What this requirement asks
Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
This is a CMMC Level 2 requirement in the Awareness & Training family, drawn from NIST SP 800-171 Rev. 2. An assessor evaluates it objective by objective — every objective below must be supported by evidence, not just described in a policy.
Assessment objectives (3)
- 3.2.2[a] — information security-related duties, roles, and responsibilities are defined
- 3.2.2[b] — information security-related duties, roles, and responsibilities are assigned to designated personnel
- 3.2.2[c] — personnel are adequately trained to carry out their assigned information security- related duties, roles, and responsibilities
What an assessor examines
Examine:
- Security awareness and training policy
- procedures addressing security training implementation
- codes of federal regulations
- security training curriculum
- security training materials
- system security plan
- training records
- other relevant documents or records
Interview:
- Personnel with responsibilities for role-based security training
- personnel with assigned system security roles and responsibilities
- personnel with responsibilities for security awareness training
- personnel with information security responsibilities
- personnel representing the general system user community
Test:
- Mechanisms managing role-based security training
- mechanisms managing security awareness training
Evidence that defends it
Show job role to training mapping and completion
Check your readiness
Score this requirement against your own environment with the Level 2 self-assessment checklist, or estimate your SPRS score with the free CMMC compliance tool. Self-reported answers are planning signals only — they do not establish a verified or assessor-accepted result.