Awareness & Training
Awareness and Training makes sure the people handling CUI actually know the risks and their own responsibilities. Technology fails when a well-meaning employee clicks the wrong link, so this family treats your team as part of the control set.
The 3 Awareness & Training requirements
9 assessment objectives across this family.
- 3.2.1Role-based Risk AwarenessEnsure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.5 pt✕ POA&M
- 3.2.2Role-based TrainingEnsure that personnel are trained to carry out their assigned information security-related duties and responsibilities.5 pt✕ POA&M
- 3.2.3Insider Threat AwarenessProvide security awareness training on recognizing and reporting potential indicators of insider threat.1 pt
Build Awareness & Training, and all 14 families, with an officer
The Level 2 workspace walks your team through all 110 requirements at the objective level, drafts your SSP section by section from your own record for your team to read and accept, gives a prime or your own internal auditor a read only seat on the same record, and a credentialed officer reviews every step.
Book a free advisory callNo credit card, and Level 1 and Level 2 are both open, so sign up for the level your contracts call for. Self assessed and self attested: you score yourself in SPRS on a three year cycle and your senior official affirms it every year. As of September 3, 2026 a class deviation directs contracting officers to remove third party assessment from contracts. The program rule still provides for it, so your solicitation sets the track. Your team builds the same evidence either way. DFARS 252.204-7012 is unaffected, and the NIST SP 800-171 Rev 2 baseline is unchanged.
Questions, answered
How many CMMC Level 2 requirements are in Awareness & Training?+
The Awareness & Training family (AT) has 3 of the 110 CMMC Level 2 requirements, assessed against 9 objectives from NIST SP 800-171A.
What is the Awareness & Training family about?+
Awareness and Training makes sure the people handling CUI actually know the risks and their own responsibilities. Technology fails when a well-meaning employee clicks the wrong link, so this family treats your team as part of the control set.