Help people understand the risks, do their security duties and know where to report a concern.
Start with the work your team actually does. Use the guide, free Office templates and fictional exercises to connect training to your procedures. You can run the starting activities with a meeting, Word and Excel.
All three requirements and nine assessment objectives are included. Reading this guide or completing a course does not establish compliance. Sources reviewed October 23, 2026. These suggested activities have not been tested in a Microsoft tenant or delivered to a customer training group.
Confirm the people and systems in scope. Include managers, administrators, users and relevant provider staff. Identify the duties each group performs and the information they handle. If the information itself is uncertain, start with the CUI identification guide.
Name a training owner and the people who can answer questions. Bring in the system/data owner, managers, IT/provider and security or personnel leads as appropriate. Agree who approves the material, arranges catch-up sessions, checks understanding and closes follow-up work.
Prepare current local instructions. Confirm where staff should handle CUI, how they request support or access, what they must report and whom they contact if email is unavailable. Replace the Word templates' fields and have the responsible people review them before use.
Choose timing and review triggers. Set a schedule that suits the duties and risks, and arrange training when people join or change duties and when relevant procedures change. These are planning suggestions. The three Level 2 requirements below do not prescribe one universal annual timetable; consider your contracts and other applicable obligations too.
Use harmless practice material. Agree the exercise and any test account or system in advance. Do not send live phishing messages, request real passwords or use real CUI for these exercises. Keep production changes out of a discussion session.
The official text below comes from the Revision 2 baseline and June 2018 assessment procedures. Our instructions, examples and templates help you plan and check the work; they do not assign an official finding or SPRS score.
Requirement 3.2.1
Explain the risks and the rules people need to follow
People need to understand the security risks in their own work and the current rules for handling them. A course about phishing cannot explain your approved CUI workspace, who may approve sharing or what to do when that workspace is unavailable.
Official requirement and assessment objectives
Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.2.1
Objective
Official text
3.2.1[a]
security risks associated with organizational activities involving CUI are identified.
3.2.1[b]
policies, standards, and procedures related to the security of the system are identified.
3.2.1[c]
managers, systems administrators, and users of the system are made aware of the security risks associated with their activities.
3.2.1[d]
managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system.
What to do
Identify the people and the work
List the managers, administrators and users of systems in scope. Include relevant contractors and provider staff. Walk through how each group receives, uses, shares and stores information. Ask what could go wrong in those activities, then record the risks that the briefing needs to address.
Choose the current local instructions
Identify the policies, standards and procedures that apply to those activities. Include approved CUI locations, sharing and remote-work rules, support verification and reporting. Give each document an owner and version so staff can find the instructions that are actually in force.
Brief each group using its own tasks
Pair a suitable introductory course with a local briefing. Show managers the approvals they own, administrators the access and change rules, and users the approved handling and reporting routes. Make the material usable for people with different language or accessibility needs, and arrange a catch-up for anyone who misses it.
Check understanding and close the gaps
Ask participants to explain the risk, find the applicable instruction and describe the next action in a made-up situation. Record the answer and any help needed. Clarify confusing instructions and repeat the check after follow-up. Choose a review schedule and retraining triggers, such as a new role, changed procedure or incident lesson, based on your needs.
Check each objective
Use these suggested checks with your own scope and procedures. Keep the actual results, including gaps. A course certificate or one successful practice answer does not establish the full requirement.
3.2.1[a]
Ask a user, manager and administrator which risks arise in their actual CUI-related activities. Compare their answers with the risks selected for training.
Records to keep: Risk/topic list tied to work activities and roles; review date and responsible person.
3.2.1[b]
Find the current policies, standards and procedures for those activities. Check that training points to the correct versions and approved locations.
Records to keep: Document titles, versions, owners and locations; briefing material references.
3.2.1[c]
Use the CUI-sharing exercise below. Ask each role to explain the risk and its own part in preventing or reporting the problem.
Records to keep: Who received the risk briefing, what was covered, discussion/check results and unresolved follow-up.
