CUI training requirements for contractors: what to provide

What CUI training do contractors need to give staff?

If a contract or customer now requires NIST SP 800-171, your staff who handle CUI need training that your organization owns and delivers. Requirement 03.02.01 in SP 800-171 Rev. 3 calls for security literacy training for system users at initial training, at a defined frequency, after system changes or defined events, and on recognizing insider threat, social engineering and social mining. The organization decides how often training recurs, what triggers an extra session, and what the content covers, because Rev. 3 leaves those choices to organization-defined parameters. If a federal agency does not specify values, the nonfederal organization must assign them to complete the requirement, so the first decision is to write those values down and approve them.

The regulatory picture has shifted. The January 2025 FAR CUI proposed rule would have added a specific minimum CUI training requirement for contractors. The June 2026 FAR overhaul proposed rule removes that mandate in favor of a more flexible approach to making sure employees can comply. Do not read the removal as relief from the obligation. The SP 800-171 literacy requirement applies regardless, and a DFARS-based contract still points to it. Agency CUI training under 32 CFR 2002.30, which covers designation, the CUI Registry, markings and safeguarding and must be given at least every two years, is a separate obligation that the agency provides to its own employees. It does not replace the training your staff need for your systems, and you should confirm with the contracting officer which agency training, if any, your personnel must complete.

An implementation partner can help build the curriculum, role mapping, attendance records and content review cycle, and can test whether training matches your defined parameters. Your organization still delivers the training and keeps the records. An independent assessor, not the partner, tests the result against the assessment procedures in SP 800-171A Rev. 3, so ask the assessor early what evidence it expects, such as dated completion records, course content versions and incident-triggered sessions. Ask any partner to show a quote tied to a written scope covering curriculum, delivery, records and review.

Who is paid for CUI training and what recurs

This table compares the training cost components a contractor faces under SP 800-171 03.02.01, showing who is paid, whether each cost is one-time or recurring, and what moves it. Read it to scope a quote, since the largest recurring cost is usually staff time rather than a vendor invoice. The main takeaway is that the requirement recurs on a defined schedule and after system changes, so budget for refresh training from the start.

Cost component	Who is paid or who bears it	One-time or recurring	What drives it up or down
Training content development	Internal staff or an outside provider you engage	One-time, then updated	Number of roles, system complexity, and how often content must change after defined events
Initial literacy training delivery	Staff time plus any external trainer or platform fee	One-time per new user	Headcount, onboarding volume, and whether training runs in-house or by vendor
Recurring refresher training	Staff time and training platform licensing	Recurring at a frequency you define	Defined frequency in your policy, workforce turnover, and whether the platform tracks completions
Event-driven retraining	Staff time, plus provider effort if content changes	Recurring when system changes or defined events occur	Rate of system changes, new threat types such as social engineering campaigns, and change control discipline
Insider threat and social engineering modules	Internal security staff or training provider	Recurring as content is updated	Scope of content, need for scenario exercises, and whether you reuse existing awareness material
Training records and evidence	Internal compliance or IT staff	Recurring	Need to show completion records to an assessor, and whether your learning system exports them
Assessment support for training evidence	Independent assessor or CMMC third-party assessor fees, if engaged	Periodic, tied to assessment cycle	Assessment scope and how well training records are already organized

How this requirement affects CMMC scoring and POA&M use

Training under 03.02.01 is scored in CMMC Level 2 and sits on the POA&M rules that decide whether a contractor can still win an award. The cards below cover what the score means, when a POA&M is allowed, and what evidence an assessor will ask for.

Rev. 2 control behind the Rev. 3 requirement

Requirement 03.02.01 in Rev. 3 traces to Rev. 2 requirement 3.2.1, and NIST classifies that change as significant because it adds more detail and foundational tasks. CMMC Level 2 still assesses against Rev. 2, so the practice an assessor scores is AT.L2-3.2.1. Contractors should map their training program to the Rev. 2 wording now, since that is what the assessment uses while Rev. 3 is not yet the DoD baseline.

Point weight in the CMMC score

AT.L2-3.2.1 carries 5 points under the 32 CFR 170.24 scoring methodology. A missing or weak training practice therefore costs points that other practices cannot easily offset. Ask your assessor to walk through how the score is calculated for your system boundary, and confirm which training records count as objective evidence before the assessment starts.

Why training cannot go on a POA&M for Conditional status

Under 32 CFR 170.21, a practice like AT.L2-3.2.1 cannot be carried on a plan of action and milestones to reach Conditional status. A contractor that has not delivered literacy training to all system users cannot close the gap with a promise to fix it later. Check which practices your organization is relying on as POA&M items and confirm that training is not among them.

