What AT.L2-3.2.1 security awareness training requires for CUI
AT.L2-3.2.1 requires that managers, system administrators and general users are made aware of the security risks of their activities involving CUI and of the security policies, standards and procedures that apply to them. If a CMMC Level 2 assessment is coming and your awareness training evidence is a folder of slide decks, a few sign-in sheets and a memory of who attended, that gap is the first thing to close. The requirement sits in the Awareness and Training domain, and it is scored as a 5-point requirement. Under the CMMC Scoring Methodology, a NOT MET result is subtracted from the maximum score of 110. Because it is worth more than 1 point, it cannot be placed on a plan of action and milestones, so it must be MET before you can reach Conditional or Final Level 2 status.
NIST SP 800-171A breaks the requirement into four assessment objectives: the risks of CUI activities, the applicable policies, standards and procedures, and awareness for managers, administrators and users. An assessor will look for the awareness curriculum and materials, the records showing who completed them, and the procedure that says how training is delivered. Assessors may also interview people from the general user community and ask them what the risks are and where the policies live. Your training has to be understood by the people it targets, not just stored on a server. Confirm with your assessor or C3PAO which awareness materials and records they expect to see before you build the package.
The hard part is ongoing delivery. A one-time course completed during onboarding rarely satisfies the requirement, because the assessor needs proof that awareness is maintained across the people who handle CUI today, including new hires, contractors and administrators whose roles changed. Phishing simulations, awareness campaigns and email advisories are recognized techniques for keeping that awareness current, and each run should leave a dated record of who was tested, what happened and what follow-up occurred. Learning platforms such as Moodle can hold the course content and completion records, but the completion settings must reflect what you actually count as aware. Decide that policy before the assessment, and keep the evidence in final form.
Which people, systems and third parties are in scope for AT.L2-3.2.1
AT.L2-3.2.1 reaches every person who can touch a system that handles CUI, not only the security team. The scope decisions below determine who gets trained, which systems the training must cover, and how third parties fit into the evidence an assessor will examine.
Managers in the CUI chain
Managers must be made aware of the security risks of their activities and of the policies that apply to them. Include anyone who approves access, assigns CUI work or signs off on handling decisions, because they make choices that affect the CUI boundary. Check that each manager in the CUI chain has a named training record, not a general statement that managers were briefed.
System administrators with privileged access
Administrators hold privileged access to the CUI enclave, its logs and its security tools, so their awareness of risk is tied directly to how they act. Build their training around the activities they perform, such as account changes, backups and configuration work. Confirm that the list of administrators matches the accounts in your identity system, including contractors and break-glass accounts.
General users of CUI systems
Every general user with an account on a system that stores, processes or transmits CUI is in scope, including staff who only read CUI documents. Assessors may interview members of this community to test whether they understand the policies and risks. Reconcile the training roster against directory group membership so that new hires and transfers are captured.
Enclave only or enterprise-wide
A decision to limit the CUI enclave to a defined boundary reduces the population for AT.L2-3.2.1, but it requires that the boundary, the users inside it and the people who administer it are documented accurately. If users outside the enclave can reach CUI through email, file shares or collaboration tools, they belong in scope. Ask your assessor to confirm the boundary before you finalize the roster.
Contractor staff and subcontractors
Contractor staff who access your systems with CUI are in scope, and their training must be evidenced to the same standard as employees. Subcontractors that receive or handle CUI require flowdown of the requirement in their own agreements and their own evidence. Ask each subcontractor how it trains its users and what records it can produce.
Cloud and managed service providers
Managed service providers and cloud operators with administrative access to CUI environments can act on your systems, so their personnel are within the risk picture. Determine whether their staff take your training, theirs under a contract, or both, and retain records that show which applies. Confirm the arrangement in writing before an assessment, because an assessor will ask who trains the people who can change your environment.
