AT.L2-3.2.2 Role-based training: requirements and evidence

What AT.L2-3.2.2 role-based training requires for CMMC Level 2

AT.L2-3.2.2 requires you to define the information security duties in your CUI environment, assign each duty to named people, and train those people so they can actually carry out what they are responsible for. It is the CMMC Level 2 version of NIST SP 800-171 Rev. 2 requirement 3.2.2, and it sits in the Awareness and Training family alongside the awareness requirement that every user receives. For a compliance lead, the practical question is whether you can show an assessor the chain from duty to person to training to competence, with records that match. NIST SP 800-171A breaks the requirement into three assessment objectives: defining the security-related duties, roles and responsibilities, assigning them to designated personnel, and training those personnel adequately to perform them. An assessor will test each objective separately, so a strong training catalog does not help if no one can show who holds the firewall change role or the access review role.

The weight of this requirement is what makes it hard to defer. Under the CMMC Scoring Methodology, AT.L2-3.2.2 is worth 5 points, which is subtracted from the maximum score of 110 when it is NOT MET. Because it is worth more than 1 point, the POA&M rules in 32 CFR 170.21 do not allow it to be carried as a open item, so it must be MET for the organization to reach Conditional or Final Level 2 status. Before scheduling any assessment, confirm the current status of the CMMC program with your contracting officer and the CMMC program rule, since the Department of War has changed the assessment timeline during 2026. Whatever the timing, the requirement itself does not change, and a gap here will hold up the whole environment.

Meeting this requirement on paper alone is difficult because the evidence has to show that training happened and that it matched the job. Assessors look for the curriculum and materials for each role, training records tied to named individuals, the procedures that govern security training, and interviews with people who hold assigned security roles. Your records should show the role description, the person assigned, the training completed and the date, and any refresher required when roles change. Role-based training should also be available for each role at the time someone takes it on, so a role change is not delayed by a fixed training calendar. Ask your learning platform vendor what its completion records contain and how they are exported, because an activity marked complete may only mean a learner viewed the material, not that they demonstrated the skill. Build the role matrix first, then the training, and keep the records in a form that stays final and reviewable.

Which roles, systems and third parties fall under AT.L2-3.2.2

Role-based training only works if the organization first decides who holds security duties, which systems those people touch, and who outside the company is covered. Each decision below changes the training population, the curriculum and the records an assessor will ask for.

Roles that hold security duties

Start with a written list of security-related duties, then map each duty to a named role. Administrators who configure systems, security staff who monitor alerts, incident responders and managers who approve access all usually qualify. Training the people in each role for what that role actually does is what AT.L2-3.2.2 asks for, so a generic all-staff course does not cover these holders. Confirm the list matches the roles in your system security plan and access approval workflow.

CUI handlers and data custodians

Anyone who creates, stores, transmits or disposes of CUI needs training that matches those handling steps. Users who only read documents differ from those who export records, move media or share files with subcontractors. For each handling task, decide which job titles perform it and record that decision. Assessors commonly test whether the people who touch CUI are the same people whose training records they review.

Systems inside the CUI boundary

Identify every system that stores, processes or transmits CUI, plus the administration tools used to manage it. Administrators of those systems carry duties that general users do not, including configuration, backup and logging. Build the training population from the boundary diagram and asset inventory, not from the org chart. Confirm that privileged accounts on cloud consoles and identity systems are included, since their operators can change protections for the whole boundary.

Managers who approve access

Managers who approve account requests, access changes and exceptions make security decisions even when they never log in to a CUI system. Training should cover what a sound approval looks like, how least privilege applies to their teams and when to escalate. Keep their approvals in the same records as their training so an assessor can see that the approver was trained before the approval was made.

Service provider and subcontractor staff

Decide whether external staff who administer, support or access your CUI environment are trained by you, by the provider, or both. Contracts should state which party delivers and records training for people with security duties. Ask providers for their training records or a written attestation, and confirm the scope covers their administrators as well as their help desk. Gaps here are easy to miss because the people involved sit outside your own human resources process.

