03.02.02 Role-based training: requirements and evidence

What role-based training requires before access and after

If a contract or assessment has asked you to show that people with security duties are trained for those duties, 03.02.02 Role-based training is the requirement you will be measured against. It asks your organization to give role-based security training to personnel who have assigned security duties before they are authorized to access the system or CUI or perform those duties. After that first session, training must repeat at a defined frequency, and it must also happen when system changes or other defined events require it. The training content itself has to be kept current, both on a schedule and after defined events. The underlying risk is simple: administrators, incident responders, system owners and others with elevated responsibilities can cause serious, avoidable damage through errors they were never shown how to avoid.

The hard part is usually not writing a course. It is that 03.02.02 has four organization-defined parameters (ODPs) that NIST does not fill in for you: how often role-based training repeats after the initial session, which events trigger a training requirement, how often the training content is updated, and which events force a content update. If a federal agency that holds the contract does not specify these values, you must assign them yourself, and an assessor will expect to see them written down and justified. The other common obstacle is that the roles themselves are undefined. Before you can say who needs role-based training, you need a list of personnel with assigned security duties, tied to a documented responsibility, such as the people named in your incident response plan or system security plan. Ask your compliance lead to confirm where those roles are recorded.

Do not confuse this requirement with 03.02.01 Literacy training and awareness, which covers security literacy training for all system users, including recognizing insider threat and social engineering. Literacy training is broad and applies to everyone with access. Role-based training is narrower and deeper, and it applies only to people whose duties call for specific security knowledge. A single course will rarely satisfy both. In practice, the two requirements can share a learning platform and records, but they need separate curricula, separate audiences and separately documented ODP values. Before you commit to a training plan, confirm with your contracting officer or assessor whether the ODP values for this requirement are already specified in the contract, and check the assessment procedure in NIST SP 800-171A Rev. 3 so you know what evidence the assessor will request.

Which roles and systems fall under role-based training

Role-based training under 03.02.02 applies to the people who hold security duties in a system that handles CUI, not to every user. The cards below cover the role groups organizations usually include, and the scoping choices that change how much training work results. Confirm each choice against the system security plan and the revision named in the contract.

System administrators

Administrators who configure servers, directories, network devices and cloud tenants that store or process CUI usually hold the largest share of security duties. Their training should cover hardening baselines, privileged account handling, logging settings and change control for the systems they run. Check whether every account with administrative rights is traced to a named person who has completed the role-based course before that access is granted.

Security operations and incident responders

Staff who monitor alerts, triage events and run the incident handling process need training that matches the procedures they follow during an incident. Because the training must be given before these people perform their duties, check that responders are not first trained during a live event. Confirm which events trigger a refresher, such as a new detection tool, a changed reporting path or a material incident.

Help desk staff with privileged access

Help desk personnel who reset passwords, unlock accounts or access user devices often hold privileges that attackers target through social engineering. Their role-based training should address the specific account recovery and device access steps they perform. Check whether help desk tools with elevated rights are treated as security duties, since many organizations overlook them when they build the role list.

System owners and security plan roles

System owners, authorizing officials and the people named in the system security plan for security responsibilities often have decision duties rather than hands-on tasks. Their training should match those decisions, such as accepting risk, approving changes and reviewing plans of action. Compare the roles in the plan with the roles in your training records, because a role named in the plan but absent from training is a common gap.

Contractors, managed service staff and third parties

Whether external personnel fall in the role population depends on their access. Contractors, managed service providers and vendors with administrative access to CUI systems hold security duties even though they are not employees. Decide whether their training is delivered by you, required of the provider by contract, or verified through evidence the provider supplies. Confirm these terms in the service agreement before access starts.

Training administrators and content owners

The people who build, schedule and maintain role-based courses, and who keep the training records, also carry duties under 03.02.02. Their work covers setting the update frequency and the events that require content changes, which are defined parameters the organization must assign. Ask who approves course changes and who confirms that the content still matches current system configurations and procedures.

