CMMC 3.2.1 Security Awareness Training
Ensure that managers, system administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
CMMC 3.2.1 in plain English
Control 3.2.1 sits in the Awareness and Training family. It ensures that the humans operating your systems understand the risks, the policies, and the part they play in protecting CUI.
NIST text (verbatim)
- Ensure that managers, system administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
- Family: Awareness and Training (3.2.x)
- Requirement type: Basic Security Requirement
What that means in practice
- Annual general security awareness training tracked per user.
- Role-based deep-dive training for sysadmins, developers, and CUI handlers.
- Insider-threat indicators built into the awareness curriculum.
Where to get security awareness training that maps to CMMC practice AT.L2-3.2.1
Petronella Technology Group, Inc. (Cyber AB Registered Provider Organization #1449) sells a self-paced CMMC Level 2 Security Awareness course built for AT.L2-3.2.1. It covers DFARS 252.204-7012, FCI versus CUI, CUI marking and handling, insider-threat indicators, phishing, vishing, smishing and BEC, passphrases and MFA, and incident reporting. The course supports this practice; it does not by itself make you CMMC compliant.
- CMMC Level 2 Security Awareness: Common Core: $49 per learner, about 63 minutes, maps to AT.L2-3.2.1 and AT.L2-3.2.3 (insider threat).
- CMMC Level 2 Awareness and Training License: $300 per user per year for all three courses, one enrollment code for the whole organization, 1 to 500 users, card checkout or invoice at 25+ users.
- Common Core team packs: 10 seats $290, 25 seats $625, 50 seats $999, 100 seats $1,499, redeemed within 12 months.
- Every learner earns a certificate you can check at /training/verify/, and you can download completion records for your assessor. CMMC certificates expire after 12 months, matching annual training.
Who has to take security awareness training under 3.2.1
The control text names three groups by role, and an assessor will interview people from each one. Build your roster around the named roles first, then widen it to anyone who can reach FCI or CUI.
The roles the control names
- Managers approve access, policies, and security spending. Their example decides whether training sticks, so they need content on oversight and governance, not only the same basics as everyone else.
- System administrators hold privileged access. One stolen admin account or bad configuration can expose every system at once, so they need depth on hardening, logging, and privileged account hygiene.
- Users of organizational systems is deliberately broad. It covers every account that can reach a system in scope, from engineers to office staff, because a phishing click does not care about a job title.
Groups to include in your roster
- Full-time and part-time employees with network or application access
- New hires, trained during onboarding before they touch CUI
- Contractors and temporary staff who work inside your systems
- Managed service providers and subcontractors that store, process, or transmit your CUI
- Executives who approve the SSP and answer questions about the program in interviews
What assessors typically ask to see for AT.L2-3.2.1
A C3PAO or DIBCAC assessor will not take your word for it. Assessment methods include examining documents, interviewing staff, and testing, and assessors commonly sample people from each group the control names. Assemble these artifacts before your assessment window opens, or bring them to a CMMC readiness assessment first.
Commonly requested evidence
- A documented awareness and training policy or procedure that names its audiences, topics, and cadence.
- Per-user training records showing who completed what and when, with completion dates on every line.
- A role map that ties each audience to its course, for sysadmins, executives, and general users.
- Onboarding records for new hires and annual refresh records for everyone else.
- Insider-threat awareness records that line up with 3.2.3, since that practice is assessed separately.
What defensible records look like
- Each record ties a named person to a dated course, not a group screenshot or a single sign-in sheet for the whole company.
- Certificates can be checked by someone outside your team. Petronella course certificates are verifiable at /training/verify/ and buyers can export a roster CSV with completion dates.
- Renewal dates are visible, so it is obvious when each user is due for the next cycle.
- The curriculum references the same policies listed in your SSP, so interview answers line up with your written documentation.
Our build pattern for Awareness and Training
We deploy this control through ComplianceArmor®, our turnkey CMMC and NIST 800-171 program. Here is the play we run when an MSP client onboards.
Roll out KnowBe4 or Hoxhunt with the Petronella curriculum baseline plus role-based modules.
