AT.L2-3.2.3 Insider threat awareness: evidence and requirements

What AT.L2-3.2.3 insider threat awareness requires of a CMMC Level 2 organization

AT.L2-3.2.3 requires an organization to provide security awareness training that teaches managers and employees to recognize and report potential indicators of insider threat. It is the CMMC Level 2 version of NIST SP 800-171 Rev. 2 requirement 3.2.3, and it is worth 1 point in the scoring model. The requirement is short, but an assessor will test it against two assessment objectives in NIST SP 800-171A (June 2018): that potential indicators of insider threat are identified, and that managers and employees receive awareness training on recognizing and reporting them. The CMMC Assessment Guide defines an insider threat as an insider using authorized access, wittingly or unwittingly, to do harm. That definition matters because the people most able to cause damage already hold legitimate credentials, so the training must help staff notice behavior that is out of pattern, not just unknown intruders.

The Assessment Guide suggests broader indicator guidance for managers than for general employees, and the difference is practical. Managers see workload changes, access requests that do not fit a role, unusual approvals and team members who stop taking leave or who show financial or personal stress. General staff are better placed to notice odd system use, unexpected data movement or colleagues who ask for information they do not need. A single generic slide deck rarely covers both. Ask your training owner to show separate curriculum sections for each audience and to state, in writing, which indicators each group must report and through which channel.

This requirement is usually weak on evidence rather than on policy. Many organizations have an insider threat policy, but few can show the curriculum, the attendance or completion records and the interview answers that link the two. Assessors look for the policy and procedures, the training materials, and records showing that the right people were trained and can explain how to report. Keep the final version of the materials with dates and version numbers, retain completion records for every manager and user in scope, and rehearse the reporting path so staff can describe it. Drafts do not count toward a MET finding, so finalize documents before the assessment. Confirm the retention period and the exact evidence format with your assessor or C3PAO, since those details are set by the assessment process, not by this page.

Which people, systems and third parties this training must reach

Insider threat awareness is only as complete as its audience. The decisions below set who must complete the training, which systems define the training boundary, and who owns training for people employed by someone else. Each one changes the curriculum, the records and the evidence an assessor will ask for.

Managers and supervisors

Managers need broader indicator guidance than general staff, because they see changes in behavior, access requests and workload that individual users may not notice. Decide which roles count as managers for this requirement, including team leads and project managers who approve access. Check that each manager's training covers reporting paths and that their records are kept separately from general user records.

System administrators with privileged access

Administrators hold the authorized access that the CMMC Assessment Guide describes as the basis of insider threat, so their risk is the one most likely to be realized. Confirm that administrators receive the same insider threat content as other staff, plus scenarios involving privileged accounts, log tampering and bulk data movement. Name the administrators in scope from your identity system rather than from memory.

General users with CUI system access

Every user who can open, copy or export CUI is a potential insider, whether or not their role involves security. Decide whether the training population follows account membership in the CUI enclave, group membership in your directory, or a signed user list. Keep the population list current as people join, change roles or leave, since an untrained user with access is a visible gap.

Contractor staff trained by the organization

When contractor personnel use the CUI environment under your accounts, the organization is usually responsible for their training before access is granted. Decide whether the contractor completes your course, a training record is accepted from their employer, or both. Your contract should state which party delivers the training, who keeps the records, and how completion is verified before accounts are issued.

Subcontractor personnel and their employers

Subcontractors that handle CUI on their own systems need their own insider threat training, and the prime contractor cannot assume it. Decide whether subcontractor staff are in your training scope at all, based on whether they access your environment or only receive CUI from you. Ask each subcontractor to confirm in writing how its staff are trained and where those records are held.

Scope boundary: CUI enclave or whole environment

If the CUI enclave is the only system in scope, training covers only people with access to it, which keeps the population smaller. If insider risk is assessed across the whole environment, training must reach everyone who can reach the enclave or the systems that manage it. Document the boundary in the system security plan and confirm that the training population matches it, because assessors compare the two.

