NIST 800-171 3.2.2 (AT.L2-3.2.2): Role-Based Training
Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
CMMC Level 2 practice AT.L2-3.2.2
What 3.2.2 means in practice
People with security duties, such as administrators, the security officer or the help desk, are trained for those specific duties, beyond general awareness. Define the roles, assign the duties, and keep a record that each person was trained for theirs.
SPRS points and the CMMC POA&M
- CMMC Level 2 practice
- AT.L2-3.2.2
- SPRS points
- 5 points. When it is not met, the DoD Assessment Methodology subtracts 5 from the score of 110.
- CMMC POA&M
- Not allowed. It is worth 5 points, and 32 CFR 170.21(a)(2)(ii) admits only requirements worth 1 point, with one exception: 3.13.11 when encryption is used but not FIPS validated.
Sources: NIST SP 800-171 DoD Assessment Methodology, version 1.2.1 (June 24, 2020), Annex A; 32 CFR 170.21, Plan of Action and Milestones requirements.
What an assessor checks for 3.2.2
NIST SP 800-171A gives 3 determination statements for 3.2.2, each found satisfied or other than satisfied. Determine if:
- 3.2.2[a] information security-related duties, roles, and responsibilities are defined.
- 3.2.2[b] information security-related duties, roles, and responsibilities are assigned to designated personnel.
- 3.2.2[c] personnel are adequately trained to carry out their assigned information security-related duties, roles, and responsibilities.
NIST SP 800-171A (June 2018), assessment objectives for 3.2.2
Evidence that shows 3.2.2 is met
- A list of security roles and the duties assigned to each.
- Training plans or courses matched to those roles.
- Training completion records by person and role.
How PolicyCortex gathers the evidence
No PolicyCortex collector reads the evidence for 3.2.2. Your team provides the evidence listed above.
Meet the requirement once. Keep the evidence current.
- Published
- Last updated
- Unchanged since publication