How a CMMC assessor tests awareness training under AT.L2-3.2.1
The assessor starts by reading what the organization teaches. SP 800-171A treats the security awareness curriculum and materials as assessment objects, so the assessor checks whether the content covers the security risks of activities involving CUI and the policies, standards and procedures that apply. The assessor also checks that managers, system administrators and users each receive content that speaks to their activities, because the requirement names all three audiences. Generic slides that never mention CUI handling, the system security plan or the organization's own policies usually fail this review.
- Risk coverage: Content names the specific risks tied to CUI, such as misdirected email, removable media, shared credentials and social engineering.
- Policy linkage: Each module points to the actual policies, standards and procedures in force, with current document numbers.
- Audience differences: Managers, administrators and general users each have material aimed at their activities.
- Version control: The assessor confirms the curriculum is the approved, current version, not a draft.
Before an assessment, confirm that every module can be traced to a named policy and that the final approved version is the one in use.
Training records show that the content was delivered and received. The assessor compares the list of people with system access against the completion records and looks for gaps, especially for new hires, contractors and administrators whose roles changed. Records must be final. A spreadsheet of planned sessions or an unsigned attendance draft does not establish that awareness was made to occur. The assessor will also check whether the records reflect the audiences named in the requirement.
- Completion by person: Each account holder with CUI access has a dated completion record for the current curriculum.
- Audience tagging: Records show whether a learner was a manager, system administrator or general user.
- Dated history: Records cover the period of the assessment, with dates tied to the curriculum version delivered.
- Gap handling: Overdue or missed completions are identified and closed, with evidence of follow-up.
Before an assessment, reconcile the directory of users with CUI access against the training system and remove or flag any unmatched accounts.
Assessors may interview members of the general user community. The purpose is to find out whether awareness has changed behavior, not just whether a course was completed. An assessor might ask a sample of staff how they would recognize a suspicious email, where CUI may be stored, or who to contact about a security concern. The answers are compared with the curriculum and the policies. Interviews reveal whether the training was retained and whether people know the procedures that apply to their work.
- Sample selection: The assessor picks people across departments, roles and locations, including managers and administrators.
- Practical questions: Users are asked about real handling of CUI, reporting paths and password or access rules.
- Consistency: Answers should match the content in the curriculum and the current policies.
- Escalation path: Staff can name who to notify when they suspect a security problem.
Before an assessment, brief a representative sample on the policies and confirm they can explain them in their own words.
The assessor also tests the mechanisms that manage awareness training. This includes the procedures for delivering training, the schedule for recurring campaigns and the tools that record completion. The CMMC Assessment Guide lists simulated phishing emails, awareness campaigns and email advisories among the techniques an organization may use. The assessor checks whether these activities run as documented, whether results are recorded, and whether failures lead to follow-up training. A learning platform can support this evidence, but the organization must be able to show who configured it, what it recorded and how it was reviewed.
- Delivery procedure: A written procedure defines frequency, audiences, content owners and escalation steps.
- Phishing simulations: Campaign design, targets, results and follow-up training are documented if used.
- Platform configuration: Completion rules and reports are configured to capture what the requirement needs. For example, Moodle's activity completion can be set to mark an activity complete when viewed, graded or ticked manually, so the organization must choose a condition that proves comprehension.
- Reporting: Management reviews delivery metrics and records decisions.
Before an assessment, test the training platform and confirm it produces the completion reports an assessor would ask to see.
Assessor test approach, evidence requested and common findings
This table compares what an assessor does, what evidence they ask for and where organizations usually fall short on AT.L2-3.2.1. Read each row as a step in the assessment, then check your own training records against the evidence column before an assessor arrives.