How an assessor tests insider threat awareness training

This table maps the two SP 800-171A assessment objectives for AT.L2-3.2.3 to the objects an assessor examines, the evidence that usually satisfies each one, and the findings that most often cause a shortfall. Read it row by row to see what to prepare before an assessment, and treat each finding as a check on your own materials.

Assessment element	What the assessor checks	Evidence to prepare	Common finding
Objective 1: identifying potential indicators	Whether the organization has defined what insider threat indicators look like for its own workforce and systems	Insider threat policy and procedures naming the indicators, with the date of the current version and the approver	Policy refers to insider threat only in general terms, with no indicators listed
Objective 2: awareness training for managers and employees	Whether managers and employees receive training on recognizing and reporting those indicators	Training curriculum and materials, with separate sections or variants for managers and general staff	Generic security content with no insider indicators, or no material aimed at managers
Assessment object: policy and procedures	Whether the insider threat procedure says who reports, to whom, and how reports are handled	Reporting path, escalation contacts and a record of how the procedure was communicated to staff	Reporting route exists only in someone's head or in an unpublished draft
Assessment object: curriculum and materials	Whether the content matches the policy and reflects the roles the training is meant to reach	Slide decks, course text, scenarios and knowledge checks, each tied to the indicators in the policy	Materials are copied from a vendor template and never mapped to the organization's policy
Assessment object: interviews with participants	Whether managers and staff can describe indicators and reporting steps in their own words	Prepared staff who can explain what they were taught, plus completion records for the people interviewed	Staff cannot name a single indicator or do not know how to report one
Assessment object: mechanisms that manage training	Whether the learning system delivers the course, records completion and shows who has not finished	Completion reports exported from the learning system, with assignment rules and dates for each cohort	Completion is recorded as viewed rather than assessed, so records do not show understanding

How to build insider threat training that an assessor can verify

This sequence turns AT.L2-3.2.3 into a set of documents, training records and tests that show an assessor both that the organization taught people to spot and report insider threat indicators and that people can actually do it. Each step produces an artifact that an assessor can trace back to the two assessment objectives in NIST SP 800-171A.

Define the insider threat procedure and reporting path
Start with a written insider threat procedure owned by a named role, such as the security officer or HR and security leads working together. The procedure should define what counts as an insider threat under the CMMC Assessment Guide's definition (an insider using authorized access, wittingly or unwittingly, to do harm), list the indicators to watch for, and state exactly how an employee reports a concern and who receives it. Leadership approval and a version date close this step. Assessors look for the procedure first, because the training content must match it.
Write separate curricula for managers and general staff
Build two curricula from the same procedure. The manager version covers a broader set of indicators, such as changes in behavior, access requests that do not fit a role, and how to handle a report without tipping off the individual. The general staff version focuses on recognizing unusual activity in day-to-day work and on the reporting route. Keep the module outlines, slides, scripts and knowledge checks under version control so the assessor can compare what was taught with the procedure.
Deliver the training and record completion
Deliver each curriculum to the audience it was written for, then record who completed it, when, and which version they took. Use a learning platform such as a self-hosted Moodle instance if you need automated records. Confirm the completion rule before relying on it: Moodle's activity completion marks an activity complete on viewing, on grading, or on a manual tick, depending on how the activity is configured. A view-only completion is weaker evidence than a graded knowledge check, so set the rule deliberately and document it.
Set the refresher and new-hire cadence
Define when new hires take the training and how often existing staff and managers repeat it. Write the interval into the procedure, not only into the course settings. Assessors compare the stated cadence against the completion records, so a cadence that appears in the procedure but is missing from the records is a finding. Confirm any interval your contracts, insurers or internal policy require with those parties before you set it, because this step asks you to choose a schedule rather than copy one from the standard.
Test whether people recognize and report indicators
Test the outcome, not only attendance. Use scenario-based knowledge checks that ask learners to identify indicators in a short case and choose the correct reporting path. Where your organization runs phishing simulations or tabletop exercises, add insider threat scenarios to them. Record the pass rates, the questions that most learners missed, and the corrective action taken, such as revised content or a follow-up session. These test results show the second assessment objective, that managers and employees can recognize and report indicators, rather than only that they sat through a course.
Retain training, test and procedure records
Keep the approved procedure, every curriculum version, completion records, test results and the corrective actions in a single evidence folder, tied to the system security plan. Set retention based on your contract and the organization's records policy, and confirm the period with your contracting officer or assessor. Assessors judge evidence in final form, so an unsigned draft procedure or a curriculum with no version date will not count. Review the set at each refresher cycle and before any assessment.

