Mapped Requirement and Assessment Objective
Mapped to NIST 800-171 requirement 3.2.1 and CMMC Level 2 assessment objective AT.L2-3.2.1[b].
What This Objective Means
This objective requires organizations to ensure that users complete required cybersecurity awareness training before they are granted access to systems that handle sensitive data or CUI.
Access should not be activated until training completion is documented.
Why Requiring Training Before Access Matters
Ensuring users complete cybersecurity awareness training before access reduces the risk of avoidable errors, improves understanding of security responsibilities, and demonstrates proactive risk management.
Documented training completion before access also supports audit readiness and compliance documentation with organizational policy.
How to Implement AT 3.2.1b
Establish a workflow that ties access provisioning to training completion. Use an LMS, HR system, ticketing tool, or onboarding checklist to track training status and prevent access until training is completed.
Document how training completion is verified before access is granted, and link training records to access approval forms as part of your broader cybersecurity and compliance controls.
Training Requirement Summary Table
| Requirement Step | Implementation |
|---|---|
| Training Assignment | Assign required awareness training to users before access approval. |
| Completion Verification | Track training completion status in an LMS or tracking tool. |
| Access Provisioning | Grant access only after completion is recorded. |
| Documentation | Document training and access dates for audit evidence. |
| Periodic Review | Review the process to confirm enforcement before granting access. |
Evidence Assessors Commonly Expect
Assessors typically look for records showing training completion dates and access provisioning dates, demonstrating that training occurred before access was granted.
Reports from an LMS or exported lists showing training status tied to user accounts are common forms of evidence.
Common Gaps to Avoid
Common gaps include granting access without verifying training completion, maintaining training records separate from access records, and lacking a defined process linking CUI security training to access approval.
FAQ
What does CMMC AT.L2-3.2.1 require?
It requires ensuring that users complete required cybersecurity awareness training programs before being granted access to relevant systems.
How is training completion documented?
Training completion can be documented via an LMS, HR training records, or a controlled tracking tool showing user names and completion dates.
What evidence supports compliance with this objective?
Evidence can include training completion records with timestamps, access provisioning logs, and documented processes linking training to access approval.