| Assessment element | What the assessor does or expects | Where it usually fails |
|---|---|---|
| Training curriculum and materials | Reviews the awareness content for coverage of CUI handling risks and the security policies, standards and procedures that apply to users | Generic content that never mentions CUI, the organization's own policies or the systems in scope |
| Delivery procedure | Reads the documented process for who receives awareness training, how often, and how new users are onboarded into it | Procedure exists in draft form only, or does not state how managers and administrators are covered |
| Completion records | Samples records for managers, system administrators and general users and checks that each audience has a dated completion entry | Records exist for general staff but are missing for managers or administrators who have system access |
| Phishing simulation results | Reviews campaign design, targets, results and the follow-up coaching given to users who failed a simulation | Campaigns run once with no follow-up, or results are not linked to targeted awareness content |
| Content currency | Checks that materials reflect current threats, current policy versions and the current system environment | Slides still reference retired tools, old policy numbers or a superseded CUI marking process |
| Interviews with users | Asks members of the general user community what risks they were taught and which policies apply to their work | Staff cannot describe the CUI risks in their role or where to find the applicable procedures |
| Mechanism testing | Tests the learning management system or tracking process to confirm that training assignments and completion status work as described | Completion is recorded on a manual tick with no proof of review, or the tracking tool cannot report by audience |
| Evidence in final form | Accepts only finalized, approved materials and records that show the organization actually used them | Drafts, unsigned policy versions or screenshots without dates are rejected as proof |
How to implement AT.L2-3.2.1 awareness training step by step
This sequence turns the awareness requirement into a documented program: defined CUI risks and policies, audience-specific content, delivery rules, campaigns, retained records and scheduled reviews that an assessor can test against the NIST SP 800-171A objectives.
Define the CUI risks and applicable policies
The organization, not the implementation partner, names the security risks of activities that touch CUI, such as handling CUI in email, sharing files externally and using removable media, and lists the policies, standards and procedures that govern them. The output is a short risk and policy register that each later step cites. It is done when the security officer signs off that every activity in the system security plan scope has a named risk and at least one governing policy.
Build curriculum for managers, administrators and users
Write separate awareness content for three audiences: managers, system administrators and general users. Each module should explain the risks from the register, the policies that apply and what the learner must do differently. Keep general awareness distinct from role-based training under AT.L2-3.2.2, which covers duties tied to specific job functions. The output is a versioned curriculum folder with materials, learning objectives and an owner for each module, which assessors will ask to see.
Set delivery and completion rules
Decide how each audience receives the content, who must complete it, and what counts as complete. Learning management systems such as Moodle can record completion when a learner views an activity, receives a grade or ticks it manually, so choose the condition deliberately and document it. Confirm the completion rule with your learning platform vendor and your assessor's expectations before launch. The output is a written delivery procedure covering enrollment, reminders for overdue learners and escalation to managers.
Run awareness campaigns including simulated phishing
Supplement scheduled training with campaigns such as simulated phishing emails, awareness posters and security advisories, which the CMMC Assessment Guide lists as awareness techniques. Track who clicked, reported or ignored each simulation, and route anyone who fails to a short targeted module. Run campaigns from a platform you control, and confirm any third-party simulation service handles CUI-related data appropriately. The output is a campaign log with dates, audiences, results and follow-up actions.
Collect and retain training records
Store completion records, quiz results, attendance, campaign results and the version of content each person received in a system that preserves them in final form. Assessors examine training records and test whether the program is delivered as documented, so records must show who was trained, on what, and when. Link each record to a named individual and a curriculum version. The output is a retained record set that an assessor can sample without help from the team.
Review content on a schedule
Review the risk register, curriculum and delivery procedure on a fixed cadence and after material changes such as a new system, a policy revision or a significant incident. Record each review, the changes made and the approver. Ask your implementation partner or internal compliance lead to confirm the review interval in your written procedure, since no fixed interval is set by the requirement itself. The output is a dated review log that shows the program stays current with the risks it addresses.
Why awareness under 3.2.1 differs from role-based training under 3.2.2
Awareness under AT.L2-3.2.1 shapes how every person with access to CUI behaves, while role-based training under AT.L2-3.2.2 prepares named people to carry out specific security duties. The first requirement asks that managers, system administrators and general users understand the security risks of their activities and the policies, standards and procedures that apply to them. The CMMC Assessment Guide Level 2 treats this as awareness that influences general user behavior, with techniques such as simulated phishing emails, awareness campaigns and email advisories. The second requirement starts from duties: an organization first defines the information security duties tied to roles, then trains the people who hold them. An administrator who patches servers and a user who handles CUI spreadsheets may both complete awareness content, but only the administrator needs the role-based course on secure configuration.
