Awareness and Training Controls

About the Awareness and Training Family (AT)

Controls ensuring that personnel are aware of security risks and are adequately trained to carry out their information security responsibilities. This family contains 3 security requirements that organizations must implement to achieve CMMC Level 2 certification and protect Controlled Unclassified Information (CUI). Petronella Technology Group, Inc. (Cyber AB Registered Provider Organization #1449, founded 2002 in Raleigh, NC) provides expert guidance on implementing every control in this family.

Where to get CMMC Level 2 training for all three Awareness and Training practices

Petronella Technology Group, Inc. (Cyber AB Registered Provider Organization #1449) sells three self-paced CMMC Level 2 courses that together map to AT.L2-3.2.1, AT.L2-3.2.2 and AT.L2-3.2.3. The simplest way to cover a whole workforce is one organization-wide license with a single enrollment code. The training supports the AT practices; it does not by itself make an organization CMMC compliant.

• CMMC Level 2 Security Awareness: Common Core: $49 per learner, about 63 minutes, maps to AT.L2-3.2.1 and AT.L2-3.2.3 (insider threat).
• CMMC Level 2 Role-Based Training: General Users: $59, about 30 minutes, maps to AT.L2-3.2.2.
• CMMC Level 2 Role-Based Training: Executives: $149, about 30 minutes, maps to AT.L2-3.2.2 for Senior Official duties.
• CMMC Level 2 Awareness and Training License: $300 per user per year for all three courses, one enrollment code for the whole organization, 1 to 500 users, card checkout or invoice at 25+ users.
• Common Core team packs: 10 seats $290, 25 seats $625, 50 seats $999, 100 seats $1,499, redeemed within 12 months.
• Every learner earns a certificate you can check at /training/verify/, and you can download completion records for your assessor. CMMC certificates expire after 12 months, matching annual training.

What CMMC Level 2 Requires From the Awareness and Training Family

CMMC Level 2 evaluates 110 practices drawn from NIST SP 800-171 Rev 2. Three of them sit in family 3.2, Awareness and Training (AT). If your organization stores, processes, or transmits Controlled Unclassified Information (CUI) in support of Department of Defense contracts, an assessor will ask for evidence that all three AT practices are implemented, documented, and refreshed on a repeating cycle. Here is what each practice asks of you, in plain language.

AT.L2-3.2.1, Role-Based Risk Awareness. The public text of NIST SP 800-171 Rev 2, section 3.2.1 says: ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems. Three audiences are named, managers, systems administrators, and users, and the content has to connect the risks that come with what people do every day to the policies, standards, and procedures your organization expects them to follow. A generic internet-safety video that never mentions your own CUI handling rules leaves part of this requirement uncovered. For the program behind the requirement, see security awareness training.

AT.L2-3.2.2, Role-Based Training. The public text says: ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities. This is the role-based layer that sits on top of awareness. A general employee, a system administrator, and the executive who owns your compliance program hold different positions and carry different security duties, so they need different training. One video shown to the entire company satisfies awareness but rarely satisfies role-based training, which is why AT.L2-3.2.2 gets its own track per role.

AT.L2-3.2.3, Insider Threat Awareness. The public text says: provide security awareness training on recognizing and reporting potential indicators of insider threat. Notice the two verbs. Recognizing an indicator is only half of the requirement; your people also need to know how and to whom they report what they see. Assessors look for both halves: course content that teaches the indicators, and a reporting path your staff can describe in their own words. For the program-level side of that requirement, see insider threat program.

All three practices have one trait in common: they are only evidenced by records. A policy stating that training happens proves nothing by itself. Completion records with dates, tied to named roles, are what an assessor samples, which is why the evidence guidance below matters as much as the courses themselves.