Why completion records alone do not prove recognition

An attendance record shows that a learner reached an activity, but AT.L2-3.2.3 is about whether people can recognize and report potential indicators of insider threat. NIST SP 800-171A breaks the requirement into two assessment objectives: identifying potential indicators, and providing managers and employees with awareness training on recognizing and reporting them. A checkbox that says a course was opened does not show either objective. Assessors will ask what the training actually required people to do and how the organization knows the content was understood.

Learning platforms usually record completion through conditions, not through understanding. In Moodle, for example, activity completion marks an activity complete for each learner when they view it, when they receive a grade from it, or when they tick it manually, depending on the conditions the course designer set. A view-based condition proves only that a page loaded. A manual tick proves only that someone clicked a box. Only a graded assessment, or a signed acknowledgment tied to a defined procedure, gives the organization a record that reflects recognition. The exact completion API behavior is documented in the Moodle developer documentation, and the reader should confirm the behavior in the version they run.

Choose completion conditions deliberately and write them down before the first learner enrolls. For each insider threat module, decide whether completion requires a passing score on scenario questions, a manager-specific quiz that covers escalation, or an acknowledgment of the insider threat reporting procedure. Record the conditions, the passing threshold, the question bank version and the date the settings took effect, and keep that record with the training curriculum that assessors will request. Confirm with the assessor how they expect graded and acknowledged completions to be presented. Changing conditions later without documentation weakens the evidence trail.

Evidence that passes insider threat awareness

An assessor testing AT.L2-3.2.3 looks for two things: a documented insider threat program that managers and staff actually follow, and records proving that training happened and stayed current. Each artifact below supports one of the two assessment objectives in NIST SP 800-171A, and each must exist in final form before the assessment, not as a draft.

Approved insider threat policy and procedure

The policy defines what an insider threat is at your organization, names the roles that own detection and response, and sets out how a concern moves from a report to a review. Assessors check the approval date, the approver, and whether the procedure matches what staff describe in interviews. Confirm that the reporting path in the procedure is the same path the training teaches. Keep a version history so the current approved text is easy to identify.

Training curriculum for managers and staff

Assessors look for separate material for managers and general staff, because the CMMC Assessment Guide expects broader indicator guidance for managers. The manager version should cover behavioral and access-related indicators that supervisors are placed to notice, while the staff version covers what to report and how. Each deck, script or module should carry a version number and the policy it reflects. Store the final files in the evidence folder, not only inside the learning platform.

Enrollment and completion records

Records must show who was assigned the training, when they completed it, and which version they saw. In Moodle, activity completion can mark an activity complete when a learner views it, receives a grade, or ticks it manually, so set the completion condition deliberately and document it. Export dated completion reports at least once before each assessment and reconcile them against the current staff roster, including people who joined after the last course run.

Assessment or acknowledgment results

A knowledge check or signed acknowledgment shows that people recognized indicators and understood the reporting duty, not only that they opened the course. Keep the question bank, pass criteria, and individual results with timestamps. Where a learner fails, record the retake and the outcome. Assessors may ask to see results for a sample of managers and general staff, so make sure both groups are represented in the records you retain.

Reporting channel records

Training teaches people to report, so assessors check that the channel exists and that reports actually reach the people responsible. Keep evidence of the channel itself, such as a monitored mailbox, ticket queue or hotline configuration, along with the access list for who can read reports. Redacted samples of handled reports, showing intake, triage and closure dates, demonstrate that the procedure runs in practice. Confirm retention rules for these records with your legal and HR teams.

Training update history

Training must change when the policy or threat picture changes, and the history shows that it did. Keep a dated change log that links each revision of the curriculum to the policy change or lesson learned that prompted it. Note when outdated material was retired and when the revised version was assigned to staff. Ask your assessor or the DoW CIO documentation which review cadence they expect, since this page does not supply one.