Training records as assessment evidence

Assessors test the training practice by looking for a training plan, attendance or completion records, the content used, and proof that content was updated after system changes or defined events. Build these records so they show who was trained, when, and on what topics, including insider threat and social engineering. Missing dates or undocumented content are the most common reasons evidence fails to support a score.

Training scope in the system boundary

Training obligations apply to the users of systems that handle CUI, not to the whole company. Confirm the boundary in your system security plan and list every role with access to that boundary, including subcontractor staff and administrators. An incomplete user list is a scoping error that will show up as a gap in the score, even when the training itself is well designed.

Rules that may change the POA&M position

A June 2026 FAR overhaul proposal would drop the January 2025 proposal's specific CUI training mandate, and DoW's 2026 guidance points to Rev. 2 baseline compliance while CMMC Phase 2 is suspended. Track any final rule and the DFARS deviation, because either could change how a training gap is treated in a contract. Ask your contracting officer which version governs your award.

What agency CUI training covers and what the contractor still owes

Under 32 CFR 2002.30, federal agencies must train their own employees on CUI. That training is the agency's obligation, and it does not replace your own program. It does show what the agency expects contractors to already understand when they receive CUI.

Designating CUI: how to identify information that falls into a CUI category and who has authority to designate it.
The CUI Registry: the approved categories, their markings and their handling authorities.
Markings: banner and portion markings and the forms that are authorized.
Safeguarding, dissemination and decontrol: the rules for storing, sharing and releasing CUI.
Timing: training when employees start and at least once every two years after that.

Ask the contracting officer or the agency's CUI program office whether it expects contractors to complete agency training, or whether it accepts equivalent training that your organization delivers and documents.

How the 2025 and 2026 FAR proposals added and dropped a CUI training mandate

The January 2025 FAR CUI proposed rule would have written minimum CUI training requirements directly into contracts for contractors handling CUI. It paired that training mandate with a requirement to report suspected or confirmed CUI incidents within 8 hours, unless a CUI category or a federally controlled facility called for a different period. The June 2026 FAR overhaul proposed rule removed that specific training requirement in favor of a flexible approach to making sure employees can comply, and it also removed the language that specified contractor liability for CUI incidents. Under the 2026 proposal, the question shifts from which course a contractor must buy to whether its staff can demonstrably handle CUI correctly.

Both documents are proposals, not final rules. The 2026 overhaul drew comments that closed on 23 July 2026, and it was not final as of October 2026. Do not assume either version applies to your contracts. Track the final rule in the Federal Register, and read the clauses your contracting officer actually includes in each solicitation and award, since agency supplements and class deviations can change what applies. Confirm with your contracting officer which training language, if any, is in force on your specific contract and whether your agency requires its own CUI training for personnel who work with its information.

Practically, a contractor should not wait for the final rule to build its training program. The SP 800-171 literacy requirement in 03.02.01 applies to any system that handles CUI under a contract that requires the standard, and the training records that prove it are the same records an assessor or contracting officer will ask to see. Plan for a documented curriculum, dated completion records for each user, refresher triggers tied to system changes and insider threat events, and a named owner who reviews training content on a defined schedule. If the final rule adds a specific training mandate, those records should already match it or be easy to extend.

How to build a CUI training program that will hold up to assessment

This sequence turns the 03.02.01 literacy training requirement and agency CUI training obligations into a documented program with named audiences, content, records and review triggers. Each step ends with an artifact an assessor can examine, interview against and sample.