For the assessment, keep the two requirements in separate evidence sets. Under AT.L2-3.2.1, assessors look for the awareness curriculum and materials, the procedures for delivering them, and training records, and they may interview members of the general user community to test whether the message landed. Under AT.L2-3.2.2, they look for the defined role duties, the assignment of those duties to named people, and training records tied to those roles. Mixing them into one course catalog with one completion report makes it hard for an assessor to tell which objectives each record satisfies. Confirm with your assessor how they expect records to be labeled and whether a single course can count toward both requirements.
Before you finalize either program, decide who owns each evidence set, how completion will be tracked in your learning system, and how you will show that records are current. Review the sibling pages for AT.L2-3.2.2 role-based training and AT.L2-3.2.3 insider threat awareness for their own requirements, and check each against the same assessment guide. Both requirements must be MET to reach Conditional or Final Level 2 status, so a gap in either one cannot be carried on a POA&M.
Evidence that passes an AT.L2-3.2.1 assessment
Assessors test AT.L2-3.2.1 by checking whether awareness content exists, reached the right people, and was verified. The cards below cover the artifacts that prove each assessment objective, and the routine that keeps each one current between assessments.
Awareness curriculum and materials
The curriculum is the content you deliver: the CUI security risks employees face in their activities, plus the policies, standards and procedures that apply to them. Assessors examine the current version and check that it names your actual systems, CUI handling rules and reporting paths, not generic phishing advice. Keep the version history with the materials so the assessor can see what each audience received at each point in time.
Training records with dates and audiences
Training records show who completed which module and when. Each record should name the individual, the audience group (managers, system administrators or general users), the module version, and the completion date. Assessors may interview members of the general user community, so records must match what staff can describe. Export records from your learning system on a schedule rather than relying on a platform view that may change.
Delivery procedures for awareness training
The delivery procedure defines how awareness reaches each audience, how often, who owns it, and what happens when someone does not complete it. Write it down and assign an owner. Assessors look for a procedure they can compare against the records, so a procedure that promises quarterly sessions should be matched by sessions held quarterly. Include onboarding, recurring refreshers and triggers for extra training after an incident.
Phishing simulation results and remediation
Simulated phishing emails are a common awareness technique listed in the CMMC Assessment Guide Level 2. Keep campaign results showing sent, opened, clicked and reported counts per campaign, along with the follow-up training given to users who clicked. Assessors are looking for evidence that the simulation changed behavior and that failures led to action. Confirm with your simulation vendor that results export in a form you can retain.
Awareness campaign artifacts and advisories
Campaigns and security advisories are the ongoing reminders that keep awareness current between formal courses. Retain the posters, emails, intranet posts and advisories with their send dates and distribution lists. Tie each advisory to a real risk you observed, such as a credential harvesting wave, so the artifact shows why it was issued. A calendar of campaigns with proof of issue is easier to defend than an undated folder.
Content review record
Awareness content goes stale when policies, systems or threats change. A review record shows who reviewed each module, when, what changed, and which policy or procedure version it now reflects. Set a review cycle in the procedure and log every review, including reviews that changed nothing. Assessors check that the content they see is the content in force, so the review log should match the version dates in the curriculum.
What meeting AT.L2-3.2.1 costs in money and effort
This table breaks down the cost components of running awareness training for AT.L2-3.2.1, who is paid for each, whether it is one-time or recurring, and what drives it up or down. No prices are published here, so use the rightmost column to scope a quote and compare options fairly.