How an assessor tests role-based training

This table maps the SP 800-171A Rev. 3 assessment for 03.02.02 to the evidence an assessor requests and the findings that commonly appear. Read each row as one assessment method, its objects, the evidence to prepare, and where the test usually fails. Undefined organization-defined parameters and training that is not tied to specific roles are the gaps to close before an assessment begins.

Assessment method	Objects the assessor requests	Evidence to prepare	Common findings
Examine	Security awareness and training policy and procedures; procedures for security training implementation	Approved policy naming the role-based training owner; implementation procedure showing how training is assigned before access is granted	Policy exists but does not state when role-based training is required or who owns it
Examine	Security training curriculum and training materials	Curriculum mapped to each security role, with version dates and the review record showing content was updated	One generic course for all staff, with no role-specific modules for administrators or incident responders
Examine	Codes of federal regulations referenced in training content	Training content that references the regulations and contract obligations that apply to the system and its CUI	Materials cite outdated or unnamed requirements, so content no longer matches the contract
Interview	Personnel with responsibilities for role-based security training	Named training owner able to explain assignment rules, frequency, and triggers for refresher training	Training owner cannot describe the defined frequency or the events that trigger retraining
Interview	Personnel with assigned system security roles and responsibilities	Role list with the training each role completed and the date, ready to walk through with the assessor	Staff with privileged or security duties say they were never given role-specific training
Test	Mechanisms for managing role-based security training and awareness	Learning management system records showing enrollment, completion, and access restrictions tied to training status	Completion is tracked manually in spreadsheets with no link to account provisioning
Determination check	Four organization-defined parameters for training frequency, events, content update frequency, and content update events	Documented values for all four parameters, approved by the accountable owner and cited in the policy	One or more parameters left undefined, so the ODP check fails even when training happens
Determination check	Six determination statements for 03.02.02	Cross-reference table linking each determination statement to the policy, curriculum, and records that answer it	Evidence is organized by document type, so the assessor cannot trace it to a determination statement

How to implement role-based training in the right order

This sequence turns the 03.02.02 requirement into a working program: people with security duties are identified, the organization sets its own parameter values, training is tied to access, and records and content updates are kept so an assessor can trace each step. The final output is a training program that a reviewer can test against the requirement.

Identify security-duty roles and the people who hold them
Start by listing every function in the system boundary that carries a security duty, such as system administrators, security operations staff, incident responders, developers with access to CUI environments, and anyone who approves access or changes. For each role, name the current holders and record the duties that justify training. Your system security plan and access records should show who holds privileged or security-relevant rights, so reconcile the two sources. The output is a role matrix that maps each role to its people, duties and systems. You know this step is done when every person with a security duty appears in exactly one role entry and an assessor could trace a named individual to a documented duty.
Set the four organization-defined parameter values
03.02.02 leaves four values to the organization: the frequency of refresher training after initial training, the events that trigger role-based training, the frequency for updating training content, and the events that require a content update. If a federal agency or contract specifies values, use them. Where none are given, your organization assigns them and must be able to justify each choice. Record the values with the rationale, the owner who approved them and the date. The output is an ODP decision record. You know this step is done when each of the four parameters has a stated value, a documented reason, and an approver, with no blank fields.
Build or map role-specific curriculum
For each role in the matrix, define what the person must be able to do safely, then map existing training material to those tasks. Gaps should be filled with new modules covering the actual procedures, tools and CUI handling rules that apply to that role, not generic awareness content, which belongs to the literacy requirement under 03.02.01. Keep the curriculum, the training materials and the learning objectives under version control so the content can be traced. Confirm with your assessor which materials they expect to see. The output is a curriculum set per role with objectives, materials and a version history. You know this step is done when every role has a curriculum entry that names the tasks it covers.
Define the training gate before access or duty assignment
03.02.02 requires training before a person is authorized to access the system or CUI or perform assigned duties. Write an access gate procedure that ties the provisioning workflow to training completion, so that identity and access requests for a security role cannot be fulfilled until the required role-based training is recorded as complete. Cover exceptions too, such as emergency access, and state who may approve them and what must follow. Ask your identity platform or ticketing tool whether it can enforce this check, and confirm the behavior in your own environment before relying on it. The output is a written access gate procedure with its workflow steps. You know this step is done when a sample request for a security role shows the training check before the grant.
Run the training and record completion
Deliver each curriculum to the people in its role, using the internal learning platform or a self-hosted system such as Moodle, where activity completion can mark a learner complete when they view an activity, receive a grade or tick it manually, depending on the conditions you set. Choose the completion condition deliberately, because a view alone may not show that the duty was understood. Store completion records with the learner, role, curriculum version, date and the parameter that triggered the training. The output is a set of completion records that link each person to a curriculum version. You know this step is done when a reviewer can pull a record for any person in the role matrix and see what they completed, when, and against which version.
Set the content review cycle and change triggers
Using the update frequency and the update events from the ODP record, schedule reviews of each curriculum and assign an owner for each. Add the events that force an earlier update, such as a significant system change, a new tool, a security incident involving the role's duties or a change to CUI handling rules. When a trigger fires, the owner revises the curriculum, reissues it, and reruns training for affected people. Keep a change log that records what changed, why and who approved it. The output is a content change log and a review calendar. You know this step is done when each curriculum has a dated review entry and a traceable link between each change event and the training that followed it.