What meeting AT.L2-3.2.3 costs in money and effort

This table lists each cost component of an insider threat awareness program, who is paid for it, whether it is one-time or recurring, and what drives it up or down. Use it to structure a quote request, since no supplied figures exist for these costs and every amount must come from your own scope and vendor pricing.

Cost component	Who is paid or who bears the effort	One-time or recurring	What drives the cost
Insider threat content development	Internal security or HR staff, or an implementation partner for the training modules	One-time, with periodic updates	Number of manager and general staff tracks, depth of indicator coverage, and how often the material changes
Procedure drafting for insider threat reporting	Internal security, HR and legal staff, or an outside consultant drafting the procedure	One-time, with annual review	Number of reporting paths, integration with existing HR and disciplinary processes, and the number of approval rounds
Legal and HR review	Internal counsel and HR, or outside employment counsel if the organization uses one	One-time, repeated after material changes	Jurisdictions where staff work, union or works council requirements, and how monitoring and reporting duties are worded
Learning platform licenses or self-hosting effort	Commercial LMS vendor, or internal platform engineering staff if the LMS is self-hosted	Recurring: license fees or hosting, patching and backup effort	Headcount enrolled, integrations with identity and HR systems, and whether hosting sits in your own infrastructure
Delivery and refresher cycles	Internal trainers, security staff or the training platform administrator	Recurring, usually tied to onboarding and an annual cycle	Workforce size, turnover rate, number of manager roles, and how many completions must be tracked as evidence
Reporting channel setup and operation	Internal security operations or a managed service, plus the staff who triage reports	Setup is one-time; triage is recurring	Choice of channel (ticketing, hotline, email), volume of reports, and whether reports route to HR, legal or the SOC
Assessor time and evidence preparation	Internal compliance staff and the independent assessor, who is paid by the organization	Recurring at each assessment cycle	Number of training records to sample, how cleanly records are kept, and whether procedures and curriculum are in final form
Content localization	Translation vendor or internal linguists, plus local reviewers	One-time per language, with updates	Number of languages in the workforce and how often the curriculum changes

Who owns insider threat training, who can help, and what the assessor will not do

Your organization owns the insider threat policy, the training content it approves, the audience it trains and the records that prove training happened. Under NIST SP 800-171A, an assessor examines the insider threat policy and procedures and the security awareness curriculum and materials, so these documents must exist, reflect your actual operations and be approved by someone accountable. Responsibility for the requirement does not transfer to a consultant or platform vendor, even when someone else builds the course.

Policy and procedure: Define what counts as an insider threat indicator for your business, who reports it and where the report goes.
Content approval: Review and sign off on training material, with separate guidance for managers and general staff.
Audience decisions: Name the populations that must complete training and how often they repeat it.
Records: Keep completion records, dates and retained versions of the course materials.
Ownership: Assign a named role, such as the security officer or HR lead, to answer assessor questions directly.

Before engaging anyone, check that you can produce the policy, the approved curriculum and a training roster without help from outside parties.

Gaps that cause this requirement to fail or land on a POA&M

Most AT.L2-3.2.3 findings come from training that exists on paper but does not show that managers and employees can recognize and report insider threat indicators. The gaps below are the ones assessors most often find when they test the policy, the curriculum and the training records against the two assessment objectives in NIST SP 800-171A.

No separate manager guidance

The CMMC Assessment Guide suggests that indicators for managers are broader than those for general employees, because managers see changes in behavior, access requests and performance that staff do not. A single module for everyone leaves managers without the indicators they are expected to act on. Check that the curriculum or its materials contain a manager section covering escalation, documentation and how to handle a concern about a direct report.

Generic training with no indicators

Training that defines insider threat in general terms does not meet the first assessment objective, which is identifying potential indicators. Assessors look for concrete examples tied to the organization, such as unusual off-hours access to CUI repositories, bulk downloads before departure, or requests for access outside a job role. Confirm that the materials list specific indicators and that the organization can show where they came from.

