What this requirement asks
Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
This is a CMMC Level 2 requirement in the Awareness & Training family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (4)
- 3.2.1[a] — security risks associated with organizational activities involving CUI are identified
- 3.2.1[b] — policies, standards, and procedures related to the security of the system are identified
- 3.2.1[c] — managers, systems administrators, and users of the system are made aware of the security risks associated with their activities
- 3.2.1[d] — managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system
What an assessor examines
Examine:
- Security awareness and training policy
- procedures addressing security awareness training implementation
- relevant codes of federal regulations
- security awareness training curriculum
- security awareness training materials
- system security plan
- training records
- other relevant documents or records
Interview:
- Personnel with responsibilities for security awareness training
- personnel with information security responsibilities
- personnel composing the general system user community
- personnel with responsibilities for role-based awareness training
Test:
- Mechanisms managing security awareness training
- mechanisms managing role-based security training
Evidence that defends it
Upload training roster exports; evidence of cadence
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.