Mapped Requirement and Assessment Objective
Mapped to NIST 800-171 requirement 3.2.1 and CMMC Level 2 assessment objective AT.L2-3.2.1[c].
What This Objective Means
This objective requires organizations to keep records showing that users completed required awareness training before being granted access to systems that handle sensitive data or CUI.
The goal is to link training completion timestamps to access provisioning so assessors can verify that access was granted only after training was completed.
Why Maintaining Training Records Matters
Without documented training proof, you cannot demonstrate compliance with your training policy or show that users understood security expectations before being granted access.
Maintaining accurate records helps support audit readiness, reduces risk from untrained users, and ensures accountability.
How to Implement AT 3.2.1c
Track training completion using a learning management system (LMS), HR system, ticketing tool, or spreadsheet that includes:
- User name and role
- Date training was completed
- Type of training or course completed
- Date system access was granted
Link these records to onboarding checklists, HR workflows, or access provisioning tasks so you can demonstrate that training occurred before access. Align your approach with your broader security awareness and compliance controls.
Training Records Summary Table
| Record Type | What to Capture |
|---|---|
| Training Completion Logs | User, date, course, and completion status. |
| Access Provisioning Date | Date when access was granted for comparison. |
| Timestamps | Ensure training dates occur prior to access dates. |
| Training Format | Whether training was online, in-person, or automated. |
| Documentation Source | Where records are stored (LMS, HR, ticketing, etc.). |
Evidence Assessors Commonly Expect
Assessors often look for training logs or reports showing the date of completion for each user, along with a comparison of training completion dates and account activation dates.
Screenshots or exported records from your LMS, HR system, or access tracking tool showing timestamps and training details are common objective evidence.
Common Gaps to Avoid
Gaps include training logs without timestamps, failing to link training dates with access dates, incomplete or inconsistent manual records, and lack of review procedures for training status.
FAQ
What does AT.L2-3.2.1c require?
It requires maintaining records that prove users completed required training before being granted access to systems.
How should training and access dates be compared?
Training records should include timestamps, and assessors will expect you to show that those timestamps predate the system access provisioning date.
What evidence supports this objective?
Evidence can include logs from an LMS or HR system that show training completion dates, access provisioning records, and comparisons demonstrating training before access.