3.2.1[d]
Ask participants to locate the applicable local rule and explain how they would follow it. Include an unavailable-workspace or reporting fallback.
Records to keep: Local procedure version taught, attendance, check results and any catch-up or corrective briefing.
Records to keep
Role and activity list, identified risks and training topics.
Current local policy/procedure references and the material actually used.
Dates, participants, facilitator, understanding-check results, missed sessions and follow-up records.
If something is missing
If someone cannot explain the risk or find the rule, record that specific gap. Have the procedure owner clarify the instruction, arrange a focused briefing and check again. A missing attendance entry also needs follow-up; do not fill it in as completed based on an invitation.
Use what you already have
Use a meeting, your current Word instructions and the free tracker. Public introductory courses can support the briefing. Staff preparation, attendance and accessible delivery still take time.
Train people to carry out their assigned security duties
Define the security work, assign it to named people and make sure they can do it. This includes duties outside IT, such as approving access, handling visitors, reviewing records or escalating a concern. A general awareness course does not teach every one of those jobs.
Official requirement and assessment objectives
Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.2.2
Objective
Official text
3.2.2[a]
information security-related duties, roles, and responsibilities are defined.
3.2.2[b]
information security-related duties, roles, and responsibilities are assigned to designated personnel.
3.2.2[c]
personnel are adequately trained to carry out their assigned information security-related duties, roles, and responsibilities.
What to do
Write down the duties
Use the roles-and-training matrix to list the security duties in your environment. Examples include approving access, disabling a leaver account, restoring a file, reviewing alerts, handling media and maintaining the training records. Include backup coverage and duties shared with an outside provider.
Assign each duty to a designated person
Name who performs the task, who approves it and who covers an absence. Record the boundary of their authority and the approved procedure. A role called IT is not enough if nobody knows who must do the work.
Teach the actual procedure
Use a walkthrough, supervised task, vendor learning or other suitable instruction for that duty. Teach prerequisites, approvals, permitted tools, the steps, expected records, escalation and recovery. Use the correct tenant, cloud and Windows identity model in the explanation. A course completion entry does not replace this local instruction.
Check that the person can perform the duty
Have a qualified reviewer observe a safe demonstration or discuss a realistic case. Use approved test accounts and harmless files for technical tasks. Record what was shown, errors and any supervision still needed. Provide help or supervised coverage for unfinished training and repeat the check before assigning independent work under your local process.
Check each objective
Use these suggested checks with your own scope and procedures. Keep the actual results, including gaps. A course certificate or one successful practice answer does not establish the full requirement.
3.2.2[a]
Choose a real security task and locate its written duties, authority and procedure. Include the provider/customer split where relevant.
Records to keep: Role descriptions, task/procedure references, responsibility matrix and backup arrangements.
3.2.2[b]
Ask who performs, approves and covers the selected duty. Confirm the designated people know and accept those responsibilities.
Records to keep: Dated assignments and acknowledgments tied to the listed duties.
3.2.2[c]
Use the unexpected-support exercise or a safe task demonstration to check the assigned person can follow approvals, perform the work, keep records and escalate a problem.
Records to keep: Training appropriate to the duty, procedure version, reviewer, demonstrated result, remaining help and follow-up check.
Records to keep
Defined duties, authority, designated people and cover for absences.
Training material and the local procedure/version used for each duty.
Observed task or discussion result, reviewer, unresolved limitations and follow-up.
If something is missing
When a task cannot be performed safely, stop the practice change, use the agreed recovery procedure if needed and ask the authorized owner or provider for help. Record which step needs more instruction. Reassign or supervise the task while the training gap is addressed under your process.
Use what you already have
Use the procedures and experienced staff you already have. Microsoft Learn can introduce a product; supervised practice connects it to your setup. Technical demonstrations may require existing licenses, an approved test environment and provider time.
Teach managers and employees what relevant warning signs can look like and how to report them. An unusual event can be a mistake, a compromised account or deliberate misuse. Staff should report the facts through an approved route, without deciding for themselves that a colleague is guilty.