Who Must Be Trained for CMMC Level 2

The public text of family 3.2 names its audience for the first two practices: managers, systems administrators, and users of organizational systems for awareness (AT.L2-3.2.1) and personnel with assigned information security duties for role-based training (AT.L2-3.2.2). AT.L2-3.2.3 does not name an audience, but because it is security awareness training on recognizing and reporting insider threat indicators, most organizations deliver it to everyone who receives awareness training. In a defense contractor, that set usually includes:

• General employees who use systems inside the CUI boundary, including anyone who emails, shares, prints, or stores CUI in any form.
• System administrators and IT staff, who need role-based training on the duties that come with administrative access: account management, patching, logging, backups, and remote access.
• Security and compliance staff who run the awareness and training program day to day.
• Executives, including the Affirming Official. Under 32 CFR Part 170 an Affirming Official affirms the organization's compliance, and leadership also resources the program and accepts risk on its behalf. Executive role-based training covers those duties specifically.
• New hires, who should complete training during onboarding, before they touch CUI for the first time.
• Contractors and temporary personnel whose accounts or workstations sit inside the CUI boundary.

A practical way to scope the roster: list everyone who uses a system that stores, processes, or transmits CUI, then add the people who administer those systems, then add leadership. When in doubt, include the person. The price of one extra seat is small next to the cost of an assessor questioning a coverage gap. Keep the list current too: people join, leave, and change roles, and the roster should move with them through your onboarding and offboarding process.

What CMMC Assessors Ask to See for Awareness and Training

CMMC assessments are evidence driven, and the AT family is one where the evidence is mostly paperwork. Before an assessment, have these items organized and retrievable:

• A training policy or procedure that defines the awareness program, the role-based tracks, the insider threat content, and the refresh cycle you follow.
• Training records with completion dates: a roster or enrollment history showing who completed which course, and when.
• Role mapping that connects each job role to the training it received, so the assessor can see why general users, administrators, and executives each received the correct track.
• Curriculum coverage: awareness content that covers risks plus your applicable policies, standards, and procedures (AT.L2-3.2.1); role-based content that covers assigned duties (AT.L2-3.2.2); insider threat content that covers recognizing and reporting indicators (AT.L2-3.2.3).
• Certificates of completion for the learners the assessor samples.
• Refresh evidence: records showing the training repeated within the cycle your policy states.
• The System Security Plan (SSP) section that describes your awareness and training program.

Assessors usually work from samples: they pick a handful of names, then ask for that person's completion record, certificate, and role map entry. If the sampled names include a new hire or a contractor, those records need to exist too. Every Petronella CMMC course issues a certificate of completion, expires after 12 months to match an annual cycle, and can be verified independently at /training/verify/. Buyers can export a roster CSV with completion dates, which is exactly the artifact assessors ask to sample.

How to Build an Annual Awareness and Training Plan

An annual plan turns training from a one-time event into a routine you can evidence on demand. Seven steps, in order:

1. Inventory your people and their roles. Mark who uses systems that store, process, or transmit CUI, who administers those systems, and who owns the compliance program.
2. Map each role to a track: every employee for awareness (AT.L2-3.2.1) and insider threat indicators (AT.L2-3.2.3), role-based courses for assigned duties (AT.L2-3.2.2), and a separate track for executives.
3. Pick the courses and fix the dates. Put the annual window on the calendar the way you calendar insurance renewals, and assign an owner who is responsible for chasing completions.
4. Enroll new hires during onboarding so nobody spends their first months untrained while waiting for the next company-wide cycle.
5. Track everything in one place: enrollment codes, completion dates, certificates, and roster exports.
6. Refresh every 12 months. Petronella CMMC certificates expire after 12 months, which gives you a built-in reminder tied to the certificates themselves.
7. Keep the evidence together: policy, plan, roster CSV, certificates, and the SSP section. When the assessor asks, you hand over one folder instead of reconstructing a year of records.

The same records do double duty elsewhere in the framework. Onboarding training supports personnel security practices, and staff who know how to report suspicious activity feed your incident response capability. One plan, several families supported. Revisit the plan whenever scope changes: a new contract, a new system inside the CUI boundary, or a new team means new roles to map and new seats to assign.

