person’s completion date, by name, showing training before access and within the last year
• Which course or level they took, matched to their role
• Your written training policy
• Proof for new hires that training came before their first access

Make the records easy

Most findings come from missing or scattered records, not from people skipping training. Some simple habits:

• Keep one spreadsheet or system listing every person, their role, and their last completion date.
• Add training to onboarding, right next to account creation, so nobody gets access first. The free onboarding and offboarding checklist has a spot for it.
• Set a reminder a month before each anniversary so annual training never lapses.
• Save certificates or completion reports in your audit evidence folder. See the free CJIS audit evidence checklist.

Beyond CJIS

Banks, healthcare offices, and cyber insurers all ask about training too, with different specifics. The same record-keeping habits work for all of them: know who needs it, prove they got it, and keep it current.

Sources

• CJIS Security Policy AT-2, literacy training and awareness (control text): training before accessing CJI and annually, and within 30 days of a security event
• CJIS updates: awareness and training (Utah CJIS TAC): the modernized AT-1 through AT-4 requirements
• Training and security awareness (Utah CJIS TAC): role-based training and who must be trained, including non-users with unescorted access
• CJIS Security Policy Resource Center (FBI): the current policy documents