How an assessor tests role-based training against the three objectives

This table maps each assessment objective for AT.L2-3.2.2 to the test method an assessor applies, the evidence that satisfies it, and the findings that most often keep the requirement from being met. Read it as a checklist you can run against your own environment before an assessor does.

Assessment objective	How the assessor tests it	Common finding
Duties and responsibilities are defined	Reads the security role descriptions, policies and procedures that name information security duties, then interviews staff to confirm the written duties match what people do	Duties exist only in a policy that does not name roles, or the defined duties do not cover systems that handle CUI
Duties are assigned to designated personnel	Compares the role definitions against named individuals in HR, identity and access records, and asks role holders to describe their duties	Duties are defined but no named person holds them, or assignments are out of date after reorganization
Personnel are trained to carry out their duties	Examines the role-specific curriculum and materials, training records and the procedures that schedule training, then interviews personnel with assigned roles	Training records are missing for new role holders, or the training is general awareness content rather than material tied to the role
Training mechanisms work as described	Tests the learning management system or tracking method, such as completion rules, enrollment for role changes and reporting of overdue training	Completion is marked when a learner opens a module rather than when required content is finished, or reports do not show overdue role training
Evidence is in final form	Checks that curricula, role descriptions and training procedures are approved, dated and version controlled before they are presented	Drafts are presented as evidence, which means the objective is not satisfied even when the training itself took place

Implementing role-based training in six steps

This sequence turns a general statement about training into named duties, named people, job-specific content and a dated record, which is what an assessor needs to see for AT.L2-3.2.2.

Inventory security-relevant duties
Start by listing every information security duty that the system and its CUI depend on, such as approving access requests, administering firewalls, reviewing audit logs, handling media or responding to incidents. Draw the list from your system security plan, existing policies and procedures, and interviews with the teams that do the work. The output is a duty inventory in which each entry names the task, the system or process it touches and the policy that governs it. Do not stop at generic items like 'protect data'. An assessor will ask whether each duty is written down, so the inventory is complete only when every duty in the SSP has a row.
Write the role matrix with named owners
Map each duty to a role, then map each role to the named people who hold it, including backups. The role matrix is the document that answers the assessor's question of who is assigned to what. Record the job title, the individual, the duties assigned and the date of the last review. Keep the matrix under change control so that a reassignment updates the record rather than leaving a stale name in place. The matrix is done when every duty has at least one named owner and every named owner can point to the duties on their row.
Define the job-specific curriculum for each role
For each role in the matrix, write a curriculum outline that states the knowledge, skills and abilities the person needs to carry out their assigned duties. A system administrator's curriculum will cover secure configuration and log handling, while a records clerk's curriculum may focus on CUI marking and handling. Keep general awareness content separate, since that belongs to the awareness requirement, and note which course materials, labs or job aids cover each outline item. The output is a curriculum outline per role with a named owner and a version date. Ask your training provider to confirm that course content can be tailored to these outlines.
Deliver training and record completion
Deliver each curriculum to the people assigned to the matching role, using a method that shows they learned the content, such as a graded knowledge check, a supervised practical task or a signed acknowledgment of a job aid. Record the learner, the role, the course version, the date and the result in a training log that the security team can export. Learning management platforms can hold this record. For example, Moodle's activity completion can mark an activity complete when a learner views it, receives a grade, or ticks it manually, depending on the conditions you set, so confirm which trigger you configure. Completion is verified when each assigned person has a logged result for the current curriculum version.
Set triggers for role changes and new hires
Define the events that require training before or at the point of access: a new hire, a transfer into a security role, a new system or a change to a duty. Write the trigger into onboarding and access-provisioning procedures so that a person does not receive a privileged role before the required training is logged. Track any exceptions with a documented approval and a deadline set by your own policy. The output is a written trigger procedure and a provisioning check that references the training log. Ask your assessor how they expect exceptions to be recorded, because practices differ.
Review the program annually and after changes
Review the duty inventory, role matrix, curriculum outlines and training log at least once a year, and after any significant system change, incident or reorganization. Update duties that have changed, retire content that no longer matches the system, and confirm that every current role-holder has completed the current curriculum. Record the review date, the reviewer and the changes made. This closes the cycle by showing that the training program tracks the work people actually do. Keep the review record with the SSP so an assessor can see that the program is maintained, not written once.

