# NIST800 53 AT-2(1) — Practical Exercises

- Source: https://support.icompaas.com/support/solutions/articles/a_gen_nist80053_at21_c3d352ec6a-nist800-53-at-21-practical-exercises
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [NIST](https://support.icompaas.com/support/solutions/62000112528) › [Awareness and Training](https://support.icompaas.com/support/solutions/folders/f_gen_62000112528_awarenessandtraining)
- Last updated: 2026-05-30
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

NIST800 53 · Control AT-2(1) · Priority: high · Component: Awareness and Training

### What this control covers

Includes practical exercises in literacy training to simulate events like social engineering, enhancing user ability to respond to security and privacy incidents. This control supports the Simulation Training Platform capability within the Awareness and Training family.

### Why it matters

How quickly and methodically you contain an incident determines the regulatory consequence — most fines are not for the breach itself but for the slow or absent response.

### How to implement

#### AWS

Wire **GuardDuty**, **Security Hub** and **Macie** findings into your ticketing/SIEM via EventBridge. Maintain documented playbooks for IAM-key compromise, EC2 instance compromise, S3 data exposure, and run **quarterly tabletop exercises**.

#### Azure

Use **Defender for Cloud** + **Microsoft Sentinel** with playbooks (Logic Apps) for automated containment — disable user, isolate VM (NSG), revoke session tokens. Keep an on-call rotation in Teams with PagerDuty.

#### GCP

**Org Policy Service** for guardrails and **Config Validator** in CI to pre-check Terraform plans against policy as code (Rego).

#### Google Workspace

Use **Data Export** (Takeout-style) and **Vault search** to scope DSARs. Apply **Drive labels + DLP** so personal data classes are discoverable.

#### GitHub

Subscribe to **secret-scanning** alerts and **Dependabot** security advisories; require triage SLAs by severity. For exposed secrets, rotate at the cloud provider FIRST then revoke at GitHub — order matters.

#### On-premises

Roll out role-based security awareness annually + phishing simulations quarterly. Track completion in your LMS and tie to performance review for repeat-fails.

### Evidence to collect

-   `ticketing_workflow` — See the iCompaas Evidence library for the canonical source for this evidence type.

Workflow metrics (ServiceNow, Jira) show approvals and remediation. Focus: Practical Exercises.

### Quick checklist

-   Security — Management / Privacy
-   Literacy — Management / Privacy
-   Practical — Management / Privacy
-   Social — Management / Privacy
-   Response — Management / Privacy
-   Control — Management / Privacy

### Related articles on this site

-   [NIST 800-171 3.6.1 Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.](https://support.icompaas.com/support/solutions/articles/62000229301-nist-800-171-3-6-1-establish-an-operational-incident-handling-capability-for-organizational-systems-t)
-   [CMMC 2.0 IR.2.092 Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.](https://support.icompaas.com/support/solutions/articles/62000229547-cmmc-2-0-ir-2-092-establish-an-operational-incident-handling-capability-for-organizational-systems-th)
-   [Ensure that 'Restrict user ability to access groups features in the Access Pane' is set to 'No'](https://support.icompaas.com/support/solutions/articles/62000219694-ensure-that-restrict-user-ability-to-access-groups-features-in-the-access-pane-is-set-to-no-)
-   [Ensure Diagnostic Setting captures appropriate categories from the control/management plane](https://support.icompaas.com/support/solutions/articles/62000219824--ensure-diagnostic-setting-captures-appropriate-categories-from-the-control-management-plane)

## Related compliance guidance

- [NIST SP 800-53 Rev. 5: a practical implementation guide for cloud teams](https://support.icompaas.com/compliance/nist-sp-800-53-rev-5): How the 800-53 catalogue, baselines and the Risk Management Framework fit together, and which controls take the most work in the cloud.
- [NIST SP 800-171 and CMMC: a practical guide to protecting CUI in the cloud](https://support.icompaas.com/compliance/nist-sp-800-171-rev-3): If the driver is a DoD or federal contract handling CUI, 800-171 (and CMMC) is the scope you actually need.