CMMC Level 2 awareness training: what assessors check after Nov 10

CMMC awareness training requirements at Level 2 come down to three practices: AT.L2-3.2.1 (security risk awareness for managers, admins and users), AT.L2-3.2.2 (role-based training for people with security duties) and AT.L2-3.2.3 (insider threat awareness). Starting November 10, 2026, DoD begins requiring Level 2 certification by a C3PAO in applicable contracts, and that assessor checks each practice against written objectives and asks for final, dated evidence that the right people were trained.

In LMS Advisor, you map each security role to a group, assign its courses with a due date and a mandatory flag, and export per-person completion records to CSV, Excel or PDF when the assessor asks. The platform won't make you compliant, but it produces the dated evidence the AT practices are tested on.

The evidence is where training programs usually come up short. The training itself mostly happened. What's missing is a defined list of security roles, a record tying each person to the course their role requires, and an insider threat module that names real indicators and a real reporting channel.

When does CMMC Phase 2 start, and why does Nov 10 matter?

The DFARS rule that puts CMMC into defense contracts was published on September 10, 2025, and the phase-in started on November 10, 2025. As Troutman Pepper Locke's summary of the final rule lays out, each phase starts one year after the one before it:

Phase	Start date	What DoD begins requiring
Phase 1	Nov 10, 2025	Level 1 and Level 2 self-assessments
Phase 2	Nov 10, 2026	Level 2 certification assessments by a C3PAO
Phase 3	Nov 10, 2027	Level 3 assessments by DIBCAC
Phase 4	Nov 10, 2028	Full implementation on applicable contracts

Phase 2 is the one that changes the conversation about training. Under a self-assessment, your own team decides whether the awareness program is good enough. Once a solicitation calls for "CMMC Level 2 (C3PAO)", an outside assessor makes that call, and the certification has to be repeated every three years with an annual affirmation in SPRS in between. DoD also kept the discretion to advance or delay requirements in each phase, so the solicitation, not the calendar, is what finally decides. If you handle CUI and bid on DoD work, assume your next contract could carry the C3PAO requirement.

What are the three awareness and training practices at Level 2?

The Awareness and Training (AT) family is small, but two of its three practices carry the highest point value in the scoring method. Here is how they line up, using the objectives in NIST SP 800-171A (which the DoD CIO Level 2 Assessment Guide, version 2.13 follows) and the point values in 32 CFR 170.24:

Practice	What it asks for	Objectives	Point value	Can it go on a POA&M?
AT.L2-3.2.1 Role-based risk awareness	Managers, system administrators and users know the security risks of their activities and the policies that apply	4 ([a] to [d])	5	No
AT.L2-3.2.2 Role-based training	Security duties are defined, assigned to named people, and those people are trained for them	3 ([a] to [c])	5	No
AT.L2-3.2.3 Insider threat awareness	Indicators of insider threat are identified, and managers and employees are trained to recognize and report them	2 ([a] and [b])	1	Yes, if the other conditions are met

The POA&M column matters more than it looks. Under 32 CFR 170.21, you can only get Conditional status with open items if your score is at least 0.8 of the maximum (88 of 110 points) and none of the open requirements is worth more than 1 point (SC.L2-3.13.11 is the one exception). So a gap in 3.2.1 or 3.2.2 can't be parked on a plan. Insider threat training could sit on a POA&M with a 180-day closeout, but it's usually the cheapest of the three to fix now.

One more rule shapes everything below. A requirement is MET only when all applicable objectives are satisfied based on evidence, and the regulation says that evidence has to be in final form. Draft policies and working papers don't count. If you train everyone perfectly but never wrote down which roles carry security duties, 3.2.2 objective [a] fails, and so does the whole practice.

What evidence will a CMMC assessor ask to see?

Assessors use three methods: examine documents, interview people and test mechanisms. For the AT practices, NIST SP 800-171A lists the objects they draw from, including the security awareness and training policy, training procedures, curriculum and materials, the system security plan (SSP), training records and, for 3.2.3, your insider threat policy and procedures. The "test" object is the mechanism that manages the training, which in most companies means the LMS.

In practice, that turns into a short list of artifacts. This is what we would have ready before the assessor asks:

Artifact	What it proves	Common gap
Security awareness and training policy	Who gets trained, on what, how often, and who owns the program	Says "annual training" but never defines roles or new-hire timing
Role-to-training matrix	Each security role maps to specific courses (3.2.2 [a] and [b])	Lives in someone's head or a spreadsheet nobody updates
Course outlines and materials	Content covers your actual CUI risks, policies and reporting steps	Generic vendor content with no mention of your own procedures
Insider threat indicators list	Indicators are identified (3.2.3 [a])	Training exists but no document names the indicators
Completion records by person	Named users completed the right course by a date	Reports show course totals, not individuals, or omit contractors
SSP section for the AT family	How each practice is implemented in your environment	Copies the requirement text back instead of describing the process

Expect ordinary interviews. The assessor may ask a help desk technician what training came with their admin access, or ask a supervisor how they would report a coworker downloading drawings they don't need. If the answer doesn't match the SSP, the paperwork won't save you.