No documented reporting path

The second objective requires training on reporting potential indicators, so a course that stops at recognition is incomplete. Employees need to know who receives a report, how to submit it when the report concerns a manager, and whether reports can be made anonymously. Check that the insider threat procedure names the reporting channel, the receiving role and the expected handling steps, and that the training points to them.

Training records not tied to named people

Assessors interview training participants and test the mechanisms that deliver the training, so records must show who completed what and when. Shared logins, unlabeled completion lists and spreadsheets that do not match directory accounts make it impossible to prove that a given employee was trained. Where a Moodle-based LMS is used, activity completion can be set to mark completion on viewing, on grading or on a manual tick, so confirm the chosen condition matches what the policy says counts as trained.

Outdated content

Insider threat indicators change as systems, data flows and threats change, and training that predates the current system security plan or reporting structure will not reflect how the organization actually operates. Assessors compare the curriculum date and content with current policy. Set a review date for the materials, tie each review to changes in the insider threat procedure, and keep the revision history with the training package.

No evidence the training was tested

Assessors look for the mechanisms that manage insider threat training and for evidence that employees can apply what they learned, not only that they clicked through a course. Without a knowledge check, a scenario exercise or a documented reporting drill, the organization cannot show the training works. Add a short assessment or tabletop exercise, record the results against named individuals, and retain the outcome for the assessment file.

Questions buyers ask about insider threat awareness training

Can a POA&M cover AT.L2-3.2.3 insider threat awareness training?

Yes, in principle. AT.L2-3.2.3 is worth 1 point under 32 CFR 170.24 and is not on the exclusion list in 32 CFR 170.21(a)(2)(iii), so it can sit on a plan of action and milestones for Conditional Level 2 status. That route depends on the overall score reaching at least 88 of 110 (0.8), and closeout is due within 180 days. Confirm your current score with your assessor or with the rule text before you rely on it. Because the Department of War suspended CMMC Phase II on 13 July 2026, timing for any certification assessment is under review, but Phase I self-assessments and SPRS postings still apply. Treat the POA&M as a short bridge, not a place to defer the training program.

How much effort does insider threat awareness training take to set up?

The effort is mostly in the content and the records, not the delivery. You need a written insider threat policy and procedure, a curriculum with separate material for managers and general staff, a way to deliver it, and a way to prove who completed it and when. NIST SP 800-171A treats the policy, procedures, curriculum and training materials as the objects an assessor reviews, and it expects interviews with people who took the training. Effort rises with the number of roles, the number of sites, and whether your organization already has a reporting channel for concerns. A quote should break the work into policy drafting, curriculum build, learning platform configuration, and evidence collection, with each item tied to a named deliverable.

Can our own staff deliver insider threat awareness training without outside help?

Usually yes, if you have someone who owns security policy and someone who can build or host the course. Most organizations keep ownership of the policy, the escalation path and the sign-off on training content, since those decisions carry the organization's risk. Outside help is most useful for drafting material that distinguishes manager indicators from general staff indicators, configuring a learning platform so completion is recorded reliably, and packaging evidence for an assessor. An implementation partner can prepare these artifacts, but only an independent assessor issues the assessment result. Ask any provider to state in writing which parts they produce and which parts remain with your staff.

What should an implementation partner deliver for this requirement?

A good partner delivers working artifacts you can hand to an assessor, not a slide deck. In practice that means an insider threat procedure that names reporting paths and roles, a curriculum split into manager and general staff versions, a configured self-hosted learning platform with completion tracking, a record of which users completed each module and when, and a short evidence index that maps each artifact to the assessment objectives in NIST SP 800-171A. Where a platform records completion as soon as a learner views an activity, the partner should document that behavior and configure the activity so completion reflects the training you intend. Ask for the deliverables list in the written scope before work starts.

How often should insider threat awareness training recur?

The requirement does not set a fixed frequency in the material supplied, so define the interval in your own policy and be ready to justify it. Common practice is to train at onboarding, repeat on a regular cycle, and refresh after significant changes such as new systems, new reporting channels or confirmed incidents. Your policy should state the cycle, who tracks it, and what happens when someone is overdue. Assessors look for consistency between the stated cycle and the completion records, so a cycle you cannot show in the records is a finding even if the content is strong. Confirm any frequency expectation with your assessor or contracting officer.

