Awareness & training.

01What this family protects

Awareness & Training protects the assumption every other family quietly depends on: that the people using and administering a system understand the security expectations placed on them, and would recognize a problem — including one caused by a colleague — if they saw it. Access controls, media handling, and incident response all work better when the humans inside the system know why the rules exist. AT doesn’t detect anything on its own; it makes detection by everyone else more likely.

02The rule says

All 3 requirements, condensed to their operative sentence. NIST SP 800-171 Rev. 2 §3.2 has the full text and discussion for each; Source Library covers when to open it.

03In practice

Awareness for everyone, training for role (3.2.1–3.2.2). Every person with access to a system that touches CUI gets a baseline understanding of the risks tied to their own activities and the policies that apply — not a security certification, just enough to recognize why a control exists. People with security-specific duties — an IT admin managing accounts, someone doing configuration work — get training tailored to what they actually do, distinct from the general session everyone else gets.

Insider-threat awareness (3.2.3) is its own, smaller requirement: training on recognizing and reporting the behavioral signs of a colleague going wrong, not just external attackers. It’s a short, specific addition to the broader awareness requirement, easy to fold into the same annual session rather than standing up as its own program.

04Where it fails

AT is the family most likely to get done once, at hire, and never again. A new employee sits through an onboarding video in week one; two years and several policy changes later, nobody has refreshed what they were told. The requirement doesn’t specify an interval, but training that happened once, permanently, isn’t awareness — it’s a memory of awareness.

The insider-threat piece (3.2.3) is the one most often missing entirely, because most training programs default to external-threat framing — phishing, malware — and never mention that the same reporting channel applies to a colleague’s behavior.

05What evidence may look like

Day-to-day output, not a training-vendor certificate wall: a record of who completed awareness training and when (a spreadsheet, an LMS export, signed acknowledgment forms); the training content itself, showing it covers both general awareness and insider-threat indicators; and role-specific training records for anyone with security-related duties, showing what made their training different from the general session.

06At the shop

07Commonly confused with

Incident Response (IR). AT trains people to recognize and report a problem; IR is what happens once a report or alert becomes an actual response. AT feeds IR’s reporting channel; it doesn’t run the response itself. See Incident Response.

Personnel Security (PS). PS screens people before they get access and manages what happens at termination or transfer; AT trains people who already have access on what to watch for while they hold it. Screening happens once, at the edges of employment; awareness training runs continuously in between. See Personnel Security.

08Cross-desk links

None load-bearing for this family. See Incident Response and Personnel Security for how AT’s training connects to the rest of the program.

09Sources