How learning platforms record role-based training completions

A training system used for AT.L2-3.2.2 has to prove four things: who was trained, which role-specific module they completed, when they completed it, and what result they achieved. A login history or a shared spreadsheet of names rarely answers all four. The learning platform is where those facts should be created at the time of training, so the record is generated by the system instead of assembled later for the assessment. Before choosing an open-source learning platform, confirm that it can tie each completion to a user account, a course or activity, a timestamp and an outcome, and that those records can be exported in a form your assessor can review.

In Moodle, activity completion is the mechanism that marks a learner's progress through an activity. According to the Moodle activity completion documentation, an activity can be marked complete when the learner views it, when they receive a grade from it, or when they tick it manually, depending on the conditions set for that activity. Those three triggers prove different things. A view proves the material was opened, not that it was understood. A graded assessment proves a result against a defined pass mark. A manual tick depends on a named trainer or supervisor attesting to completion, which is only as strong as the recorded identity of the person ticking. For role-based training, a graded quiz on the duties of the role is usually the closest match to the proof an assessor expects, while a view-only condition is weaker evidence of competence.

Treat completion conditions as a control decision, not a default setting. For each role-specific course, document which condition applies, why it matches the duty being trained, and who is authorized to change it. Then run a test: enroll a test user in the role, complete the course the way a real learner would, and confirm the completion record, timestamp and grade appear in the report you plan to show an assessor. Confirm the exact settings, reporting options and export formats in your own Moodle version and configuration, since the behavior depends on how the course and activity completion are set up.

Training evidence that passes AT.L2-3.2.2

AT.L2-3.2.2 is met by a set of linked records rather than a single training certificate. Each artifact below proves one part of the chain: duties were defined, people were assigned, those people were trained for their duties, and the training mechanisms work. Assessors cross-check these records, so keep them consistent and final before the assessment begins.

Role matrix and duty definitions

This is the starting point: a document listing each information security duty, the role that owns it, and the knowledge and skills the role needs. Assessors use it to confirm the organization defined its security-related duties and responsibilities before it trained anyone. Check that every duty in the system security plan and policies appears here, and that each role maps to a job family rather than to a generic label like "staff". Review it when a system, process or contract changes the duties. A matrix that no one has approved is a draft and will not satisfy the assessor.

Role assignment records

These records show which named individuals hold each role, with dates of assignment and, where relevant, the approver. Assessors compare them against the role matrix and against account and access records to confirm that the people who perform a duty are the people assigned to it. Include backup and delegated owners for critical duties. Update the records on every transfer, promotion or departure, and keep the prior assignment history so an assessor can see who held a role during the period under review.

Role-specific curriculum and materials

The course content, slide decks, runbooks and labs used for each role, versioned and dated. Assessors look for content that matches the duties in the matrix: an administrator should be trained on privileged account handling and log review, while a developer should be trained on secure coding for the systems they change. Generic awareness material does not establish role-based training on its own. Re-issue materials when a duty or tool changes and retain prior versions so the training in force on any date can be shown.

Individual training records

Per-person records showing who completed which role-specific training, when, and with what result. Assessors sample these records and compare them against the people assigned to each role, so gaps appear quickly. A learning management system can generate them, provided the report includes learner, course version, completion date and assessment result. Confirm with your platform's documentation how completion is recorded. For example, Moodle's activity completion can mark an item complete on viewing, on grading or by manual tick, so the completion condition chosen should match what proves the person was trained.

Training procedures

The written process that governs how training is assigned, delivered, tracked, repeated and escalated. It should state who schedules training for a new role, how quickly a person in a new role must complete it, what happens when a learner misses a deadline, and who signs off on exceptions. Assessors read the procedure to confirm the organization manages training systematically rather than ad hoc. The procedure should describe the process the records actually show, so review it against a sample of real records before the assessment.