Track completion in our LMS-of-record and surface noncompliant users to the engagement team weekly.
Wire phish-test and insider-threat reporting into ComplianceArmor® evidence packs.
How to build an annual awareness training plan
Assessors read your training program as a cycle, not a single event. See how the whole Awareness and Training family fits together, then work through three moves and repeat them every year.
Inventory the audience: list every user, manager, and system administrator, and flag who handles CUI or holds privileged access.
Assign courses by role: awareness core for everyone, then role-based training for sysadmins, executives, and frequent CUI handlers under 3.2.2.
Track and renew: keep completion dates current, set a 12-month renewal cycle, and export rosters so evidence never goes stale.
A sample 12-month cadence
- Quarter 1: refresh the training policy, enroll new hires, and run the Common Core course for anyone whose certificate has expired.
- Quarter 2: deliver role-based training to sysadmins and executives while the annual policy review is still fresh.
- Quarter 3: focus on insider-threat indicators and incident reporting drills tied to your written reporting procedure.
- Quarter 4: close the year, export the roster CSV, archive certificates, and queue next year's enrollments.
What keeps the plan defensible
- A named owner who can produce records on request, not a shared inbox nobody watches.
- Course content mapped to the exact practice IDs it supports: AT.L2-3.2.1, AT.L2-3.2.2, and AT.L2-3.2.3.
- Renewal deadlines aligned to certificate expiry, since CMMC course certificates expire after 12 months.
- A written cadence you can show on one page, in the same order your SSP describes the control.
Where assessors flag 3.2.1 gaps
Patterns we see during DIBCAC and CMMC C3PAO assessments inside the Awareness and Training family. Treat these as your gut-check before a Joint Surveillance Voluntary Assessment.
Finding 1
Annual training that does not include role-specific content for sysadmins or developers
Finding 2
No training records retained to prove completion during assessment
Fix 1
Build a role-based curriculum (sysadmin, dev, CUI handler) on top of the general awareness module.
Fix 2
Capture training completion centrally and tie it to access-renewal workflow.
Six mistakes that turn an easy control into a finding
None of these are exotic, and each one has a straightforward fix. For the insider-threat items, start with our insider threat program guide.
One generic video for everyone
A single clip for all staff does not separate managers, sysadmins, and users, and it is hard to defend in a role-based interview under AT.L2-3.2.2.
Records without dates
An email announcing that training is done is not a record. Assessors look for names, course titles, and completion dates.
Skipping the leadership team
Managers are named in the control text, and executives are managers. When leadership has no training record, the roster does not cover everyone the control names.
Training that ignores your own policies
3.2.1 asks users to be aware of your policies, standards, and procedures. Generic content that never mentions them leaves the requirement half met.
Treating insider-threat content as covered by default
3.2.3 is a separate practice, and a general phishing module rarely teaches how to recognize and report insider-threat indicators.
Letting certificates lapse
If renewal is not scheduled, the second year of records has holes, and the annual evidence story falls apart right before an assessment.
Layer the curriculum
Common Core for everyone, then role-based courses mapped to the AT.L2-3.2.2 audiences in your role map.
Export dated rosters
A roster CSV with completion dates answers a sampling request in minutes, and certificates back it up.
Enroll executives deliberately
A short executive course covers the approval and oversight duties without pulling leaders off the floor for a day.
Tie lessons to the SSP
Use your real policy names in the curriculum so what people learn matches what the documentation says.
Make insider threat explicit
Pick a core course that includes insider-threat indicators, like the Common Core that maps to AT.L2-3.2.3.
Renew on a schedule
The 12-month certificate expiry gives you a built-in renewal calendar and a clean annual record.
Other Awareness and Training controls in the 3.2.x family
Controls in the same family typically share evidence artifacts and audit interview targets. Address them as a set during your SSP build.
How to choose a CMMC awareness training provider
Price per seat is the least important number on a quote. Compare providers on the criteria below before you enroll anyone, and ask for written proof of every claim a sales page makes.
Explicit practice mapping
The course page should name the practices it supports, such as AT.L2-3.2.1, AT.L2-3.2.2, and AT.L2-3.2.3. If a syllabus never mentions the practice IDs, ask how the content maps before you buy.
