# VAL-005: Generate targeted training and enablement recommendations


- Area: AI Usage, Spend & Value

- Verification: Proof of value

- URL: /r/VAL-005

**Acceptance criteria:** Turn observed usage and detection telemetry into prioritized interventions, templates, coaching and sanctioned-tool adoption, aimed at the teams and behaviors that actually generate risk, and measure whether behavior changes.

**Why it matters:** Training aimed at the teams and behaviors that actually create risk works better than blanket training.

**How to verify:** Prioritized enablement recommendations from pilot data, and a measure of whether behavior changed.

**OWASP adoption context:** Training recommendations should reflect observed needs across the listed employee AI contexts instead of assuming that adoption tier determines competence.

**Mappings:**
- NIST CSF 2.0: PR.AT-01, PR.AT-02; NIST AI RMF: GOVERN 2.2; ISO 42001: Cl. 7.2, Cl. 7.3; SOC 2: CC1.4, CC2.2, CC4.1 — Usage and detection telemetry can target AI/security training and coaching at relevant teams and roles, while behavior changes provide evaluation evidence. Recommendations do not establish delivered training or required competence; effectiveness measures must relate to the awareness or risk-control objective being evaluated.
- ISO 27001: Cl. 9.1, Cl. 7.3, A.6.3 — Measured changes in risky behavior provide security-effectiveness evidence; targeted coaching can support awareness when it reaches employees. Define the relevant objective, baseline, responsibility, measurement cadence and evaluation. Recommendations alone are not delivered training and do not determine or assess required competence.