CMMC Security Awareness Training Requirements 2026
CMMC security awareness training requirements cover 3 NIST AT practices. See what Level 2 assessors check and how DefendWise builds the evidence in 2026.
DefendWise
DefendWise
Defense contractors handling Controlled Unclassified Information can't wait for a Certification Assessment to figure out their training gap — CMMC security awareness training requirements are specific, documented, and checked line by line during a C3PAO assessment.
TL;DR
- CMMC security awareness training requirements map to NIST SP 800-171 practices AT.L2-3.2.1, 3.2.2, and 3.2.3 for Level 2 contractors.
- Generic phishing training alone fails an assessment — role-based and insider threat modules are separate line items assessors check.
- Per-seat SAT pricing punishes contractors who add subcontractors mid-contract; DefendWise's flat $399/month covers unlimited seats instead.
- CMMC 2.0's final rule is live in 2026, and prime contracts are already requiring documented training evidence at award.
- Training records need timestamps and 3-year retention — a spreadsheet of names does not survive an assessor's questions.
Why this matters
CMMC 2.0's final rule is enforceable in 2026, and contracting officers are already writing the certification requirement into new solicitations. Level 2 assessments check 110 NIST SP 800-171 practices, and three of them sit in the Awareness and Training (AT) domain — meaning training isn't a checkbox, it's a line item with its own evidence trail.
Miss it, and the gap doesn't just cost you a point on a scoresheet. A Plan of Action and Milestones (POA&M) item that stays open past your assessment window can delay contract award entirely. Subcontractors on defense supply chains feel this pressure just as hard as primes — CUI flows downstream, and so does the training obligation.
What you'll need
- Your confirmed CMMC level (1, 2, or 3) and the specific NIST SP 800-171 practices in scope for your contract
- A full inventory of every employee, contractor, and subcontractor who touches Federal Contract Information (FCI) or Controlled Unclassified Information (CUI)
- A training platform that logs completion with timestamps and stores certificates for the length of your assessment cycle
- Separate content tracks for general awareness, role-based training, and insider threat indicators — these are three distinct CMMC checks, not one
- A System Security Plan (SSP) and POA&M ready to reference your training program by name and date
Defense contractors and prime contractors managing subcontractor risk face a specific version of this problem: headcount shifts fast when a task order ramps up, and per-seat training tools turn every new hire into a billing event.
The steps
1. Confirm your CMMC level and in-scope practices
Level 1 covers 17 practices tied to FCI. Level 2 covers all 110 NIST SP 800-171 practices, including the three AT controls. Level 3 adds NIST SP 800-172 on top. Pull your contract's DFARS 252.204-7021 clause or your prime's flow-down language to confirm which level applies before you build anything.
Common mistake: assuming Level 1 scope when subcontracts actually require Level 2 because CUI flows through your systems.
2. Inventory every user who touches FCI or CUI
AT.L2-3.2.1 requires awareness training for all users, not just IT staff. Pull a list from your HR system and your subcontractor rosters — anyone with network access, including part-time and seasonal staff, is in scope.
Expected outcome: a single roster you can hand an assessor showing headcount matches training completion counts exactly.
3. Deploy security awareness training that satisfies AT.L2-3.2.1
This is the baseline: security risks associated with organizational activities, and applicable policies, standards, and procedures related to information security. Assign the training within 30 days of hire and re-run it at least annually — most C3PAO assessors expect an annual cadence at minimum.
Common mistake: running training once at onboarding and never refreshing it before the next assessment cycle.
4. Add role-based training for AT.L2-3.2.2
Users with elevated privileges — system administrators, incident responders, anyone managing CUI directly — need training beyond the general module. This is a separate control an assessor checks independently, so a single all-staff phishing course won't cover it.
Expected outcome: a documented role-based track with a shorter, more technical roster than your general awareness list.
5. Cover insider threat indicators for AT.L2-3.2.3
AT.L2-3.2.3 requires training personnel to recognize and report potential indicators of insider threat. This content is distinct from phishing awareness — it covers behavioral red flags, not just email clicks. Skipping it is the single most common gap found during mock assessments.
Common mistake: folding insider threat content into a slide buried inside a longer phishing deck instead of tracking it as its own completion record.
6. Log and retain training evidence for assessors
Every completion needs a timestamp, a version reference for the content delivered, and a retention period that covers your full assessment cycle — typically three years. A spreadsheet with names and dates isn't enough if an assessor asks which content version an employee actually saw.