Records of mechanism tests

Evidence that the mechanisms managing role-based training work as described. This includes test records showing that a role change triggers the required training, that overdue training is flagged, and that access is limited where a required course is not complete. Assessors look for these tests because SP 800-171A treats the mechanisms as part of the evidence, not only the course content. Run the tests on a schedule, record the date, tester and result, and retain failed tests with the corrective action taken.

Open-source tools that help produce role-based training evidence

Training records are the most direct evidence for AT.L2-3.2.2, because they show that named personnel completed the training tied to their duties. Moodle, an open-source learning management system released under GPL-3.0-or-later, can hold course content and track learner progress. Its activity completion feature marks an activity complete for each learner when they view it, when they receive a grade from it, or when they tick it manually, depending on the conditions the course designer sets. That completion data, with timestamps and course history, can be exported and kept as training records.

Course-level completion conditions: Set each role-specific course so that completion requires a meaningful action, such as a graded assessment, rather than a page view alone.
Per-learner completion history: Retain the completion and grade records for each person, not only the summary report for the course.
Manual completion controls: Restrict who may tick activities manually and log who did so, because manual entries are weaker evidence.
Exportable records: Confirm that reports can be exported in a format the assessment file store will keep unchanged.
Backup of the learning database: Include training records in backup and retention routines so history survives platform upgrades.

Confirm with your platform administrator and assessor which completion conditions and export formats they will accept, since the choice of activity conditions determines what the record proves.

What meeting AT.L2-3.2.2 costs in money and effort

This table lists each cost component of role-based training for AT.L2-3.2.2, who is paid for it, whether it is one-time or recurring, and what pushes it up. No price figures were supplied, so use the drivers to build a written scope and request quotes against it.

Cost component	One-time or recurring	Who is paid or who spends time	Main cost driver
Role analysis and duty matrix	One-time, then revisited when roles change	Internal security or compliance lead, sometimes with an outside consultant	Number of distinct security-related roles and how many systems each role touches
Curriculum development for each role	One-time per role, with periodic updates	Internal subject matter experts or a training contractor	Depth of role-specific content and how many roles need separate courses
Learning platform licenses or self-hosting effort	Recurring license fees or ongoing hosting and upgrade time	Software vendor for licenses, or platform engineering staff for a self-hosted LMS	Number of learners, choice between commercial and open-source platforms, and internal hosting capacity
Instructor and content maintenance time	Recurring	Internal trainers or external content providers	Frequency of policy, system and threat changes that require updated material
Training record upkeep	Recurring	HR or training administrators and system owners	Staff turnover, number of contractors and whether completion is tracked automatically
Onboarding for new hires and role changes	Recurring	Managers and the training administrator	Staff turnover and whether role-based training must be completed before access is granted
Assessor time during review	Recurring at each assessment cycle	Internal staff who answer questions and provide evidence, plus the independent assessor	Quality of organized records, number of roles interviewed and how quickly final evidence can be produced

Who owns role-based training and what a partner can take on

Your organization owns the control. Only you can decide which information security duties exist, which roles carry them, and which named people hold each role. A training program cannot satisfy AT.L2-3.2.2 if the duties behind it are undefined or the people are unassigned, because the assessment objectives ask for each of those steps in order. Your team also approves the training content, decides how much proficiency is enough for each role, and signs off on the records that show it happened. Assessors will ask the people who hold these roles what they are expected to do, so the responsibilities must be ones those people actually recognize.

Duty definitions: Write down the security-related duties for each role, such as access reviews, incident triage, change approval or backup restoration tests.
Named assignments: Map each duty to a named person or a named position, and keep the mapping current when staff move.
Approval authority: Decide who signs off on curriculum, pass criteria and exceptions for staff who cannot finish training on time.
Ownership of records: Name the person accountable for training records and their retention.
Scope decisions: Decide which systems that process CUI fall under each role.

Before any outside party is engaged, confirm that the duty list, assignment register and approval chain exist in writing and match how your staff work today.

