Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Documented policy and procedures related to security awareness program.

·  Evidence that all system users, managers, and system administrators have received initial and annual training aligned with their roles and responsibilities.

·  Evidence that initial training is provided to users prior to granting access to the system.

·  Additional evidences such as communications when new risks/threats impose a risk.

Organizations should consider the content and frequency of security awareness training based on threats and risks to the organization.

Assessment NOTES: A CMMC assessor may want to review, observe, or test the following

·  Type of training employees with security-related duties receive beyond that provided to employees without security specific responsibilities.

·  Training material to determine if adequate security training is provided to personnel e.g., physical and technical safeguards and countermeasures against threats to the organization.

Organizations must determine the content and frequency of security training based on the roles and responsibilities of employees.  

Threat Actors:   

An insider threat can reveal:

i) Details about an organization’s security practices

ii) Customer and employee data

iii) Login credentials and sensitive financial records

Training records and content of the delivered training to ensure that the training addresses potential indicators and possible precursors of insider threats.