Mapped to NIST 800-171 Requirement: 3.2.2
CMMC Assessment Objective: AT.L2-3.2.2[a]
What This Objective Means
General security awareness training is required for all users (see 3.2.1), but this control focuses on targeted training for personnel who perform security-sensitive functions, such as:
• System administrators
• IT support staff
• Network engineers
• System security officers
• Compliance managers
• Personnel involved in incident response or access control
The first step is identifying who fills those roles within your organization.
Why It Matters
Users in security-sensitive roles can:
• Configure access controls
• Respond to incidents
• Manage encryption, firewalls, or backups
• Influence how CUI is protected (or exposed)
Without targeted training, these individuals may unintentionally misconfigure systems or overlook key responsibilities.
How to Implement It
• Create a list of security-related roles, based on:
◦ Job descriptions
◦ System access rights
◦ Operational responsibility (e.g., provisioning, monitoring, auditing)
• For each role, identify who fills it within your organization
• Ensure role definitions are documented in your System Security Plan (SSP), HR system, or access control matrix
Evidence the Assessor Will Look For
• A list or matrix of individuals mapped to specific security-related roles
• Documentation that shows how roles are assigned (e.g., onboarding checklist, HR system, org chart)
• Job descriptions or responsibilities that justify inclusion in the training requirement
• Role definitions referenced in your training policy or program
Common Gaps
• No formal distinction between general users and users with security responsibilities
• Training provided, but roles not clearly defined or tracked
• Security roles are assigned informally without documentation
How Cuick Trac Helps
Cuick Trac supports this control by:
• Defining access roles clearly across user and administrator levels
• Helping organizations map roles to required training content
• Offering advisory support for documenting security responsibilities by function
• Supporting user tracking and reporting aligned with CMMC role-based training requirements
With Cuick Trac, identifying who needs specialized training is part of how you structure access from the start.
Final CTA
The more responsibility someone has, the more precisely they need to be trained.
Schedule a Cuick Trac demo and make sure the right people are getting the right training for their role.