Where organizations fail AT.L2-3.2.2 and how to close each gap

Most failures against AT.L2-3.2.2 come from paperwork that never reached the people doing the work. The gaps below follow the three assessment objectives in NIST SP 800-171A, plus the role-change timing that assessors probe, so each fix can be checked against a specific objective.

Duties never written down

Many organizations assume administrators know their security duties, but nothing in writing defines them. Assessors start by asking for the defined duties and responsibilities, and an interview that produces no document ends the test quickly. Write a short duty statement for each security-relevant role, covering backup verification, account reviews, patching approvals and incident escalation. Check that each duty maps to a control in the system security plan. The fix is a reviewed document with an owner and a date, not a policy sentence.

Roles with no named holder

A duty listed on a role chart still fails if nobody is assigned to it. Common examples are a log review role held by a departed engineer or a media sanitization role that no one knows they have. Assessors check that each defined duty is assigned to designated personnel, usually by comparing the role register with the access list and interviewing the people named. Keep a roster that names a person and an alternate for each role, and update it on every hire, transfer and termination. Confirm that the roster matches what people actually do.

Generic annual training that ignores role duties

A single annual course on phishing and passwords covers awareness, not role-based training. Role-based training should teach the knowledge and skills a specific job needs, such as how a firewall administrator validates rule changes or how a help desk agent verifies identity before a password reset. Ask each role holder to name the three tasks that carry the most security risk, then build or buy content that covers exactly those tasks. Generic courses can stay in the program for AT.L2-3.2.1, but they should not be counted as role training.

Training records not linked to roles

Completion certificates that show a person finished a course say nothing about whether that person holds a security role. Assessors look for training curriculum, training records and procedures that connect each role to the training it requires. A record that lists the name, the role, the course version, the completion date and the assessment result gives an assessor something to test. Keep these records in a system that can be queried by role, and keep the course materials for the version that each person completed. Moodle can mark activity completion, but the role mapping and the proof of competence still have to be designed and kept.

New role holders trained after they start

When a person takes on a security duty before completing role training, the organization has trained them adequately only after the gap has passed. The CMMC Assessment Guide expects role-based training to be available for every role so that role changes are not held up by the training schedule. Set the rule that a person cannot receive privileged access or a security duty until the required module is complete, or that a supervised period with a named mentor applies first. Test this with a sample of recent role changes, because the gap shows up in dates, not in policy wording.

No test of role change handling

Organizations often test whether training happened but not whether role changes flow through it. Assessors may test the mechanisms that manage role-based training, so a process that depends on one manager remembering to request training fails in practice. Run a tabletop exercise where a user moves into an administrator role, then trace the access grant, the training assignment, the completion record and the removal of the old duties. Record the result and fix any step that depended on memory. Keep the exercise notes as evidence that the mechanism works.

How much effort and time role-based training takes

Can we run role-based training for AT.L2-3.2.2 in-house?

Yes, most organizations can do this in-house, because the requirement asks you to define duties, assign them to named people and train those people, not to buy a particular product. The work sits with your security, HR and system owners. Start by listing each information security duty (for example, administering accounts, reviewing audit logs, handling CUI media) and naming the person who holds it. Then decide what knowledge each role needs and how you will confirm it was learned. An outside partner can help with curriculum design or a readiness review, but the organization owns the roles, the training and the records. Only an independent assessor can judge whether the requirement is MET.

What drives the effort behind role-based training?

Effort scales with the number of distinct security roles, how often people change roles, and how much of your environment is in scope. The main drivers are:

The number of roles and duties you must define and document
How many people hold each role and how often staff move between roles
Whether training content already exists or must be written for CUI systems
How many systems, cloud tenants and sites share the same administrators
How easily you can prove completion for every named person

The CMMC Assessment Guide Level 2 expects role-based training to be available for all roles so that a role change is not held up by the training calendar. Plan for that from the start, because a role change that waits weeks for a course is a finding waiting to happen.

Is a consultant worth paying for role-based training?