How does insider threat awareness training differ from role-based training under AT.L2-3.2.2?

Insider threat awareness teaches everyone, and managers in particular, to recognize and report potential indicators of insider threat, which the CMMC Assessment Guide defines as an insider using authorized access, wittingly or unwittingly, to do harm. Role-based training under AT.L2-3.2.2 assigns defined information security duties to named people and trains them to perform those duties. The two can share a learning platform and records, but they answer different questions: one asks whether people spot and report concerns, the other asks whether people with security responsibilities can carry them out. Keep separate curricula and separate evidence so each objective can be tested on its own.

What evidence will an assessor ask for to show insider threat training works?

Assessors will ask for the insider threat policy and procedures, the awareness curriculum and training materials, and records showing who completed training. They also interview people who took the training to confirm they can recognize and report indicators. Strong evidence is dated, versioned and final, since a requirement is met only when evidence is in final form rather than in draft. Export completion records from your learning platform, keep copies of the materials as they stood at delivery, and note where the reporting channel is documented. Confirm with your assessor which format they accept for records before you build the evidence set.

Where DeployOpen fits in preparing this evidence

DeployOpen plans and prepares the systems, training workflow and evidence behind AT.L2-3.2.3 in your own environment, under a written scope agreed before work starts. In practice that means helping you set up the training platform, build the insider threat training content for managers and general staff, configure course completion tracking, and organize the procedure and record set an assessor will ask for. DeployOpen does not decide what your insider threat indicators are, does not sign off on whether the requirement is met, and does not issue assessment results. Those decisions stay with your organization, and any formal determination comes from the independent assessor your contract requires.

The work usually splits into a few pieces that are easy to scope separately. Your organization owns the insider threat policy, the procedure for reporting concerns, and the decision about who is trained on which material. A partner can draft the training modules from that policy, host them on a self-hosted learning platform such as Moodle, and configure activity completion so that records show who viewed the material and when. Ask any partner to confirm in writing which of these items are in scope, who approves the content, and who keeps the training records after handover. Ask also how the evidence will be retained and which assessment objectives in NIST SP 800-171A each artifact supports.

Before you engage anyone, confirm your current training records against the two assessment objectives for this requirement, and confirm which CMMC assessment path applies to your contracts, since the program timeline has been changing. The DoW CIO's About CMMC page is the place to check current status. Independent assessment is performed only by an authorized or accredited assessor, so an implementation partner's readiness work does not replace that step. Treat any partner that promises a pass or a certificate as a warning sign.

How DeployOpen scopes and prepares insider threat awareness evidence

DeployOpen works on AT.L2-3.2.3 as part of a written, fixed-scope engagement that prepares systems and evidence for your own assessment. Your organization owns the insider threat policy, the training content and the decision about who completes what, while DeployOpen helps build the records an assessor will examine.

How we scope

Confirm which personnel are managers, which are general staff, and which systems hold CUI in scope for training.
Inventory the insider threat policy, procedures and reporting channels that already exist before any changes are proposed.
Agree in writing the deliverables, timelines and responsibilities, so your team knows exactly what the engagement covers.

How we build

Draft separate training modules for managers and general staff, reflecting the broader indicator guidance suited to managers.
Configure the learning platform so completion is recorded per learner, with quiz results and reporting paths retained as evidence.
Test the training mechanisms and reporting workflow end to end, confirming that records can be exported for assessor review.

How we hand over

Document the curriculum, materials, version history and the insider threat procedures in a form your assessor can review.
Provide an evidence map linking each assessment objective for 3.2.3 to the artifact that demonstrates it.
Walk your staff through operating the training and reporting process so ownership stays with your organization.

How we support

Engage ongoing support as a retainer to update training content when policy, personnel or threats change.
Schedule periodic checks that completion records and reporting channels still work as documented.
Ask your assessor or certification body to issue any formal report, since DeployOpen prepares evidence but does not certify.