Expected outcome: an exportable report you can hand over in the room, not one you build the night before.
7. Run phishing simulations to demonstrate ongoing awareness
While CMMC doesn't mandate simulated phishing by name, assessors increasingly ask for evidence that training translates to behavior. A quarterly simulation with click-rate tracking gives you a second data point beyond course completion.
Common mistake: running one simulation right before the assessment window instead of showing a consistent quarterly cadence.
8. Update your SSP and POA&M with training status
Your System Security Plan should name the training platform, the cadence, and the AT practices covered. If any practice is partially implemented, document it in your POA&M with a remediation date — an open item with a plan reads very differently to an assessor than an open item with silence.
Expected outcome: an SSP an assessor can cross-reference directly against your training logs without follow-up questions.
Build CMMC-ready training evidence
Unlimited seats, one flat fee, evidence built in from day one.
Troubleshooting
- Subcontractor headcount spikes mid-contract and your per-seat bill spikes with it. Move to a flat-fee model before your next task order ramps up — DefendWise charges $399/month regardless of seat count.
- An assessor asks for role-based training evidence and you only have general completion logs. Separate your roster into general, role-based, and insider threat tracks now, not during the assessment.
- Training certificates lack a content version reference. Choose a platform that timestamps both completion date and module version, so a two-year-old certificate is still defensible.
- Remote or BYOD employees skip simulated phishing tests because they're on personal devices. Confirm your simulation tool delivers through email, not a browser extension tied to a managed device.
- A POA&M item stays open because training records live in three different systems. Centralize completion data in one export before your next internal review, not the week of the assessment.
Tools and resources
- NIST SP 800-171 Rev. 2, the source document for all three AT practices
- Your prime contract's DFARS 252.204-7021 flow-down clause, which confirms your assessment level
- A centralized SAT platform with role-based tracks, insider threat content, and retained completion records
- Your SSP and POA&M templates, kept current between assessment cycles
MSPs managing CMMC compliance across multiple defense-adjacent clients face the same seat-count math internally that their clients face externally — choosing phishing simulation software built for MSP client management avoids re-litigating pricing every time a client's headcount shifts.
What to do next
CMMC training evidence and cyber insurance evidence overlap more than most contractors realize — insurers ask for nearly the same completion logs and cadence data an assessor wants. If you're building one evidence package, build it to satisfy both.
FAQ
What are the CMMC security awareness training requirements?
CMMC security awareness training requirements for Level 2 map to NIST SP 800-171 practices AT.L2-3.2.1 (general awareness), 3.2.2 (role-based training), and 3.2.3 (insider threat awareness). All three need separate, documented completion evidence.
Does CMMC require phishing simulations?
CMMC does not name phishing simulations explicitly, but assessors increasingly expect behavioral evidence beyond course completion. A quarterly simulation cadence gives you a defensible second data point in 2026 assessments.
How often must CMMC awareness training run?
Most C3PAO assessors expect annual refresher training at minimum, with new-hire training completed within 30 days of onboarding. Contractors with high subcontractor turnover often run it quarterly instead.
What's the difference between CMMC Level 1 and Level 2 training requirements?
Level 1 covers 17 practices tied to Federal Contract Information and does not include the AT domain by name. Level 2 covers all 110 NIST SP 800-171 practices, including the three AT training controls.
Do subcontractors need separate CMMC training?
Yes — any subcontractor employee who touches CUI or FCI needs the same training and documentation as prime contractor staff. Flow-down clauses in DFARS 252.204-7021 make this explicit.
How long must CMMC training records be kept?
Retention typically needs to cover your full assessment cycle, usually three years. Records should include completion timestamps and the content version delivered.
Is generic security awareness training enough for CMMC?
No — generic training satisfies only AT.L2-3.2.1. Role-based training and insider threat awareness are separate practices an assessor checks independently.
How much does CMMC-compliant training cost?
Per-seat platforms scale cost with headcount, which punishes contractors adding subcontractors mid-contract. Flat-fee platforms like DefendWise charge $399/month for unlimited seats regardless of roster size.
One last thing
Most contractors treat AT.L2-3.2.3 — insider threat awareness — as an afterthought bolted onto a phishing module. Assessors check it as its own line item, and it's the gap that shows up most often in mock assessments heading into 2026 solicitation cycles. Build it as a separate, documented track from day one and you skip the scramble entirely.