Compare the AT coursesReal role-based depth
General users, system administrators, and executives face different risks and need different lessons, not one video with a new title slide for each audience.
See the general users courseVerifiable certificates and rosters
Certificates should carry an expiration and be checkable by someone outside your team, so an assessor can confirm a sampled record independently. A roster export with completion dates matters just as much.
Test certificate verificationLicensing that fits your rollout
Look for one enrollment code for the whole organization, seat packs sized to your headcount, and invoice billing once you pass a modest user count. That combination keeps rollout simple as your roster changes.
Review team packs and licensingCredentials matter too. Petronella Technology Group, Inc. is a Cyber AB Registered Provider Organization (#1449), and the instructor for these courses is Craig Petronella, a CMMC Registered Practitioner. Ask any provider you evaluate for the equivalent proof in writing.
Which course fits which job
Every option below is self-paced and ends with a certificate of completion. CMMC courses expire after 12 months, which keeps annual refresh records lined up. Browse the full training catalog for details on each.
CMMC Level 2 Security Awareness: Common Core, $49 per learner, about 63 minutes, maps to AT.L2-3.2.1 and AT.L2-3.2.3
CMMC Level 2 Role-Based Training: General Users, $59, about 30 minutes, maps to AT.L2-3.2.2
CMMC Level 2 Role-Based Training: Executives, $149, about 30 minutes, maps to AT.L2-3.2.2
CMMC Level 2 Awareness and Training License, $300 per user per year, all three CMMC courses, one enrollment code, 1 to 500 users
2026 Security Awareness Training, $49, 90 minutes, for teams outside the CMMC scope
FTC Compliance Mastery, $149, for teams working on Safeguards Rule programs
HIPAA Rescue Manual for Healthcare Practices, $999, for practices building a HIPAA program
HIPAA Compliance and Cybersecurity Mastery, $2,997, the full HIPAA security program course
Rolling out across a whole team? Common Core team packs run 10 seats for $290, 25 seats for $625, 50 seats for $999, and 100 seats for $1,499, with seats redeemable for 12 months. To scope the entire Awareness and Training family against your environment, start with CMMC training solutions or a readiness assessment.
HIPAA and the FTC Safeguards Rule carry their own training duties
Defense work is not the only driver for awareness training. Two other federal rules name training directly, and the same awareness habits carry over to both. See HIPAA training and security awareness training for the broader programs.
HIPAA Security Rule, 45 CFR 164.308(a)(5)
- The rule calls for a security awareness and training program for all members of the workforce, including management.
- Four implementation specifications sit under it: security reminders, protection from malicious software, log-in monitoring, and password management.
- They are addressable, not optional: implement the measure or document why an equivalent approach fits your organization.
- Reminders are periodic by design, so a one-time course at hire does not carry the intent on its own.
FTC Safeguards Rule, 16 CFR 314.4(e)
- Paragraph (e)(1) requires security awareness training for personnel that is updated as necessary to reflect risks identified by the risk assessment.
- Because content follows the risk assessment, an awareness course that never changes as risks change is hard to reconcile with the rule.
- Paragraphs (e)(3) and (e)(4) add training for information security personnel and require verifying that key security staff keep current on changing threats and countermeasures.
- Section 314.4(g) requires the program to be evaluated and adjusted over time, which in practice means dated records and a review cycle.
Security awareness training for CMMC: FAQ
Plain answers to the questions buyers ask most often. If yours is not here, call Penny at (919) 348-4912.
What is CMMC 3.2.1?
NIST SP 800-171 Rev 2 control 3.2.1 requires organizations to make managers, system administrators, and users of organizational systems aware of the security risks associated with their activities and of the applicable policies, standards, and procedures for the security of those systems. In CMMC Level 2 it is assessed as the practice AT.L2-3.2.1, Role-Based Risk Awareness, alongside AT.L2-3.2.2 and AT.L2-3.2.3.
Who must receive security awareness training for CMMC Level 2?