Which evidence shows role-based training is current

An assessor testing 03.02.02 examines the policy, the curriculum, and the training records, then interviews the people who run the program. The cards below cover the artifacts that answer those checks and the routine that keeps each one accurate between assessments.

Role-based training policy and procedure

The written policy and procedures for security awareness and training are the first examine object SP 800-171A names for this requirement. They should state which roles count as having assigned security duties, who owns the program, and how training is delivered and recorded. Check that the document names an owner, carries a version and approval date, and is reviewed on a schedule you set. An assessor will compare what the procedure says with what the training records show, so mismatches are a common finding.

ODP decision record with approval

Four organization-defined parameters govern 03.02.02: the frequency of post-initial training, the events that trigger training, the frequency of content updates, and the events that require content updates. If a federal agency does not set them, your organization must, and the SP 800-171A procedure checks that each value is defined. Keep a decision record that states each value, the reasoning, the approver, and the date. Bold the approver's name in your record so an assessor can confirm accountability at a glance.

Role-specific curriculum with version history

Assessors look for a security training curriculum and training materials tailored to each role, such as system administrators, developers, approvers of changes, and incident responders. Each module should map to the duties it prepares people for. Keep version history showing what changed, when, and why, especially after system changes or defined events. A single generic deck for every role will not show that training matched the responsibilities of the people taking it.

Completion records tied to roles and dates

Completion records are the main evidence an assessor will sample. Each record should show the learner, the role they held at the time, the module version, and the completion date. Most learning platforms can export this data, but confirm that the export includes the module version and role, not only a pass mark. Review the records against the current role roster each quarter so that people who changed roles are retrained or have access adjusted.

Access gate records showing training first

03.02.02 requires training before a person is authorized to access the system or CUI or perform assigned duties. The strongest proof is an access gate: a provisioning record that shows the training completion was checked before the account or privilege was granted. Where the identity system cannot enforce this, keep a dated approval ticket that links the access grant to the completion record. Confirm with your identity team which gate is actually enforced, because a documented gate that is bypassed will fail the test.

Event-triggered training and content update logs

When a system change or a defined event occurs, your ODP decisions require training or a content update. Keep a log that records each trigger, the date, the training or update issued, and the people affected. Pair it with a content update log that shows when materials were revised and which trigger caused the revision. Reviewing these logs at each change board meeting, and signing off on them, gives an assessor a direct path from change to training.

What role-based training costs to meet

This table lists the cost components behind meeting 03.02.02, who typically carries each one, whether it is one-time or recurring, and what pushes it up or down. Use it to build a written scope before asking for quotes, since the number of roles, systems and content updates shapes most of the spend.