| Cost component | Who is paid or who bears the effort | One-time or recurring | What drives the cost and what to ask for in a quote |
|---|---|---|---|
| Awareness content development | Internal staff or an implementation partner, sometimes a content vendor | One-time, then periodic updates | Driven by how many policies, CUI handling rules and user roles the content must cover. Ask whether the quote includes tailoring to your policies and how updates are priced. |
| Learning platform or licenses | Commercial LMS vendor, or no license fee with a self-hosted open-source LMS such as Moodle (GPL-3.0-or-later) | Recurring for commercial licenses, mostly one-time for setup on open source | Commercial seat counts scale with headcount. Self-hosted platforms remove license spend but add hosting, patching and backup work. Ask for seat, hosting and support terms separately. |
| Staff time for delivery and follow-up | Internal managers, administrators and users, plus training coordinators | Recurring, at each onboarding and refresher cycle | Driven by audience size, frequency of refreshers and how many users need follow-up after missed completions. Ask how completion tracking and reminders are handled. |
| Phishing simulation operation | Internal security team, a managed simulation vendor, or an implementation partner | Recurring, usually per campaign cycle | Driven by campaign frequency, number of templates and the effort to review click and report data. Ask whether the simulation tool is self-hosted or licensed per user. |
| Training record upkeep | Compliance lead or system owner | Recurring | Assessors examine training records, so the effort grows with the number of users and the number of training events. Ask how records are retained and exported in final form. |
| Evidence preparation and review | Internal compliance staff, with an outside reviewer if engaged | One-time setup, then recurring at each assessment | Driven by how many evidence items must be gathered and reconciled against the assessment objectives in NIST SP 800-171A. Ask what review is included in the scope. |
| External review and assessor sampling | Independent assessor or C3PAO, paid by the organization | Recurring at each assessment | Driven by how many users the assessor samples and how many records must be shown. An implementation partner prepares evidence but does not issue the assessment result. Ask the assessor for its sampling approach before scoping. |
Self-hosted open-source tools that produce awareness training evidence
Can Moodle prove that each user completed awareness training?
Yes, Moodle's activity completion can record when each learner views an activity, receives a grade from it, or ticks it manually, depending on the conditions you set. That record is only as strong as the condition behind it. A page that is marked complete on view shows that someone opened it, not that they absorbed the policy content. For AT.L2-3.2.1, you need records that show each user in scope was made aware of security risks and of the applicable policies, standards and procedures. Confirm with your assessor which combination of view, grade and manual evidence they will accept for your environment before you build the course.
Which Moodle completion condition fits each audience?
Match the condition to what you need to prove. Use view-based completion for reading material such as an acceptable use policy page, because it confirms access but not comprehension. Use grade-based completion for a short quiz on phishing recognition or handling CUI, because a passing grade shows the user engaged with the content. Reserve manual completion for activities a supervisor must confirm, such as a briefing for managers, and record who ticked it. Managers, system administrators and general users usually need different content and possibly different conditions, so set them per audience rather than applying one rule to the whole site.
Does Moodle's GPL license affect how we use it for CMMC evidence?
Moodle is licensed under GPL-3.0-or-later, which allows you to run, modify and distribute it without paying a license fee, but it also carries obligations if you distribute modified versions. Running Moodle inside your own infrastructure for internal training generally does not trigger distribution duties, but your legal or procurement team should confirm this for your specific use. Plugins you add may carry their own licenses, so check each one. The license question is separate from whether the platform produces assessment-ready evidence, which depends on how you configure and document it.
What does it cost to run Moodle for awareness training?
The software itself carries no license fee under its GPL-3.0-or-later terms, so cost comes from people and infrastructure. One-time costs include design of the course content, configuration of completion rules, and documenting the procedure assessors will examine. Recurring costs include hosting or cloud compute, backups, patching, plugin updates, and content refreshes when policies change. Costs rise with the number of audiences, languages, and the frequency of required retraining. Ask any implementation partner for a fixed-scope written quote that lists each deliverable, the environment it runs in, and who maintains it after handover.
Can we set up Moodle awareness training ourselves?
Yes, an internal team with Linux, database and web application experience can install and configure Moodle, but the hard part is usually governance rather than software. You need current policy documents, a named owner for each course, a schedule for refresher training, and a retained record of who completed what and when. A common gap is that teams configure completion but never store the policy version a user acknowledged. If your staff lack capacity, a partner can plan, implement, harden and document the platform inside your own cloud account or data center, while your organization keeps ownership of the content and the controls.