The control names managers, system administrators, and users of organizational systems. Build your roster around those roles, then extend it to every account that can reach a system in scope: full-time and part-time staff, new hires at onboarding, contractors, and providers that handle your CUI.
How often does awareness training need to be repeated?
NIST SP 800-171 does not set a fixed interval, but an annual cycle is the pattern most programs follow because threats change and evidence ages. Petronella CMMC course certificates expire 12 months after completion, which gives your plan a built-in renewal schedule and keeps the record trail current for each assessment year.
What evidence does an assessor usually request for AT.L2-3.2.1?
Expect requests for a documented training policy or procedure, per-user records with completion dates, a role map showing which course each audience took, onboarding and annual refresh records, and insider-threat awareness records that line up with 3.2.3. A roster export with completion dates lets you answer a sampling request in minutes instead of days.
What is the difference between 3.2.1, 3.2.2, and 3.2.3?
3.2.1 covers general awareness of security risks and your applicable policies, standards, and procedures. 3.2.2 covers training personnel to carry out their assigned information security-related duties and responsibilities. 3.2.3 covers training on recognizing and reporting potential indicators of insider threat. The Common Core course maps to 3.2.1 and 3.2.3, and the role-based courses map to 3.2.2.
How much does CMMC security awareness training cost?
The CMMC Level 2 Security Awareness: Common Core course is $49 per learner and runs about 63 minutes. Role-Based Training for General Users is $59 and for Executives is $149, each about 30 minutes. The Awareness and Training License is $300 per user per year, includes all three CMMC courses, and uses one enrollment code for 1 to 500 users, with invoicing available at 25 or more users. Common Core team packs run 10 seats for $290, 25 seats for $625, 50 seats for $999, and 100 seats for $1,499.
Do executives and system administrators need separate courses?
Role-based training under AT.L2-3.2.2 should match each person's assigned security duties, so executives and system administrators usually need different content from general users. Petronella offers an Executives course for people who approve policies, budgets, risk acceptance, and access decisions, and a General Users course for day-to-day work with CUI. Both map to AT.L2-3.2.2 and run about 30 minutes each. System administrators typically also need technical training on the privileged duties their role carries.
How do I verify that a learner completed a course?
Every learner earns a certificate of completion, and CMMC course certificates can be checked at /training/verify/. Certificates expire after 12 months on CMMC courses, and buyers can export a roster CSV that lists each learner with a completion date, which is the format assessors ask to see.
Do contractors and service providers need training too?
DFARS 252.204-7012(m) requires the clause to be flowed down to subcontracts whose performance involves covered defense information, which places the NIST SP 800-171 requirements, including awareness training, on those subcontractors. Under 32 CFR Part 170, external service providers that process, store, or transmit CUI for you also fall within your assessment scope, so ask providers how they evidence training and fold the answer into your supply chain review.
Does HIPAA require security awareness training?
Yes. The HIPAA Security Rule at 45 CFR 164.308(a)(5) requires a security awareness and training program for all members of the workforce, including management. Four implementation specifications sit under it, all addressable: security reminders, protection from malicious software, log-in monitoring, and password management. Addressable does not mean optional: you either put the measure in place or document why an equivalent approach works for your organization.
What does the FTC Safeguards Rule require for training?
Under 16 CFR 314.4(e)(1), financial institutions covered by the rule must provide personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment. Paragraphs (e)(3) and (e)(4) add security updates and training for information security personnel and require verifying that key security staff keep their knowledge of threats and countermeasures current. Dated records and a review cycle show the training followed the risk assessment.
Does a course certificate make my company CMMC compliant?
No, and be careful with any provider who implies otherwise. Training supports practices such as AT.L2-3.2.1, AT.L2-3.2.2, and AT.L2-3.2.3, but a CMMC Level 2 assessment examines your whole security program, including the SSP, policies, and evidence across every family. Treat the courses as one pillar and pair them with a structured program or a readiness assessment.
Need help proving 3.2.1 for your CMMC assessment?
Petronella Technology Group runs ComplianceArmor® for defense contractors across North Carolina and nationwide. We close Awareness and Training gaps before your C3PAO does.