Official requirement and assessment objectives
Provide security awareness training on recognizing and reporting potential indicators of insider threat.
NIST SP 800-171A, June 2018. Determine if:
Official objectives for 3.2.3
Objective
Official text
3.2.3[a]
potential indicators associated with insider threats are identified.
3.2.3[b]
security awareness training on recognizing and reporting potential indicators of insider threat is provided to managers and employees.
What to do
Identify relevant warning signs
With your security and personnel leads, choose potential indicators relevant to your work. Examples for discussion include attempts to access information outside an assigned role, use of unapproved transfer routes or attempts to bypass approved access rules. Explain the context and what remains unknown. Indicators prompt authorized review; they are not proof of wrongdoing.
Give people a known reporting route
Name the security or incident contact for access, data-transfer and account concerns, and the appropriate personnel/HR contact for personnel concerns. Define when those leads coordinate. Provide a phone, on-call or in-person fallback when email is unavailable, an urgent route and an alternative when the usual recipient is involved in the concern.
Practice reporting facts
Use the fictional reporting exercise below for managers and employees. Ask what was observed, when it occurred, which approved record can be referenced and which contact should receive it. Explain what staff may preserve under their role and procedure. Keep sensitive records in approved systems and share them only with authorized recipients.
Explain the limits of the employee role
Make clear that staff should not confront or accuse colleagues, expand monitoring, copy records to personal tools or investigate outside their authority. Do not use a person's background, protected characteristics or personality as a substitute for relevant facts. Have the designated leads handle privacy, HR and legal questions, and explain how concerns about retaliation are reported.
Check each objective
Use these suggested checks with your own scope and procedures. Keep the actual results, including gaps. A course certificate or one successful practice answer does not establish the full requirement.
3.2.3[a]
Ask the responsible leads to identify potential indicators relevant to your environment and explain their context and limits.
Records to keep: Approved indicator/topic list, responsible leads, review date and training material.
3.2.3[b]
Ask a manager and employee how they would recognize and report the fictional concern, including the fallback and an alternative contact.
Records to keep: Training delivered to managers and employees, reporting instructions/version, discussion results, missed sessions and follow-up.
Records to keep
Relevant potential indicators, approved training material and reporting procedure.
Manager and employee attendance, reporting checks, questions and follow-up.
Training evidence references kept separately from restricted incident or personnel case files.
If something is missing
If someone does not know where to report, fix the contact instructions and walk through the route again. If practice reveals a real concern, stop the exercise and use the approved incident or personnel process. Keep the actual case out of ordinary attendance and training notes.
Use what you already have
DCSA offers a public insider-threat awareness course. Add your own contacts, local examples and discussion. Keep the training record in your current approved Office workspace; a new monitoring product is not a prerequisite for this training guide.
The learning outcomes apply across these setups. The tasks, approved workspaces, sign-in routes and reporting contacts used in your local training should match the systems your staff actually use.
Commercial cloud
Demonstrate the approved Microsoft 365 workspace and actual tenant-specific access and support process. A familiar commercial service is not automatically suitable for your CUI or contract. Keep attendance and evidence in a location your organization has approved for those records.
Government cloud
Use the correct GCC, GCC High or Azure Government tenant and the procedures your team follows there. GCC and GCC High are different service arrangements. Confirm course links and any optional product feature work in your cloud before assigning them. A commercial tutorial can explain a concept without matching your portal or available features.
AD DS-only
For assigned Windows duties, teach your domain account, group, approval and Group Policy procedures. Check cloud sign-in and remote support separately where those are also used.
Hybrid joined
Explain which changes belong in AD DS and which belong in Entra or device management. For a leaver or role change, have the assigned person explain how both sides are checked under your procedure.
Entra joined
Teach the tenant, device and workload duties the person actually owns. A device sign-in, an application permission and a user's access to stored CUI are separate things to check.
Azure Virtual Desktop: users should know the approved desktop, handling rules and support route. Assigned administrators need training on the session hosts, access, redirection, logs or recovery they manage. Record what your provider handles and what your team still does. For technical steps, use the Access Control guide alongside your own procedures.