What training records will an assessor ask to see?
Assessors typically look for the training curriculum and materials, the records showing who completed training and when, and the procedures for delivering it. In Moodle, that means course exports or reports showing completion status per user, the completion conditions applied, the content version delivered, and the procedure describing how new hires and contractors are enrolled. Keep records in final form. Drafts or unexplained manual ticks can cause a requirement to be judged not met. Test your report export early, because assessors may also interview general users about what they learned.
What can go wrong with Moodle completion records?
The most common failures are configuration drift, unmanaged manual ticks, and gaps in enrollment. An administrator may change a completion rule after records already exist, which makes earlier evidence hard to interpret. Manual completion without a named approver weakens credibility. New users who never get enrolled will simply never appear as incomplete, which hides the gap. Protect the platform with strong authentication, restrict who can edit completion settings, keep audit logs of configuration changes, and run periodic reports that compare active accounts against training completions. Confirm these controls with your assessor so the evidence design matches what they will test.
Does Moodle activity completion meet the awareness requirement by itself?
No. Moodle is a delivery and recording tool, and it can support the evidence for AT.L2-3.2.1, but it cannot decide that your training content covers the security risks of CUI activities or your applicable policies. Your organization owns the curriculum, the policy mapping, and the assessment of whether the training is adequate. The Moodle documentation on activity completion describes how completion is marked, which is the starting point for your own configuration checks. Treat the platform as one part of an evidence package that also includes policy documents, procedures and interviews with users.
Who does what: your team, a partner and the auditor
Your organization remains accountable for AT.L2-3.2.1. Assessors test whether the awareness program actually runs, so the people responsible for it must be named inside the company and must approve what the workforce is taught. Ownership does not transfer to a vendor or consultant, even when someone else builds the materials.
- Policies and standards: Own the security policies, standards and procedures that awareness content must reference, and keep them current with approval dates and version history.
- Content approval: Review and sign off on curriculum, phishing campaign templates and advisories before they reach staff, and record who approved each version.
- Audience definition: Decide which managers, system administrators and general users are in scope, and keep the roster current as people join, move or leave.
- Records: Keep training completion records, campaign results and follow-up actions in a form that shows completion dates, participants and content versions.
- Internal interviews: Be ready to explain the program to assessors in plain terms, because assessors may interview members of the general user community.
Before an assessment, check that every policy referenced in the training is the approved version and that you can produce records for each audience group without reconstructing them from memory.
An implementation partner can take on much of the build work for the awareness program. The partner prepares and configures the systems that deliver and record training, but it does not decide what your policies say and it does not judge whether your program meets the requirement. Its deliverables become evidence only after your organization reviews and adopts them.
- Curriculum preparation: Draft awareness modules, phishing simulation templates and advisory content for your review, mapped to the policies you provide.
- Platform setup: Install and configure a learning platform, such as an open-source LMS, so completion and campaign results are captured automatically and can be exported.
- Evidence packs: Assemble the training materials, configuration records, completion exports and campaign reports into a package that your staff can check against each assessment objective.
- Operational handover: Document how campaigns are run, how records are retained and who runs each step after the engagement ends.
- Limits: The partner should not write attestations, mark objectives as met on your behalf or present itself as the assessor.
In a fixed-scope engagement, confirm in writing which deliverables are included, who reviews them, and whether ongoing campaign operation is part of the scope or a separate support arrangement.
The independent assessor tests the awareness program against the assessment objectives in NIST SP 800-171A and decides whether the requirement is MET. For Level 2 certification, that assessor is a C3PAO authorized or accredited through The Cyber AB. Self-assessments are carried out by your organization, and your results still have to be supported by evidence an outsider could verify.
- Objective testing: The assessor checks the risk awareness content, the policy references, delivery mechanisms and training records against each objective.