Confirm which contract and agency obligations apply
Start by reading the contract, the CUI categories it involves and any agency training expectations, then record which requirements bind your organization. Compliance leads and contracts staff do this together, because the answer decides whether you need only SP 800-171 literacy training or also the agency's CUI training. The output is a short scope memo naming the contract, the CUI categories and the training sources it relies on. Confirm with the contracting officer any training expectation that the contract leaves unclear.
Define the audience and training tiers
List every user of systems that hold CUI, including employees, contractors, administrators and staff who only handle marked documents, and group them by the duties they perform. Separate general users from people with security responsibilities, since role-based training is a distinct obligation under the awareness and training family. The output is an audience matrix mapping each group to the courses it must complete. Review the matrix whenever roles or systems change.
Write the literacy content against 03.02.01
Build course content that covers security literacy for system users, recognizing and reporting indicators of insider threat, and recognizing social engineering and social mining. Add the CUI-specific material your contract requires, such as marking, safeguarding, dissemination and the reporting path for suspected incidents, drawing on the procedures already in your system security plan. The output is a content outline that maps each topic to the 03.02.01 requirement it supports. Have legal or compliance review the outline against the contract's CUI categories.
Set frequency, triggers and content update rules
Document how often each audience must take training, which events trigger additional training, such as system changes or a reported incident, and how often the content itself is reviewed. The 03.02.01 requirement asks for defined frequencies and defined events, so the values must be written down rather than assumed. The output is a training standard approved by the security owner and signed by management. Confirm any frequency your agency sets, since agency CUI training may impose its own cycle.
Deliver training and capture completion records
Run the courses at onboarding and on the defined cycle, using a learning platform or a self-hosted learning management system inside your environment. Record the user, course version, date and score or attestation for every completion. The output is a training log that an assessor can sample by person and by date. Check that access to a system is tied to completion of the required initial training.
Test understanding and handle gaps
Use short knowledge checks, phishing simulations or tabletop exercises to confirm that staff can apply the material, not only that they clicked through it. Record results and follow up with targeted retraining for people who miss items. The output is a results summary showing pass rates by audience and the actions taken for gaps. Keep the simulations within the rules your organization sets for employee monitoring.
Evidence the program for assessment
Assemble the training standard, audience matrix, course content, completion records and test results into one evidence folder mapped to the 03.02.01 requirement and to any agency training obligation. Walk a sample of staff through their own training history to confirm the records match what you claim. The output is an evidence package that supports interviews and examination by the DoD assessor or the relevant auditor. Your assessor, not your implementation partner, decides whether the program meets the requirement.

What assessors will look for in training evidence

An assessor testing the SP 800-171 literacy training requirement will not accept a policy that says training happens. They look for records that show who was trained, on what content, when, and whether the content changed as the threat and the system changed. The cards below cover the evidence that connects those answers.

Training content tied to the required topics

The course must visibly cover the topics the requirement names: recognizing and reporting insider threat indicators, social engineering, and social mining. Assessors compare the slide deck or course outline against those topics, not against a generic security awareness module. Ask the vendor or internal team to map each module to the topic it addresses, and keep that map with the training record.

Completion records for every CUI user

Assessors sample system users and ask for proof that each one completed training before gaining access, and again at the defined frequency. A learning management system export with names, dates, module versions and pass results is the usual evidence. Check that contractors, temporary staff and subcontractor personnel with CUI access appear in the same records, because gaps in those groups are common findings.

Event-driven refresher records

The requirement also calls for training when system changes or defined events occur, such as a new collaboration tool, a phishing campaign, or a reported incident. Keep a change log that links each system change or event to the training it triggered. An assessor who sees a major platform change with no matching refresher will question whether the organization's own triggers work.

Defined frequency and content review dates

The organization must set the training frequency and the frequency for updating content in its own documentation, since the requirement leaves those values to be defined. Assessors check that the stated frequency appears in the policy and that the course version history shows reviews on that schedule. Confirm the values with the contracting agency if it has specified them, because a federal agency can set the parameters.

Insider threat and reporting procedures

Training must teach people to recognize and report indicators of insider threat and social engineering, which connects the training record to the incident response process. Evidence includes the reporting procedure given to staff, the contact path, and test results from simulated exercises if the organization runs them. Assessors often ask a sample of users to describe where to report a suspicious request, so the answer should be consistent across staff.

Training as part of the system security plan

Assessors look for the training program described in the system security plan and policy, not only in a separate training file. The plan should name the owner of the training, the audience, and how the records are retained. A plan that describes training in detail but has no records behind it signals a program that exists on paper only, which assessors treat as a gap.

Common questions about CUI training for contractors

Does NIST SP 800-171 require contractors to train staff on CUI?

Yes. Under Rev. 3, requirement 03.02.01 (Literacy training and awareness) requires security literacy training for system users, given as part of initial training and at a defined frequency afterwards, when system changes or defined events require it, and covering how to recognize and report insider threat, social engineering and social mining. The organization owns this control and must define the frequency and triggers itself, because Rev. 3 leaves those values to the organization where no federal agency sets them. Training content must also be updated at a defined frequency and after defined events. A CUI-specific course is a common way to meet the requirement, but the standard itself is a general security literacy obligation for everyone with system access.

Is 03.02.01 the same as the old CMMC awareness and training practice?

Not exactly. Rev. 3 withdrew 03.02.03, which corresponds to Rev. 2 requirement 3.2.3 and CMMC practice AT.L2-3.2.3, and folded it into 03.02.01. NIST's change analysis traces 03.02.01 to Rev. 2 requirement 3.2.1 and classifies the change as significant, because the Rev. 3 version adds more detail and foundational tasks. CMMC Level 2 still assesses against Rev. 2, where AT.L2-3.2.1 is worth 5 points under the 32 CFR 170.24 scoring methodology. Under 32 CFR 170.21, that practice cannot be placed on a plan of action and milestones to reach Conditional status, so it needs to be fully implemented before assessment.