Cost component	One-time or recurring	Who is paid or who carries it	What drives it up or down
Role mapping and ODP decisions	One-time, revisited on change	Internal staff, sometimes with an implementation partner	Number of roles with security duties and how many ODP values the contracting agency has specified
Curriculum development or tailoring	One-time, then recurring with updates	Internal security lead or contracted content developer	Whether content is bought and adapted or built from scratch, and how many role-specific curriculum units are needed
Training delivery and learning platform	Recurring	Platform operator, internal team or hosted provider	Number of learners, refresh frequency, and whether a self-hosted learning platform already exists
Engineering time to link completion to access gates	One-time, with ongoing maintenance	Internal engineering or implementation partner	Number of systems that require training before access and how identity tooling integrates with the learning platform
Evidence upkeep	Recurring	Internal compliance staff, with partner support if scoped	Volume of completion records, curriculum versions and change-triggered training logs to retain and organize
External review of curriculum	Recurring or per update cycle	Independent reviewer or subject matter specialist	Whether content is reviewed on a schedule, after defined events, or only before an assessment
Auditor sampling time	Per assessment cycle	Independent assessor, billed to the organization	Sample sizes, number of roles tested and how quickly training records can be produced
Quote scope requirements	One-time, at procurement	Organization and any bidding partner	Ask for a written scope listing roles, systems, curriculum units, ODP decisions and evidence deliverables

How Moodle activity completion can record training

Moodle is a GPL-3.0-or-later learning platform that an organization can run inside its own infrastructure, so training records stay under its control. Its activity completion feature can produce per-learner records that support 03.02.02, but the platform only shows that training happened under the conditions chosen, not that the right people were trained before access.

What activity completion records

Moodle marks an activity complete for each learner when they view it, when they receive a grade from it, or when they tick it manually, depending on the conditions set for that activity. For role-based training, a view-only condition can show that someone opened the material, but it does not show that they understood it. Choose the completion condition before the course goes live, because changing it later affects how existing records read.

Matching completion to ODP values

The organization assigns the values for the frequency of role-based training, the events that trigger it, and the frequency of content updates. Each completion condition should reflect the training that the chosen values require, such as a graded assessment for a privileged administrator course. Record the ODP values and the matching completion settings together so an assessor can trace one to the other.

Per-learner completion evidence

Completion data can be exported per learner and per course, giving an assessor a dated list of who finished which role-based module. Keep exports from the same period as the role assignments they cover. Confirm with your Moodle administrator how completion data is retained and backed up in your environment, since the audit trail depends on those records remaining intact.

Linking completion to access

Completion alone does not stop an untrained person from getting access. The organization must add its own control, such as an identity workflow that grants privileged or CUI-related roles only after the required course is complete. Test this link with a sample account, because a completed course that does not gate access does not satisfy the requirement that training come before access.

Recording role assignments

Completion records show who trained, but assessors also need to see which security duties each person held at the time. Keep a role register that links each user to assigned security responsibilities and the dates those roles began and ended. When a role changes, the register should trigger the event-based training defined in the ODP values.

Keeping Moodle as one part of evidence

Moodle output supports the examine and interview methods used in SP 800-171A, but assessors will also review the training policy, the curriculum and the training materials. Confirm with your assessor which artifacts they expect alongside platform exports. Treat the platform as a record-keeping component inside a broader training program, not as the program itself.

Who does what for role-based training

The organization owns the requirement and everything that makes it true. It decides which personnel hold security duties, sets the ODP values that NIST leaves to the organization when the federal agency does not specify them, and approves the curriculum for each role. It also controls the access gates that stop someone from touching CUI or system functions before training is complete, and it keeps the training records that show who was trained, on what content, and when.

Role population: Maintain a current list of personnel with assigned security duties, such as administrators, incident responders and system owners, and refresh it when roles change.
ODP decisions: Document the training frequency, the events that trigger training, the content update frequency and the events that trigger content updates.
Access gates: Tie system and CUI access to training completion so that authorization cannot precede training.
Curriculum approval: Name an accountable owner who signs off on role-specific content and each update.
Records: Keep completion evidence that an assessor can sample, including dates, content versions and learner identities.

Before engaging anyone, confirm that the organization has written its ODP values and can produce a dated list of role holders.

