Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind

frameworkNIST Cybersecurity Framework 2.0 sectionProtect (PR) topicsAwareness & Training frameworks7 3 3

gap from NIST CSF 2.0 → gap to NIST CSF 2.0 →

Wrong or missing mapping? Report it

Equivalents of PR.AT-01 in other frameworks
Framework	Requirement	Title	Link	Source / reason
ISO 27001	A.6.3 Clause 7.3	Information security awareness, education and training; Awareness	Crosswalk	Same topic: Awareness & Training
CIS v8.1	CIS 14.1 CIS 14.9 CIS 14.2 CIS 14.3 CIS 14.4 CIS 14.5 CIS 14.6 CIS 14.7 CIS 14.8	Establish and Maintain a Security Awareness Program; Conduct Role-Specific Security Awareness and Skills Training…	Crosswalk	Same topic: Awareness & Training
SOC 2	CC1.4 CC2.2	Commitment to attracting, developing and retaining competent people; Internal communication of objectives and responsibilities	Editorial	Same topic: Awareness & Training (editorial pick)
PCI DSS	12.6.1 12.6.3	Formal security awareness programme; Awareness training on hire and at least annually	Crosswalk	Same topic: Awareness & Training
CMMC	AT.L2-3.2.1 AT.L2-3.2.2 AT.L2-3.2.3	Role-Based Risk Awareness; Role-Based Training…	Crosswalk	Same topic: Awareness & Training
800-53	AT-2 AT-3	Literacy Training and Awareness; Role-based Training	Crosswalk	Same topic: Awareness & Training
HIPAA	§164.308(a)(5)§164.308(a)(5)(ii)(A)	Security Awareness and Training; Security Reminders	Crosswalk	Same topic: Awareness & Training 3 loosely related (not mappings) §164.308(a)(5)(ii)(B) Protection from Malicious Software Loosely related Only shares CSF PR.AT-01: related, not a mapping §164.308(a)(5)(ii)(C) Log-in Monitoring Loosely related Only shares CSF PR.AT-01: related, not a mapping §164.308(a)(5)(ii)(D) Password Management Loosely related Only shares CSF PR.AT-01: related, not a mapping
GDPR	Art.39(1)(b)	Tasks of the data protection officer	Editorial	Same topic: Awareness & Training (editorial pick)
NIS2	8.1 8.2	Awareness raising and basic cyber hygiene practices; Security training	Crosswalk	Same topic: Awareness & Training
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	Art.5(4)Art.13(6)	Governance and organisation; Learning and evolving	Editorial	Same topic: Awareness & Training (editorial pick)
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.