Awareness and Training is a small family — three requirements — but two of them carry five points each, which gives it one of the highest point densities in the standard. It covers three things: making sure everyone with access understands the risks and their obligations, training people for the security duties their roles require, and teaching staff to recognize insider threat.
Generic security awareness training rarely satisfies it on its own, because the requirements are about CUI and about the specific duties people perform inside your environment.
What the Awareness and Training family covers
Awareness and Training contains 3 requirements, numbered 3.2.1 to 3.2.3 in NIST SP 800-171 Revision 2. In CMMC Level 2 they carry the practice prefix AT.L2, so 3.2.1 appears as AT.L2-3.2.1.
The family touches every person with access to the CUI environment, including executives, administrators, engineers and contractors. Its scope should be read together with CUI marking and what CUI is, because handling CUI correctly is the content most training programs leave out.
| Requirement | What it requires | SPRS points | POA&M |
|---|---|---|---|
| 3.2.1 | Ensure managers, administrators and users are aware of security risks and applicable policies | 5 | No |
| 3.2.2 | Ensure personnel are trained to carry out their assigned security-related duties | 5 | No |
| 3.2.3 | Provide security awareness training on recognizing and reporting potential indicators of insider threat | 1 | Eligible |
Point values from the DoD Assessment Methodology v1.2.1. POA&M eligibility under 32 CFR 170.21.
What it costs you in SPRS points
The family puts 11 of the 313 deductible points in the SPRS score at risk. The five-point requirements are 3.2.1 and 3.2.2. The remaining 1 is worth one point each.
Eleven points from three requirements is 3.67 points per requirement, well above the standard's average of 2.85. A company with no training program at all loses 11 points immediately, and because 3.2.1 and 3.2.2 are worth five points each, neither can be deferred on a POA&M under the CMMC rule.
Where training programs fall short
The usual failure is not the absence of training but the absence of the right training. An annual phishing module satisfies part of 3.2.1 but says nothing about how to recognize, mark, store, transmit and destroy CUI, which is what most people in the boundary actually need to know. Requirement 3.2.2 is more often missed entirely: system administrators, help-desk staff and developers have security duties that need specific instruction, and assessors will ask what training they received.
Frequency is the other gap. The standard does not set an interval, so your policy must — typically on hire, annually, and when systems or procedures change — and records must show it happened.
Building training that satisfies all three requirements
A workable program has three layers. Everyone in the boundary completes general awareness training that includes a CUI module on identifying, marking, storing, sending and destroying CUI. People with security duties — administrators, help desk, developers, managers who approve access — complete role-based training tied to their procedures. Everyone completes an insider-threat module explaining the indicators to watch for and how to report concerns confidentially. Each layer has a defined frequency and a completion record by name and date, so the evidence for all three requirements comes from the same system.
What you can and cannot defer
Under 32 CFR 170.21 only one-point requirements may be placed on a POA&M, with the single exception of 3.13.11 when encryption exists but is not FIPS-validated. In this family that makes 3.2.3 eligible for deferral.
Only 3.2.3, insider threat awareness, is eligible for deferral. In practice it is usually cheaper to add an insider-threat module to the existing program than to carry it on a POA&M.
Evidence assessors expect
Assessors work at the level of the objectives in NIST SP 800-171A and use examine, interview and test. For this family, have the following ready — the full evidence package checklist covers all 14 families:
- Training content for general users that covers CUI identification, marking and handling.
- Role-based training materials for administrators and other security roles.
- Completion records by name and date, including new starters and contractors.
- An insider-threat module covering indicators and how to report them.
- A policy stating who must be trained, on what, and how often.
Frequently asked questions
Does a commercial phishing-training platform satisfy AT?
Partly. It usually covers general awareness under 3.2.1. You still need CUI-specific content, role-based training under 3.2.2 and insider-threat awareness under 3.2.3.
Do contractors and temporary staff need training?
Yes, if they have access to systems in the CUI boundary. Training must be complete before access is granted.
Can DoD CUI training satisfy the requirement?
The DoD mandatory CUI training is a good resource for CUI-handling content, but you still need records and role-based training for your own environment.
How long should CUI training take?
There is no minimum. A focused 20 to 30 minute CUI module, plus role-based sessions for administrators, is common. Completion records matter more than duration.