---
title: "NIST 800-171 3.2 Awareness and Training"
description: "The 3 NIST SP 800-171 Awareness and Training requirements (3.2, CMMC AT): text, SPRS points, POA&M rules and evidence."
url: https://policycortex.com/nist-800-171/awareness-and-training
sealed: 2026-11-11
amended: 2026-11-11
register: nist-800-171/awareness-and-training
records: 4
digest: sha3:337684642091558f5bfc7b9679463a2929a8a51f282b5393abe38a3f8b094ff2
---

# NIST 800-171 3.2 Awareness and Training

NIST 800-171 / Awareness and Training

Awareness and Training asks that people know the risks of their work and the rules that apply, that those with security duties are trained for them, and that everyone can recognize and report signs of insider threat. The evidence is training content and completion records.

3 requirements · up to 11 SPRS points · 1 can go on a CMMC POA&M

## The 3 Awareness and Training requirements

| Requirement | CMMC practice | SPRS points | Requirement text |
|---|---|---|---|
| [3.2.1 Security Awareness](https://policycortex.com/nist-800-171/awareness-and-training/3.2.1) | AT.L2-3.2.1 | 5 points | Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems. |
| [3.2.2 Role-Based Training](https://policycortex.com/nist-800-171/awareness-and-training/3.2.2) | AT.L2-3.2.2 | 5 points | Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities. |
| [3.2.3 Insider Threat](https://policycortex.com/nist-800-171/awareness-and-training/3.2.3) | AT.L2-3.2.3 | 1 point | Provide security awareness training on recognizing and reporting potential indicators of insider threat. |

## Awareness and Training: points and the CMMC POA&M

**Q: How many SPRS points can the Awareness and Training family cost?**
A: Up to 11 of the 313 points a score can lose: 2 worth 5 points and 1 worth 1.

**Q: Which Awareness and Training requirements can go on a CMMC POA&M?**
A: 1 of the 3: 3.2.3, worth 1 point. The others are worth more than 1 point, which 32 CFR 170.21(a)(2)(ii) does not admit. The score must also be at least 88.

## Related pages

- **Calculator**: [SPRS score calculator: mark the Awareness and Training requirements and see what they cost.](https://policycortex.com/sprs-score-calculator#family-AT)
- **Sample package**: [Sample package: an SSP, a POA&M and an evidence chain the product generated from demonstration data.](https://policycortex.com/sample-package)
- **Previous family**: [3.1 Access Control](https://policycortex.com/nist-800-171/access-control)
- **Next family**: [3.3 Audit and Accountability](https://policycortex.com/nist-800-171/audit-and-accountability)
- **All requirements**: [All 110 NIST SP 800-171 requirements, by family.](https://policycortex.com/nist-800-171)

Know the family. Keep the evidence for every requirement in it. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | FAMILY | 1c8f3fc7cff4 | 2bf1cfa33da3 |
| REC 0001 | REQUIREMENTS | c0712ca75033 | 1c8f3fc7cff4 |
| REC 0002 | POINTS AND POA&M | 8dd47122b160 | c0712ca75033 |
| REC 0003 | RELATED | 337684642091 | 8dd47122b160 |

Head sha3:337684642091558f5bfc7b9679463a2929a8a51f282b5393abe38a3f8b094ff2. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.