What does agency CUI training have to cover?

Agency CUI training is a separate obligation from the SP 800-171 literacy requirement. Under 32 CFR 2002.30, federal agencies must train their employees on designating CUI, the relevant CUI categories, the CUI Registry, markings, and safeguarding, dissemination and decontrol procedures. That training must be given when employees start and at least once every two years after that. Contractors are not required to run that agency course for their own staff, but agency-provided training may be required by a contract or by agency policy, so check the contract and any agency instructions. Ask the contracting officer whether the agency will provide its own CUI course to your personnel.

Did the 2025 FAR proposal require CUI training for contractors?

Yes, the January 2025 FAR CUI proposed rule would have added minimum CUI training requirements for contractors, alongside an 8-hour incident reporting window unless a CUI category or Federally-controlled facility required a different period. The June 2026 FAR overhaul proposed rule removes that specific training mandate in favor of a flexible approach that ensures employees can comply. The rule was a proposal, not a final requirement, so the status can change. Contractors should not assume that dropping a specific training mandate removes the need for training: SP 800-171 literacy training and any contract-specified training still apply.

Why does the proposed FAR change matter if the training requirement comes from SP 800-171?

The FAR text decides what a contract must say, while SP 800-171 decides what a system must do. The January 2025 proposal would have written CUI training minimums directly into the contract clause, which would have made them an explicit contract term. The June 2026 overhaul removes that specific mandate, so a contractor is left with the flexible outcome of employees being able to comply, plus whatever SP 800-171 requires where it applies. Contractors handling CUI should read their contract's clauses, not only the proposed rule, because the clause the agency actually uses will govern. Ask the contracting officer which CUI training obligations are in the award.

Who is responsible for CUI training, the contractor or the agency?

The organization is responsible for its own training program. NIST states that application and implementation of SP 800-171, and any compliance issues, are the responsibility of the federal agency with the contract, irrespective of the organization's size, which means the agency sets the scope and the contractor must show it meets the requirement. In practice, the contractor delivers and records training for its staff and subcontractors where flowed down, and the agency may supply its own CUI course. An implementation partner can help design the course, configure the learning platform and collect records, but it cannot certify that training was delivered. An independent assessor checks the evidence.

What evidence shows that CUI training was delivered and understood?

Assessors look for records that tie each person with system access to completed training, the content used, and the trigger events. Useful evidence includes a training policy and schedule with the defined frequency, course materials showing insider threat, social engineering and reporting topics, completion records with dates, and a log of training updates made after system changes or defined events. Keep records for staff who change roles or leave, and show how new users are trained before access is granted. Ask your assessor which format they accept, because the evidence method should match how the SP 800-171A assessment procedure tests the requirement.

Can a self-hosted learning platform handle SP 800-171 training records?

A self-hosted learning management system can keep training content and completion records inside your own environment, which can simplify CUI handling. Confirm with the platform vendor that it supports the records you need, including dated completions, role assignments, course versioning and exportable reports, rather than assuming it does. DeployOpen plans, implements, hardens, backs up and documents self-hosted open-source platforms inside a client's own infrastructure, and it can help configure the training environment and evidence trail. Training content and the decisions about frequency and triggers still belong to your organization.

How DeployOpen prepares training evidence for an assessment

DeployOpen helps contractors prepare the systems, records and training evidence behind the CUI training requirement, working inside the client's own infrastructure. The organization owns its training program, and an independent assessor reviews the evidence and issues any report or certificate.

How we scope

Engagements are fixed-scope, with the training audience, roles and systems agreed in writing before work starts.
The written scope lists which personnel groups, courses and learning platforms the work covers for CUI training.
Scope also names the evidence the organization will retain, such as rosters, completion logs and course versions.

How we build

We configure the learning platform in your environment to record completions, dates and course versions for each user.
We help draft literacy content covering insider threat, social engineering and reporting steps, aligned to your own policies.
We set up test points that check whether training content is reviewed at a defined frequency and after defined events.

How we hand over

Deliverables include the training plan, course materials, a completion evidence map and a short operating procedure.
We walk your compliance and security staff through where each training record lives and how to export it for an assessor.
Documentation states which items the organization must confirm, including the frequency values it has chosen.

How we support

Ongoing support and periodic reviews of training content are available as a retainer after handover.
Retainers can cover updates when system changes, new CUI categories or contract terms require revised training.
Confirm with your contracting officer or prime which training requirements apply before the scope is signed.

CUI training requirements for contractors