CMMC 2.0 • LEVEL 2 • AWARENESS & TRAINING

AT.L2-3.2.1 — Literacy Training and Awareness

Provide security literacy training to system users: As part of initial training for new users and annually (every 12 months) or following significant changesCMMC/STIG thereafter, When required by system changes or following annually (every 12 months) or following significant changesCMMC/STIG, and On recognizing and reporting indicators of insider threat, social engineering, and social mining. Update security literacy training content the Authorizing Official (AO) or Information System Security Manager (ISSM)CMMC/STIG and following the Information System Security Officer (ISSO) or designated System Administrator under ISSM oversightCMMC/STIG.

NIST 800-171 Mapping

NIST 800-53 Controls

AT-2

Assessment Objectives

  • security literacy training is provided to system users as part of initial training for new users.
  • security literacy training is provided to system users annually (every 12 months) or following significant changesCMMC/STIG after initial training.
  • security literacy training is provided to system users when required by system changes or following annually (every 12 months) or following significant changesCMMC/STIG.
  • security literacy training is provided to system users on recognizing indicators of insider threat.
  • security literacy training is provided to system users on reporting indicators of insider threat.
  • security literacy training is provided to system users on recognizing indicators of social engineering.
  • security literacy training is provided to system users on reporting indicators of social engineering.
  • security literacy training is provided to system users on recognizing indicators of social mining.
  • security literacy training is provided to system users on reporting indicators of social mining.
  • security literacy training content is updated the Authorizing Official (AO) or Information System Security Manager (ISSM)CMMC/STIG.
  • security literacy training content is updated following the Information System Security Officer (ISSO) or designated System Administrator under ISSM oversightCMMC/STIG.

Practitioner Notes

Practitioner commentary coming soon.

Related CMMC 2.0 Practices

AT.L2-3.2.2 Role-Based Training AT.L2-3.2.3 Provide Security Awareness Training on Recognizing and Reporting Potential Indicators of Insider Threat