Provide Insider Threat Awareness Training

CMMC Level 2 practice AT.L2-3.2.3, rooted in NIST SP 800-171 Rev 2 requirement 3.2.3, mandates that organizations identify potential indicators associated with insider threats and provide security awareness training to both managers and employees on recognizing and reporting those indicators. Insider threats include current or former employees, contractors, or business partners who misuse authorized access to harm the organization's systems, data, or mission — whether through intentional espionage, sabotage, theft of CUI, or unintentional negligence. The training must address behavioral indicators such as unusual access patterns, expressed grievances, financial stress signals, or attempts to bypass security controls, as well as technical indicators like unauthorized data exfiltration or off-hours system access. Organizations must ensure this training reaches the entire user population — not just IT staff — because any authorized user can become an insider threat vector. This practice complements personnel security screening (NIST SP 800-171 §3.9) by keeping the workforce vigilant throughout the employment lifecycle, not just at onboarding.