Where role-based training usually falls short

Role-based training under 03.02.02 fails in predictable places: the parameters are left open, the people who need training are never named, and the records cannot prove who was trained, when and for what. Each gap below is one an assessor can test directly, and each fix is something an organization can finish before the assessment begins.

Organization-defined parameters left undefined

03.02.02 has four organization-defined parameters: how often role-based training is repeated after initial training, which events trigger it, how often training content is updated, and which events trigger a content update. NIST does not assign these values, so if the federal agency does not specify them, the organization must. An assessor checks that each value is defined, and an undefined parameter leaves the requirement incomplete even when training happens. Write all four values into the training policy and confirm the agency agrees with them.

Security roles never identified

Role-based training can only be scoped if the organization has a list of personnel with assigned security duties, such as system administrators, security operations staff, incident responders and developers of CUI systems. Without that list, training either reaches everyone in a generic way or misses the people who hold privileged duties. An assessor interviewing personnel with system security responsibilities will ask who they are and what training they took. Maintain a role register that maps each security duty to the training it requires.

Training completed after access was granted

The requirement expects role-based training before a person is authorized to access the system or CUI or to perform assigned duties. A common failure is provisioning an administrator account on day one and scheduling the role course for the following month. Assessors compare account creation dates with training completion dates. Tie the access request workflow to the training record so that approval waits for completion, and document the exceptions and who approved them.

Content not updated after system changes

The requirement ties training content to defined events, so a change to the platform, a new integration, or a new threat pattern can make existing material wrong. Training that still describes an old admin console or a retired approval path fails the test even if people attended it. Assessors look for evidence that content was reviewed after the events named in the parameters, such as version history and change tickets linked to curriculum updates. Set a review step in the change process so that content owners are notified of relevant changes.

Completion records that cannot be traced

A learning management system can show that a course was finished, but many deployments cannot show which role the learner held on that date or which version of the material they saw. Assessors need to link a person, a role, a course version and a completion date in one place. Moodle's activity completion can mark an activity complete when a learner views it, receives a grade, or ticks it manually, so the completion condition chosen determines what the record proves. Confirm which condition is used for role-based courses and export records with role and version fields.

Third-party administrators outside the training population

Managed service providers, contractors and vendor support engineers often hold administrative access to systems that hold CUI, but they sit outside the organization's HR-driven training roster. When they are left out, the population the assessor tests is incomplete. Include contracted personnel with security duties in the role register, require the same training before access, and get the provider's training records as part of the contract. Confirm in the agreement how often the provider repeats training and how it reports completions to the organization.

Questions buyers ask about role-based training

How much effort does role-based training take to set up?

The effort depends mainly on how many roles carry security duties and how much training content already exists. Start by listing every role with security responsibilities, such as system administrators, incident responders, developers who touch CUI systems and managers who approve access. Each role group needs its own content, delivery method and completion record. Effort also rises when the organization has not yet decided its four organization-defined parameters (ODPs), because those decisions shape the content and the schedule. Ask any implementation partner to quote content development, learning platform setup, delivery and record keeping as separate lines. Ask which parts are one-time (initial content and setup) and which recur (refresher delivery, content updates after system changes and records upkeep).

How long does it take to put role-based training in place?

The timeline is set by three things: how quickly the organization decides its ODP values, how much content must be written or adapted, and whether training must finish before people with security duties receive access. The requirement calls for training before authorization to access the system or CUI, so content and completion tracking should be ready before those people start. Work also depends on how many roles need separate courses and whether a reviewer must approve content before release. Ask the partner for a milestone plan that lists decisions, content drafts, pilot delivery, first completions and the evidence pack, with the owner and the date for each. Any duration in a quote should trace back to those milestones.

What does the work need from our own staff?

Your staff own the decisions and the facts, while a partner can prepare the content, configuration and evidence. Expect to name a security owner who signs off on the ODP values, a system administrator who confirms which roles and system changes trigger training, and an HR or training contact who can confirm who holds each role and when they start. Your team also needs to review content for accuracy against your own systems and policies. The assessment procedure for 03.02.02 includes interviews with personnel who hold role-based training responsibilities and personnel with assigned system security roles, so those people must be available and able to explain the training in their own words. Ask the partner to list these roles and the expected hours for each in the quote.