For the test method, be ready to open the LMS and pull a live report: everyone in the "system administrators" group, the course assigned to it, the due date and each person's completion date. If that takes an afternoon of spreadsheet work, fix the setup now. In LMS Advisor that report is a filter on the group and course, exported on the spot.

How should role-based training work for privileged users and managers?

Role-based training under 3.2.2 is different from the annual awareness course everyone takes. NIST's discussion says organizations decide the content and frequency based on assigned duties and the systems people can access. The DoD guide's example is a company upgrading its firewall: it identifies the staff affected, trains them on the new device and budgets for that training inside the upgrade project.

Start with the roles your SSP already implies. For a typical small or mid-size contractor, the list looks something like this:

• System and network administrators. Privileged account use, change control, log review, patching procedures.
• Help desk and IT support. Identity checks before password resets, handling remote support sessions, escalating incidents.
• Managers and supervisors. Approving access requests, onboarding and offboarding steps, spotting and reporting insider risk in their teams.
• Staff who mark, store or send CUI. Marking, approved storage locations, how to share CUI with a subcontractor.
• Incident response team members. The IR plan, reporting timelines and evidence handling.
• Engineers or developers with system-level access. Secure configuration of the tools they administer.

Two habits make this defensible. First, tie training to the role, not the person. When someone moves into an admin role, adding them to the admin group in the LMS should be a step in the same access request, so the training shows up with the access. SCIM provisioning from your identity provider helps here because accounts exist before anyone has to create them by hand. Second, treat system changes as training triggers. A new firewall or file-sharing platform should come with a short, dated module for the people who run it.

What should CMMC insider threat training cover, and how often?

AT.L2-3.2.3 has two objectives: potential indicators of insider threat are identified, and managers and employees get training on recognizing and reporting them. Many programs only prove the second one. Write the indicators down in your insider threat policy or training procedure, then make sure the course teaches that same list.

You don't have to invent the list. The discussion in NIST SP 800-171 Rev. 2 gives examples of potential indicators, including long-term job dissatisfaction, attempts to access information not needed for the job, unexplained access to financial resources, bullying or harassment of coworkers, workplace violence and other serious policy violations. Add the ones that fit your business, such as bulk downloads from a CUI share or USB use on engineering workstations.

The part that usually gets skipped is the reporting channel. A good module ends with a specific instruction: who to tell, how (a named contact, a hotline or an internal form), and what happens next. A course that describes warning signs but never says where to report them leaves objective [b] half done.

On content, a practical option for many contractors is the CDSE Insider Threat Awareness course (INT101.16), a 60-minute eLearning module that covers indicators and reporting and issues a completion certificate after a passing final exam. It's written for people with access to classified information, so pair it with a short module on your own policy and reporting contacts. Keep each person's CDSE certificate with the rest of your training evidence. An assignment inside your own policy module, where people upload the certificate, keeps it next to their other records.

On frequency, the requirement doesn't set one. Our default is training at hire (before CUI access) plus an annual refresher, with a longer version for managers because they usually notice behavior changes first. Whatever you pick, put it in the policy and make the records match.

Where should CMMC training records live?

Training records are evidence, so they need the same care as the rest of your artifact set. Under 32 CFR 170.17, the hashed artifacts used as evidence for a Level 2 certification assessment must be kept for six years from the CMMC Status Date. A completion report that only exists as a live dashboard in a vendor tool you might cancel in two years is a weak place to keep that.

A few decisions to make before the assessment:

• Keep CUI out of the training content. Use sanitized examples for phishing, marking and handling exercises. A screenshot of a real controlled drawing puts CUI in the LMS and can drag it into your assessment scope. Settle scoping with your RPO or assessor, not by guessing.
• Export a dated snapshot. Export completion records per role to PDF or CSV and add them to the artifact set you hash. The snapshot shows what was true on assessment day.
• Include everyone with access. Contractors, interns and temporary staff who touch CUI systems need records too. Check that your LMS reports list them as individuals.
• Decide where the system runs. Some contractors want training records on infrastructure they control. Others are fine with a cloud LMS that holds no CUI. Our comparison of self-hosted and cloud LMS options walks through the trade-offs, and our guide to training record retention covers keeping records past a system change.

Also check that the LMS keeps its own audit log. When an assessor asks who changed a due date or marked a course complete by hand, "the admin probably did" isn't a good answer. LMS Advisor keeps audit logs of admin activity alongside the training records.

A 30-day readiness checklist

If your C3PAO assessment is close, this is the order we would work in. It assumes the basic awareness course already exists.

