The organization:
Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and
Retains individual training records for [FedRAMP Assignment: at least five (5) years or 5 years after completion of a specific training program].