A consultant is worth considering when your roles are poorly defined, your administrators work across many systems, or your team has never documented security duties before. Ask for a fixed-scope written proposal that lists the roles to be defined, the training to be built or tailored, the records to be produced and the staff time required. DeployOpen plans, implements and documents systems and evidence in the client's own environment, and most engagements are fixed-scope with deliverables agreed in writing before work starts. DeployOpen does not issue assessment reports or certifications, and an independent assessor still judges the outcome. No price list is published, so the quote follows from the written scope.

Can AT.L2-3.2.2 go on a POA&M?

No. AT.L2-3.2.2 is a 5-point requirement under the CMMC Scoring Methodology, and 32 CFR 170.21(a)(2) does not allow requirements worth more than 1 point on a plan of action and milestones. It must be MET to reach Conditional or Final Level 2 status. Because you cannot defer it, finish the duty definitions, role assignments and training records before any assessment. The rule text is in the eCFR version of 32 CFR Part 170.

How does the Phase II suspension change timing?

The Department of War suspended CMMC Phase II on 13 July 2026, which had been scheduled to start 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. A 60-day review by a CMMC Reform Task Force followed. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. The DoW CIO page says implementation may only require self-assessments at Levels 1 and 2 for now, while the eCFR still carries the original four-phase schedule. Confirm the current position with your contracting officer and the DoW CIO About CMMC page before you set a date, and do not treat the suspension as a reason to delay role definitions.

What do staff need to give up for this work?

Staff need time for three things: describing the duties they actually perform, completing the training assigned to their role, and taking part in interviews. SP 800-171A lists interviews of personnel who hold assigned security roles as potential evidence for AT.L2-3.2.2, so the people who run administration, logging and incident work must be available to explain what they do. Ask managers to schedule these sessions early and to name a backup for each critical role, so that training does not stall a change of duties. The exact hours depend on your roles and systems, so estimate them from your own duty list rather than from a published figure.

How do we keep training records current?

Keep a single current register that maps each named person to each duty, the training they completed, the date and the evidence of completion. SP 800-171A names the security training curriculum and materials, training records and the procedures for security training as evidence, so keep all three. Update the register whenever someone changes role, and retire access to duties the person no longer holds. If your learning platform is self-hosted, the open-source Moodle LMS can record activity completion, which marks an activity complete when the learner views it, receives a grade or ticks it manually, depending on the settings you choose. Confirm that the completion condition matches your evidence standard before you rely on it, and review the register at least once a year against your duty list.

How DeployOpen prepares role-based training evidence

DeployOpen starts role-based training work with a written scope that names the roles in your organization that carry CUI-related duties, the training content each role needs, and the platform that will deliver and record it. The organization owns AT.L2-3.2.2 and every decision about who holds a role and what training that role requires. DeployOpen plans, implements and documents the supporting system inside your own cloud accounts, data center or air-gapped network, and it does not issue assessment reports or certifications. Before work begins, confirm with your assessor and your Registered Practitioner Organization, if you use one, that the proposed evidence structure matches what they will test against NIST SP 800-171A.

On the platform side, DeployOpen can configure a self-hosted learning management system such as Moodle, which is licensed under GPL-3.0-or-later, so that each role maps to a course path and completion is tracked per learner. Moodle's activity completion can mark an activity complete when a learner views it, receives a grade, or ticks it manually, depending on the conditions you set, so the completion rule for each role's course should be chosen deliberately and recorded. The deliverables typically include the role matrix, curriculum and materials for each role, completion settings, the procedure for updating training when a role changes, and exports of training records. The role matrix is the document an assessor will ask for first, because it shows the link between a duty, a named person and the training that person completed.

Evidence preparation is where most of the effort falls. Assessors expect training records to show who was trained, on what, when and against which role, and they will interview personnel who hold assigned security roles. DeployOpen can prepare the records, test the mechanisms that manage role-based training and walk your staff through them, but the training content must be approved and owned by your organization. Ask any implementation partner to confirm in writing which artifacts are delivered, who maintains them after handover, and how the work is priced and timed, since a fixed-scope agreement should state these before any build starts. Ongoing support, upgrades and periodic checks of training records can be contracted separately as a retainer.

AT.L2-3.2.2 Role-based training