1. Days 1 to 5: define roles. List every role with security duties in the SSP, name the people in each role, and write the role-to-training matrix. This closes 3.2.2 objectives [a] and [b] on paper.
2. Days 1 to 5: write the indicators list. Add insider threat indicators and the reporting channel to your policy. Get it approved so it's final, not a draft.
3. Days 6 to 10: build or update courses. One short module per security role, an insider threat module matching your indicators list, and an awareness course that names your actual policies. Add a scored knowledge check to each.
4. Days 6 to 10: set up assignments. Create groups or departments that mirror the roles, then assign each one its courses with due dates. Contractors and interns go in too.
5. Days 11 to 20: train and chase. Follow up on overdue people individually, including contractors and remote staff.
6. Days 21 to 25: run a mock interview. Ask five people, including an admin and a manager, what training they had and how they would report an insider concern. Fix whatever their answers expose.
7. Days 26 to 30: package the evidence. Export per-role completion records, the policy, the matrix, course outlines and the SSP section, and add them to the hashed artifact set.

If 3.2.1 or 3.2.2 still has gaps at day 30, talk to your C3PAO about moving the date. Neither can ride on a POA&M, and a NOT MET on either takes Conditional status off the table.

How to run CMMC training and evidence in LMS Advisor

An LMS can't make you CMMC compliant. It doesn't write your SSP or define your roles, and no training platform can hand you a certification. LMS Advisor holds no CMMC, FedRAMP or other certification either, so treat it as the system that runs the assignments and produces the records an assessor will test. Here is how the 30-day checklist above maps onto it.

Checklist step	What you do in LMS Advisor
Define roles (3.2.2 [a] and [b])	Create a department or group per security role in the organization and group structure. SAML SSO and SCIM provisioning from your identity provider keep membership current, so leavers drop off the roster.
Build or update courses	Upload the SCORM or xAPI packages you already have, or build short modules with scored knowledge checks and required blocks. AI course generation can draft a role module to edit, and drafts are never published automatically.
Keep the CDSE certificate	Add an assignment lesson to your insider threat module so each person uploads their INT101 certificate next to their other records.
Set up assignments	Assign each group its courses as organization assignments with due dates and mandatory flags.
Train and chase	The overdue report lists who is late, by person. Email rules can nudge people who never started or stalled mid-course.
Annual refresher	Give the awareness course a certificate valid for 12 months. It shows as expiring soon 30 days out, and people renew by retaking the course.
Package the evidence	Export completion records to CSV, Excel or PDF per group for the hashed artifact set. Audit logs record admin changes.

For defense suppliers, the most relevant option is running LMS Advisor self-hosted on your own server, so training records stay inside your environment. The government and public sector page covers that setup. For the frameworks that often sit alongside CMMC, see our roundup of security awareness training requirements. To check whether your role-to-training matrix maps cleanly onto groups and reports, start a trial and build it with your own roles.

Frequently asked questions

What training does CMMC Level 2 require?

CMMC Level 2 has three training practices: security risk awareness for managers, administrators and users (AT.L2-3.2.1), role-based training for people with security duties (AT.L2-3.2.2) and insider threat awareness (AT.L2-3.2.3). All three come from NIST SP 800-171 Rev. 2.

Can LMS Advisor produce CMMC training evidence?

Yes. LMS Advisor runs role-based assignments with due dates and produces the per-person completion records, exports and audit logs an assessor tests for the AT practices. It doesn't make you compliant and holds no CMMC or FedRAMP certification, so the SSP, role definitions and policies are still yours to write. You can self-host it so training records stay on infrastructure you control.

What is AT.L2-3.2.3 insider threat training?

AT.L2-3.2.3 requires security awareness training on recognizing and reporting potential indicators of insider threat. The assessor checks that the indicators are identified in your documentation and that managers and employees were trained on them. It's worth 1 point, the lowest value, but it's also one of the easiest practices to fix before an assessment.

How often is CMMC security awareness training required?

CMMC doesn't set a fixed frequency. NIST leaves content and frequency to the organization, and the DoD assessment guide asks whether users get initial and refresher training. Most contractors train at hire and then annually, and whatever cadence you choose has to be written in your policy and reflected in your records.

Can I use a POA&M for missing CMMC training?

Only for insider threat training. AT.L2-3.2.1 and AT.L2-3.2.2 are each worth 5 points, and 32 CFR 170.21 doesn't allow requirements worth more than 1 point on a Level 2 POA&M. AT.L2-3.2.3 is worth 1 point, so it can be included if your overall score qualifies, but it must be closed within 180 days.

How long do I need to keep CMMC training records?

Keep the training records that are part of your assessment evidence for at least six years. 32 CFR 170.17 requires the hashed artifacts used as evidence for a Level 2 certification assessment to be retained for six years from the CMMC Status Date.