- Interviews and observation: The assessor may interview users across the organization and check whether they can describe the risks and policies that apply to their work.
- Evidence standard: Only final evidence counts. Drafts, unsigned approvals and undated records weaken a finding.
- Outcome: Only the assessor's process results in a certification outcome. Your partner and internal team can prepare for this, but cannot issue it.
- Independence: A consultant that prepared your evidence should not also perform the certification assessment, so ask which firms are excluded from the assessment team.
Before engaging any assessor, confirm its current authorization status and the scope and fee terms in writing, and verify that the assessor has no role in building your program.
Where organizations fall short on AT.L2-3.2.1
Most AT.L2-3.2.1 findings do not come from missing training catalogs. They come from training that cannot be tied to CUI risk, records that do not cover every audience, and evidence that an assessor cannot accept as final. Each card below names one gap and the closing step that addresses it.
Training not tied to CUI risk
Many programs use a generic security course that never mentions how CUI is handled in the organization's own systems. AT.L2-3.2.1 asks that people be made aware of the security risks of their activities involving CUI, so a course on phishing in general may not satisfy it on its own. Check that each module names the CUI workflows, systems and data types staff actually touch. Close the gap by rewriting the content around those workflows and recording the revision date.
Records missing for some audiences
Training logs often cover employees but leave out managers, system administrators, contractors with system access or staff who joined after the last campaign. The requirement names all three groups, and assessors may interview members of the general user community to test whether the awareness reached them. Compare the training roster against the current access list and the org chart. Close the gap by assigning every account holder to a required course and reconciling the roster each quarter.
Phishing tests without follow-up
Simulated phishing emails are a recognized awareness technique, but a campaign that only counts clicks does not show that people learned the policy. Assessors look for the link between the exercise and the awareness content, including what happened to users who failed. Confirm that every failed simulation triggers a documented coaching or retraining step. Close the gap by recording each campaign's results, the follow-up assigned and the completion date for that follow-up.
Drafts presented as final
A curriculum marked draft, an unsigned policy acknowledgment or a training log exported before the final review can fail the assessment. A requirement is met only when the evidence is in final form, so an assessor will not accept a document the organization has not finalized. Check the version control on every training artifact before the assessment window opens. Close the gap by freezing approved versions, signing them and archiving the drafts separately.
No evidence of content review
Awareness material that was written once and never revisited is hard to defend, because the policies, standards and procedures it cites change over time. Assessors examine the curriculum and materials as assessment objects, so they will ask when content was last reviewed and against which policy version. Confirm that a named owner reviews the material after every policy change and at least on a scheduled cycle. Close the gap by keeping a review log that links each course version to the policy version it reflects.
Common questions about AT.L2-3.2.1 awareness training
How much effort does AT.L2-3.2.1 awareness training take to meet?
The requirement is short, but the effort comes from building the training, delivering it to every affected group and keeping records current. Effort rises with the number of managers, system administrators and users who handle CUI, how many separate user groups need tailored content, how often policies change, and whether you already have a learning management system that can track completion. Costs are one-time for the curriculum and setup, then recurring for refresher training, updates and record keeping. No standard figure for hours is supplied here, so ask any provider for a written effort breakdown by task, group and deliverable before you commit.
Can an in-house team meet AT.L2-3.2.1 without outside help?
Yes. The organization owns its controls, and nothing in the requirement requires an outside consultant. Your team needs to identify the security risks of activities involving CUI, identify the policies, standards and procedures that apply, deliver awareness to managers, system administrators and users, and keep evidence of all of it. Many teams handle this internally and bring in help only for a readiness review, curriculum design or evidence organization. Whatever you decide, the independent assessor, not your team or any partner, is the party that judges whether the requirement is met.
Are phishing simulations required for AT.L2-3.2.1 awareness training?
No single method is named as mandatory for this requirement. The CMMC Assessment Guide for Level 2 lists simulated phishing emails among the techniques used for awareness, alongside awareness campaigns and email advisories. Assessors check whether the four assessment objectives are satisfied, including that managers, system administrators and users are aware of the risks of CUI activities and of the applicable policies. Phishing simulations can support that evidence if you keep campaign content, results and follow-up actions. Confirm with your assessor and contracting officer how they expect awareness to be shown.
