The organization:
a. Documents and monitors individual information system security training activities including basic security awareness training and specific information system security training; and
b. Retains individual training records for [Assignment: organization-defined time period].
b. at least 5 years or 5 years after completion of a specific training program
Source:
DoD RMF TAG
Documentation for specialized training may be maintained by individual supervisors at the option of the organization.