{"id":"VAL-005","section":"AI Usage, Spend & Value","requirement":"Generate targeted training and enablement recommendations","acceptance":"Turn observed usage and detection telemetry into prioritized interventions, templates, coaching and sanctioned-tool adoption, aimed at the teams and behaviors that actually generate risk, and measure whether behavior changes.","tier":"","whyItMatters":"Training aimed at the teams and behaviors that actually create risk works better than blanket training.","verificationMethod":"POV","verificationTest":"Prioritized enablement recommendations from pilot data, and a measure of whether behavior changed.","formerly":null,"alsoIn":[],"sort":49,"adoptionContext":"Training recommendations should reflect observed needs across the listed employee AI contexts instead of assuming that adoption tier determines competence.","mappings":[{"frameworks":["csf","rmf","iso","soc2"],"explanation":"Usage and detection telemetry can target AI/security training and coaching at relevant teams and roles, while behavior changes provide evaluation evidence. Recommendations do not establish delivered training or required competence; effectiveness measures must relate to the awareness or risk-control objective being evaluated.","kind":"framework","references":{"csf":["PR.AT-01","PR.AT-02"],"rmf":["GOVERN 2.2"],"iso":["Cl. 7.2","Cl. 7.3"],"soc2":["CC1.4","CC2.2","CC4.1"]},"relation":null,"conditions":[]},{"frameworks":["iso27001"],"explanation":"Measured changes in risky behavior provide security-effectiveness evidence; targeted coaching can support awareness when it reaches employees. Define the relevant objective, baseline, responsibility, measurement cadence and evaluation. Recommendations alone are not delivered training and do not determine or assess required competence.","kind":"framework","references":{"iso27001":["Cl. 9.1","Cl. 7.3","A.6.3"]},"relation":null,"conditions":[]}],"area":"AI Usage, Spend & Value","areaSlug":"VAL","url":"/r/VAL-005","frameworkRefs":{"ISO27001":["Cl. 9.1","Cl. 7.3","A.6.3"],"ISO42001":["Cl. 7.2","Cl. 7.3"],"NIST-CSF":["PR.AT-01","PR.AT-02"],"NIST-AI-RMF":["GOVERN 2.2"],"SOC2":["CC1.4","CC2.2","CC4.1"]}}