How to Choose a CMMC Awareness and Training Provider

Course catalogs are crowded and quality varies. Before you buy, ask each provider these questions and compare the answers side by side:

• Do the courses map explicitly to AT.L2-3.2.1, AT.L2-3.2.2, and AT.L2-3.2.3? Ask for the mapping in writing.
• Is there a genuine role-based layer, or one video shown to everyone?
• Do learners receive certificates of completion, and can a certificate be verified without calling the vendor?
• Can you export a roster with completion dates for your evidence pack?
• How long does each course run, and what does each seat cost?
• Is there an organization-wide license with a single enrollment code, so IT is not managing hundreds of individual logins?
• Do certificates expire to enforce an annual refresh, and is the content updated?
• Who teaches the course, and what are their CMMC credentials?
• Does the provider understand CMMC beyond training, for example readiness assessments, or is training a side product?

Petronella Technology Group, Inc. answers those questions directly. The Common Core course maps to AT.L2-3.2.1 and AT.L2-3.2.3; the General Users and Executives courses map to AT.L2-3.2.2. Certificates verify at /training/verify/ and buyers export a roster CSV with completion dates. The organization license costs $300 per user per year, covers all three CMMC courses, uses one enrollment code, and supports 1 to 500 users with invoicing available at 25 or more. Courses are taught by instructor Craig Petronella (CMMC-RP), and the company has operated from Raleigh, North Carolina since 2002 as Cyber AB Registered Provider Organization #1449. To see the full catalog, explore CMMC training, and for an outside read on where your whole program stands, start with a CMMC readiness assessment.

Awareness and Training in HIPAA and the FTC Safeguards Rule

CMMC is not the only regulation that requires training, and many contractors carry several of these obligations at once. HIPAA: the Security Rule at 45 CFR 164.308(a)(5) requires covered entities and business associates to implement a security awareness and training program for all members of the workforce, including management. The rule lists four addressable implementation specifications: security reminders, protection from malicious software, log-in monitoring, and password management. Addressable means the organization decides how to implement each one and documents the decision; it does not mean the specification can be ignored. Healthcare practices that also handle CUI can cover both tracks, and dedicated HIPAA training is available separately.

FTC Safeguards Rule: 16 CFR 314.4(e) requires financial institutions covered by the rule to provide personnel with security awareness training that is updated as necessary to reflect risks identified by the risk assessment, and to provide information security personnel with security updates and training sufficient to address relevant security risks. That split between awareness for everyone and deeper training for security staff mirrors the split between AT.L2-3.2.1 and AT.L2-3.2.2, which is why the same course structure transfers well between the two frameworks.

The practical takeaway: choose training that already separates awareness from role-based duties, and the same structure supports HIPAA's workforce training and the Safeguards Rule's personnel training in addition to the CMMC AT practices. For coverage outside CMMC, see 2026 Security Awareness Training ($49, 90 minutes), FTC Compliance Mastery ($149), HIPAA Rescue Manual for Healthcare Practices ($999), and HIPAA Compliance & Cybersecurity Mastery ($2,997).

Common Awareness and Training Mistakes That Surface in Assessments

These avoidable errors weaken Awareness and Training evidence:

• Training only at hire. The onboarding course exists, but the annual refresh never happens.
• No completion dates. We did training last year is not evidence; a dated roster is.
• One generic course for the whole company with no role-based layer, leaving AT.L2-3.2.2 uncovered.
• Executives skipped. Managers are named in 3.2.1, executives can be sampled like any other user, and leadership duties are part of what AT.L2-3.2.2 covers.
• Insider threat content that teaches recognition but never explains how to report.
• A policy that describes a program which does not actually exist. Assessors test documents against reality.
• Seats purchased but never assigned. A license nobody redeemed is a purchase, not a program.
• Contractors and new hires left off the roster entirely.

None of these are expensive to fix once identified. A single annual cycle, with role mapping and dated records, resolves nearly all of them at once. Review the list before your assessment window opens, because each item is simpler to correct a month out than a week out.