Can we implement 03.02.02 in-house without a consultant?

Yes. The organization owns its controls, so an internal team can design, deliver and document role-based training without an outside partner. The team needs people who can read the assessment procedure in SP 800-171A Rev. 3, which lists six determination statements for this requirement plus four checks that the ODP values are defined, and who can keep the evidence current. Internal teams often struggle with three things: deciding frequencies and events that they can defend, keeping content current after system changes, and assembling records that match the examine, interview and test methods. An outside partner can help with those areas, but it does not issue findings. Only an independent assessor or certification body reports on whether the requirement is met.

Is the 03.02.02 change from Rev. 2 requirement 3.2.2 significant?

Yes. NIST's change analysis traces 03.02.02 to Rev. 2 requirement 3.2.2 and classifies the change as significant, because the Rev. 3 wording asks for more detail and foundational tasks. In practice, the organization must define how often role-based training is provided after initial training, which events trigger it, how often the content is updated and which events trigger a content update. Rev. 2 left much of this to the organization's judgment, so existing training programs often lack documented answers to these questions. Contracts may still name Rev. 2, and CMMC Level 2 assesses 3.2.2, so plan for the current requirement while confirming which revision your contract names. The change analysis spreadsheet from NIST lists the mapping in detail.

How do the CMMC 5 point weight and POA&M rule affect planning?

For CMMC Level 2, the practice AT.L2-3.2.2 carries 5 points in the scoring methodology in 32 CFR 170.24, and 32 CFR 170.21 does not allow it on a plan of action and milestones (POA&M) for Conditional status. That means role-based training cannot be deferred into a remediation plan if you need Conditional status. Plan to have the training defined, delivered and recorded before the assessment begins. Practically, this moves content decisions and first completions earlier in the schedule than many teams expect. When you ask a partner for a quote, ask how the work will be sequenced against your assessment date and which records will exist on that date. Confirm the current CMMC rules with your contracting officer or a qualified assessor, because the program's status can change.

Who sets the ODP values when the federal agency does not?

The nonfederal organization must set them. NIST does not assign organization-defined parameter values, and if the federal agency does not specify them, the nonfederal organization must assign them to complete the requirement. For 03.02.02, that covers four values: how often role-based training is provided after initial training, which events require it, how often the training content is updated and which events require a content update. A proposed FAR rule published on 23 June 2026 would instead have contractors use ODP values published by the DoW CIO, but the rule was not final as of October 2026. Ask your contracting officer which values apply, and document your own choices so an assessor can see the reasoning behind them.

How DeployOpen prepares role-based training evidence

DeployOpen helps organizations prepare the role-based training program, its records and its supporting evidence for 03.02.02 in their own infrastructure. The organization still owns its training decisions, and an independent assessor is the party that tests the requirement and reaches a conclusion.

How we scope

Confirm which personnel hold assigned security duties and which roles need training before access.
Agree the four organization-defined parameters for frequency and triggering events in writing.
Define the written scope for the training platform, curricula and records, delivered as a fixed-scope engagement.
Identify which role-based content the organization already has and what needs to be written or revised.

How we build

Configure a self-hosted learning platform inside the organization's own environment, such as Moodle.
Build role-specific course paths and completion rules that record when each person finished required training.
Set up records that tie each training completion to the person, role, date and content version.
Document the ODP values and the review cycle so the content update schedule can be shown to an assessor.

How we hand over

Deliver the training policy, procedures, curriculum and materials as documentation the organization owns.
Provide a walkthrough of how to pull completion and content-version records for an assessment.
Map each determination statement in SP 800-171A to the artifact that answers it, and flag any gaps.
Hand over with a list of items the organization must confirm with its assessor and its own leadership.

How we support

Ongoing support, upgrades and content maintenance are available as a retainer after handover.
Retainers can cover updates to curricula when systems, roles or defined events change.
Continuous testing of the training platform's access controls can be added under a separate written scope.
Questions about who issues the final assessment result are directed to the organization's independent assessor.