CMMC readiness · NIST 800-171 alignment · DFARS support Mon–Fri · 0800–1800 ET
Controls / Awareness and Training / 3.2.1
3.2.1
AT.L2-3.2.1 · Level 2

Ensure that managers, systems administrators, and users of organizational systems are made aware of…

NIST SP 800-171 Rev 2 · §3.2.1

Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.

Assessment objectives

From NIST SP 800-171A · 4 objectives must be met to satisfy this control
3.2.1[a] security risks associated with organizational activities involving CUI are identified.
Examine
[SELECT FROM: Security awareness and training policy; procedures addressing security awareness training implementation; relevant codes of federal regulations; security awareness training curriculum; security awareness training materials; security plan; training records; other relevant documents or records].
Interview
[SELECT FROM: Personnel with responsibilities for security awareness training; personnel with information security responsibilities; personnel composing the general system user community].
Test
[SELECT FROM: Mechanisms managing security awareness training; mechanisms managing role-based security training].
3.2.1[b] policies, standards, and procedures related to the security of the system are identified.
Examine
[SELECT FROM: Security awareness and training policy; procedures addressing security awareness training implementation; relevant codes of federal regulations; security awareness training curriculum; security awareness training materials; security plan; training records; other relevant documents or records].
Interview
[SELECT FROM: Personnel with responsibilities for security awareness training; personnel with information security responsibilities; personnel composing the general system user community].
Test
[SELECT FROM: Mechanisms managing security awareness training; mechanisms managing role-based security training].
3.2.1[c] managers, systems administrators, and users of the system are made aware of the security risks associated with their activities.
Examine
[SELECT FROM: Security awareness and training policy; procedures addressing security awareness training implementation; relevant codes of federal regulations; security awareness training curriculum; security awareness training materials; security plan; training records; other relevant documents or records].
Interview
[SELECT FROM: Personnel with responsibilities for security awareness training; personnel with information security responsibilities; personnel composing the general system user community].
Test
[SELECT FROM: Mechanisms managing security awareness training; mechanisms managing role-based security training].
3.2.1[d] managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system.
Examine
[SELECT FROM: Security awareness and training policy; procedures addressing security awareness training implementation; relevant codes of federal regulations; security awareness training curriculum; security awareness training materials; security plan; training records; other relevant documents or records].
Interview
[SELECT FROM: Personnel with responsibilities for security awareness training; personnel with information security responsibilities; personnel composing the general system user community].
Test
[SELECT FROM: Mechanisms managing security awareness training; mechanisms managing role-based security training].

What we look for in practice

The following are placeholder notes that should be refined based on practice experience.

What assessors look for in practice. Documented evidence that this control is implemented across all CUI-handling systems within scope. Specific artifacts vary, but expect requests for written procedures, system configurations, and operational records demonstrating the control is active.

Common failure patterns. Typical issues include incomplete documentation, inconsistent implementation across systems, and missing periodic review records. Refine this section as your practice accumulates direct assessment experience.

Strong evidence looks like. Formal policy referencing this control, technical configurations demonstrating enforcement, periodic review logs with sign-off, and procedures for handling exceptions.

Scoring and POA&M context. 5-point control under the DoD Assessment Methodology. Highest scoring impact — treat as a foundational requirement. Not POA&M-eligible — must be implemented at assessment time.