Sep 17 2025
Training, Awareness, and Insider Threats Under CMMC and NIST 800-171r2
The human factor remains the single largest vulnerability in any security program. That’s why CMMC and its underlying framework, NIST 800-171r2, put heavy emphasis on training, awareness, and insider threat management.
Technology alone doesn’t stop phishing, careless mistakes, or malicious insiders. People do.
How the CMMC controls work together to address Training, Awareness, and Insider Threats.
• Access Control (AC) Restricting system and data access to only what’s necessary — reducing the “blast radius” of a potential insider.
o AC.L2-3.1.1 – Limit system access to authorized users, processes, and devices. Coupled with training, this reduces the chance of accidental or intentional misuse.
• Awareness & Training (AT): Awareness and role-based training, including recognition of malicious or suspicious activity.
o AT.L2-3.2.1 – Ensure managers, system administrators, and users are made aware of the security risks associated with their activities.
o AT.L2-3.2.2 – Ensure personnel are trained to carry out their assigned information security-related duties.
o AT.L2 3.2.3 – Provide security awareness training on recognizing and reporting potential indicators of insider threat.
• Personnel Security (PS): Screening personnel before granting access, an essential safeguard against insider threat exposure.
o PS.L2-3.9.2 – Screen individuals before authorizing access to systems containing CUI. Background checks and vetting (ensuring or providing appropriate training can and should be a component of vetting) support insider threat prevention.
• Audit & Accountability (AU): Audit logs and review, used to detect inappropriate access or unusual patterns that may signal insider misuse.
o AU.L2-3.3.1 – Maintain and review audit logs, which are critical for detecting insider misuse.
Together, these controls reflect a simple truth: employees need to understand both the risks and their responsibilities to keep CUI secure.
Insider Threats: A Focus on The Human Side of Risk
The most advanced technical defenses can be bypassed by an insider with legitimate access. Insider threats may be malicious (data theft, sabotage) or unintentional (falling for phishing, mishandling sensitive data). Both can be devastating.
That’s why training isn’t just “check-the-box.” It’s about building a culture of security awareness where employees recognize risks, follow procedures, and feel empowered to report suspicious behavior.
We highly recommend talking to an insider threat professional like Shawnee Delaney, CEO of Valiance Group. Shawnee’s counterintelligence background and expertise in human risk provide organizations with actionable strategies to move beyond compliance into resilience.
What Organizations Should Do Now
1. Develop role-based training – Tailor security awareness for executives, admins, and end-users. Leadership needs to understand the risk and how they themselves can often be the target of bad actors. All too often it’s at the top of the hierarchy that is the least aware, and the most vulnerable.
2. Refresh often – Annual training isn’t enough. Reinforce key behaviors through regular touchpoints (e.g., phishing tests, continuing education).
3. Screen and monitor personnel – Establish pre-hire vetting and ongoing monitoring to reduce insider risk.
4. Measure effectiveness – Track whether training changes behavior (reporting rates, test scores, incident reduction).
5. Link to compliance – Map training efforts directly to AT, PS, AC, and AU controls to demonstrate compliance during audits.
The Takeaway
CMMC and NIST 800-171r2 don’t just want secure systems — they want trained, aware people protecting those systems. Training, awareness, and insider threat programs aren’t “soft” requirements; they’re mandatory, auditable controls that directly impact compliance and resilience.
BACK TO BLOGS