How long must AT.L2-3.2.1 training records be kept?
No retention period is supplied for this requirement, so confirm it before you set a schedule. Check the contract clauses that flow down to you, your contracting officer's expectations, the current CMMC status and your own records policy. Whatever period applies, records should show who was trained, when, which version of the content they received, how completion was confirmed and what follow-up occurred. Keep the materials for each version, because an assessor may ask what content was in use on a given date. Ask your compliance lead or any outside advisor to write the retention rule into your policy.
Can a partner prepare AT.L2-3.2.1 training evidence for us?
Yes. An implementation partner can help build the curriculum, set up delivery and completion tracking, collect training records and map the evidence to the assessment objectives. A partner does not issue reports or certificates. Your organization performs and owns the self-assessment, and an independent assessor, such as a C3PAO for Level 2 certification, makes the judgment. Be explicit in writing about who writes each artifact and who approves it. If you use Moodle, activity completion can mark an item complete when a learner views it, receives a grade or ticks it manually, depending on the conditions you set, so configure those conditions to match real training.
How does AT.L2-3.2.1 fit current CMMC status and the paused Phase II?
On 13 July 2026, the Department of War suspended CMMC Phase II, which would have required Level 2 C3PAO certification for applicable contracts, and started a 60-day review by a CMMC Reform Task Force. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. As of 17 October 2026, the DoW CIO page says implementation is paused in Phase 1 and may only require self-assessments at Levels 1 and 2, while the eCFR text still contains the original schedule. AT.L2-3.2.1 is a 5-point requirement that cannot go on a POA&M, so it must be MET for Conditional or Final Level 2 status. Confirm the current requirement with your contracting officer.
What do assessors check in awareness training evidence?
Assessors work from the four assessment objectives in NIST SP 800-171A. They check that the security risks of CUI activities are identified, that the applicable policies, standards and procedures are identified, and that managers, system administrators and users are made aware of both. Typical objects include the training curriculum and materials, training records and the procedures for delivering awareness. Assessors may interview members of the general user community and test the mechanisms that manage awareness training. Evidence must be in final form, not drafts, and each objective must be satisfied for the requirement to be MET.
How DeployOpen prepares AT.L2-3.2.1 evidence
DeployOpen's role on AT.L2-3.2.1 is to prepare the systems, curriculum records and evidence that your organization uses to show awareness training is running. The first step is scoping: agreeing in writing which audiences count as managers, system administrators and general users, which systems and CUI workflows the training must cover, and which policies, standards and procedures each audience must be made aware of. Those decisions decide what an assessor will ask for, so they belong with your compliance lead and CISO before any platform work starts. DeployOpen does not issue assessments or certifications, and your organization owns its controls, its training content sign-off and its attestations.
Next, DeployOpen can build or configure the delivery platform inside your own infrastructure, typically an open-source learning management system such as Moodle, and set up the activity completion rules, enrollment by audience and reporting so that completion records are exportable and tied to named users. DeployOpen can also prepare the curriculum pack: versioned course materials, a map from each topic to the policy it references, and an evidence folder holding the materials, completion exports and delivery procedure. Phishing simulations and awareness campaigns, which the CMMC Assessment Guide lists as techniques for this requirement, can be scheduled and recorded in the same environment. Confirm with your own tooling team which simulation product fits your network and data-handling rules, because not every open-source option supports every campaign type.
Finally, DeployOpen supports security awareness testing, meaning a review of whether the records would hold up under interview and document examination. Assessors may interview members of the general user community, so the test should check that staff can name the risks and policies the course covers. Ask for a written list of what the test covers, the sample of users and records reviewed, and the findings. Make sure every record is final rather than a draft, because only final evidence supports a MET result. Budget effort for ongoing completion tracking and refresher cycles, which recur after the first build.