Optional Microsoft attack-simulation tools
Microsoft Attack simulation training requires Microsoft 365 E5 or Defender for Office 365 Plan 2; government use has corresponding G5 or government Plan 2 options. Microsoft lists availability in GCC, GCC High and DoD, with advanced feature limits in GCC High and DoD. Check your subscription, cloud and permissions before planning a campaign. A basic Office subscription does not include the full feature just because Outlook is installed.
You can use the discussion exercises and manual records here without that product. A live simulation needs separate authorization, a suitable design and appropriate handling of employee results. This guide does not ask you to launch one. See Microsoft's current licensing and cloud notes.
Fictional practice, not observed customer results
Practice the decisions people need to make
Choose an exercise that fits the role. Ask the questions before reading the suggested actions, then have participants use your actual procedure and reporting contacts. Nobody needs to run a command, open a suspicious link or change a production system.
Supports 3.2.1
Choose an approved sharing route
Fictional practice only. Harbor Point Fabrication is a made-up contractor. A project coordinator needs to share the made-up record PRACTICE-204 with a partner. The exercise record contains no CUI. In the story, the real work would involve CUI, and a colleague suggests using a personal email account because the approved project workspace is slow. The coordinator has not confirmed the recipient's authorization or the current sharing procedure.
Ask the group
What risks would using personal email or an unapproved workspace introduce?
Which current local policy, sharing procedure and recipient authorization checks apply?
What should the coordinator do before sharing, and who can approve a different route?
How would a manager, administrator and ordinary user each help prevent this mistake?
What a useful response includes
Pause the transfer and keep the practice record in the approved exercise location.
For real work, verify the recipient's authorization, the approved service and the applicable local handling and sharing procedure before releasing CUI.
Use the organization's approved support or Security Lead route to resolve the delay. Obtain any required authorization before changing the sharing method.
Explain the relevant risk and procedure in the participant's own words, then record any unclear instruction for the training owner to correct.
Talk it through
A familiar tool or a completed course does not establish that a sharing route is approved for CUI. Connect the risk to the organization's actual work, current procedure version and each participant's responsibilities. Use only made-up records during practice.
Keep a record: Record the date, facilitator, participant role, local procedure title and version, the participant's explanation, any gap, follow-up owner and due date, and the approved internal evidence reference. Do not record CUI in the exercise notes.
Supports 3.2.1, 3.2.2
Verify unexpected support work
Fictional practice only. At the made-up contractor Harbor Point Fabrication, an unexpected caller claims to be a support technician and asks an administrator to grant temporary elevated access to a project system. The caller says a manager already approved it, but the administrator cannot find the made-up work record PRACTICE-305 or a scheduled change. No live call, account, password, link or system change is part of this exercise.
Ask the group
How should the administrator verify the request through a known organizational channel?
Which assigned person may approve the work, grant access and review the activity?
What role-specific knowledge and practical demonstration does the administrator need before doing this duty?
What should the manager and user do if the request cannot be verified?
What a useful response includes
Pause the requested access change and verify the request through the approved help desk or change process using a known contact route, not contact details supplied by the caller.
Have the designated manager or system owner confirm the business need and required approval. An administrator uses only the access and procedure authorized for the assigned duty.
Use a CUI-free demonstration or walk-through to check the administrator's ability to validate approval, limit access, record the action and escalate a problem under the current local procedure.
Report an unverified or suspicious request through the Security Lead or incident route and retain the approved internal reference. Record any training gap and assign follow-up before independent performance of the duty.
Talk it through
Requirement 3.2.2 concerns competence for assigned security duties. General awareness training can support this work, but it does not replace a defined role, a named assignee and training that checks the person's ability to perform the duty. A manager's approval and an administrator's execution may be separate responsibilities.
Keep a record: Record the assigned duty, designated person or role, relevant procedure version, verification steps demonstrated, result in plain words, support needed, follow-up owner and due date, and the approved internal evidence reference. Leave real credentials and CUI out of the record.
Supports 3.2.3
Report a factual security concern
Fictional practice only. At the made-up contractor Harbor Point Fabrication, a manager reviewing an approved practice log sees a made-up account open a project folder outside its documented authorization and attempt a transfer to an unapproved destination. The log entries are made up and contain no CUI. The manager does not know whether this is a mistake, a compromised account or deliberate misuse. No employee's background, personality or protected characteristics are relevant to the exercise.
Ask the group
Which observable facts should be reported, and what remains unknown?
What approved Security Lead or incident route applies, and when should the designated HR representative also be involved?
What should a participant do if the usual reporting email is unavailable or the concern is urgent?
Which actions would cross the participant's authority or create a risk of retaliation?
What a useful response includes
Report the observable access and transfer events promptly through the organization's named Security Lead or incident route. Use the designated HR representative for personnel concerns under the approved procedure, involving both channels when appropriate.
Describe the date and time, system, observed action, known authorization issue and approved log reference. Distinguish facts from assumptions and share information only with authorized recipients.
If email is unavailable or the matter is urgent, use the approved phone, on-call or in-person fallback. Use the organization's emergency route for immediate threats to safety.
Preserve information only as the approved procedure and the participant's role allow. Do not confront or accuse a colleague, investigate independently, expand monitoring, retaliate or copy sensitive material to personal tools.
Talk it through
An indicator calls for authorized assessment, not a conclusion about a person. Training should teach factual recognition and the organization's actual security and HR reporting channels. Authorized responders decide what investigation or containment is appropriate. Use privacy and anti-retaliation procedures throughout.
Keep a record: Record the reporting route practiced, facts the participant identified, assumptions they avoided, urgent fallback explained, understanding check, follow-up owner and due date, and the approved internal evidence reference. Do not put real personnel allegations or CUI in exercise records.
The Word facilitator pack includes these same exercises and room to record questions and follow-up. If someone raises a real incident, stop the exercise and use your approved reporting procedure.
Free learning resources to use with your local briefing
Choose material for the risks and duties you identified. Public training explains general concepts; add your approved handling rules, assigned roles, contacts and a check of understanding.
Save your certificate before closing. The hub does not save course state, completion records or certificates. Arrange an internal record and a local briefing. If you need a maintained transcript, review DCSA's separate STEPP route and its registration requirements. See the hub FAQ.
A starting point for administrators who already have basic Microsoft 365 and general IT experience. Select the topics that fit the assigned job, then teach and check the procedure in your own environment.
Microsoft Learn content is free to read without a profile. Sign-in is used for progress and achievements, including the module assessment result. Practice using product features may require licenses and an approved environment. A module result is not a CMMC finding. See Microsoft's training FAQ.
Open these in your existing Microsoft Office tools. Save your own copies in an approved location. Replace template fields and review them with the responsible people before use; the examples are fictional and the templates are not approved organizational policies.
Excel
Training tracker
Record assigned training, due dates, attendance, local topics, understanding checks and follow-up. Keep evidence in your own approved location.
Record where evidence is kept, rather than pasting its contents into a tracker. Keep actual incident and personnel case files separately restricted. No CUI, credentials, employee training records or completed files should be uploaded or emailed to this website.
Turn a training gap into follow-up work
For a fictional example, a manager at Harbor Point Fabrication attended an introductory course but cannot find the approved reporting fallback. The team records the missed local briefing and assigns the training owner to update the contact instructions and check again. Attendance stays recorded; the outstanding reporting question stays open.
In the Level 2 gap-and-action worksheet, record objective 3.2.3[b] as Evidence to check, with the internal training evidence reference and the next action. Use the new tracker for who needs the catch-up and the roles matrix for the manager's reporting duty. These are internal work records, not official assessment results.
Sources and review notes
Sources reviewed October 23, 2026. The official requirement text and objectives are separate from our suggested steps. External course access and product features can change; check the linked source before assigning training or buying a service.
Email cmmc@purposefulsecurity.com with a general description. Keep CUI, contracts, employee records, evidence and completed templates in your own approved environment. This site does not collect exercise answers.