What security awareness training does CMMC require of defense contractors?

CMMC is the US Department of Defense (DoD) program for verifying that contractors protect sensitive, unclassified government information on their own systems. It applies when a DoD solicitation or contract specifies a CMMC level and the contractor's systems will process, store or transmit Federal Contract Information (FCI) or Controlled Unclassified Information (CUI).

For readers outside the United States: federal regulations are published in the Code of Federal Regulations (CFR), organized by title and part. CMMC sits in two places. The program rule at 32 CFR Part 170, effective December 16, 2024, defines the levels, assessments and scoring. The acquisition rule in the Defense Federal Acquisition Regulation Supplement (DFARS), effective November 10, 2025, puts clause 252.204-7021 into contracts so that the requirement actually binds a supplier.

CMMC does not create new security controls. It verifies requirements that already existed: the 15 basic safeguarding requirements in FAR 52.204-21 (Level 1), the 110 requirements of NIST SP 800-171 Revision 2 (Level 2), and 24 selected requirements from NIST SP 800-172 (Level 3). Subcontractors at any tier receive the requirement through flowdown when they will handle FCI or CUI, which is how companies in Europe, the Middle East and Asia come into scope. This page states the position as at September 2026.

Training requirements appear at Level 2 and Level 3 only. The Level 1 requirements in FAR 52.204-21 cover access control, identification and authentication, media sanitization, physical access, boundary protection, flaw remediation and malware protection, and contain no awareness or training requirement.

In practice, Level 2 expects three distinct streams: general awareness for everyone who uses in-scope systems, deeper role-based training for people with security duties, and insider threat awareness. The discussion text in NIST SP 800-171 Rev. 2 leaves content and frequency to the organization, based on its requirements and the systems people can access.

• Awareness (3.2.1): NIST describes the content as a basic understanding of the need for information security, user actions to maintain security and respond to suspected incidents, and operations security. Techniques can include formal training, email advisories, logon messages and awareness events. It points to NIST SP 800-50 for program guidance.
• Role-based training (3.2.2): NIST lists roles that need security-related technical training tailored to their duties, including system and network administrators, developers, architects, procurement officials, configuration management and audit staff, and security assessors.
• Insider threat (3.2.3): NIST gives indicators such as long-term job dissatisfaction, attempts to access information not needed for the job, and serious policy violations, and says training should cover how to report concerns through the organization's channels. It suggests tailoring by role, for example behavior-change indicators for managers.

The program rule sets a ceiling on vague frequencies. Section 170.14(d) says that where CMMC requirements use "periodically", the interval is organization-defined but no more than one year. An annual refresh cycle is therefore the practical maximum wherever a contractor's own policy uses periodic language.

Each requirement is assessed as MET, NOT MET or not applicable against the assessment objectives in NIST SP 800-171A, and a single unmet objective makes the requirement NOT MET. Level 2 scoring starts at 110 and subtracts 5, 3 or 1 points for each unmet requirement, as set out in 32 CFR 170.24.

The weighting matters for training. Under 32 CFR 170.21, a Level 2 contractor can reach Conditional status with a POA&M only if its score is at least 80% of the maximum and every item on the POA&M is worth 1 point. Because AT.L2-3.2.1 and AT.L2-3.2.2 are 5-point requirements, a gap in general awareness or role-based training cannot be deferred and prevents Conditional status. A gap in insider threat awareness (1 point) can be placed on a POA&M, which must then be closed within 180 days.

The annual affirmation is where training records become a board-level matter. Section 170.22 requires an Affirming Official, a senior representative with authority over compliance, to attest to continuing compliance in the Supplier Performance Risk System (SPRS) each year. Training that lapses between assessments undermines that attestation. While Phase 2 is suspended, Level 2 status is obtained by self-assessment, so the affirmation carries more weight.

The rule text phases CMMC into DoD contracts over four phases that started on November 10, 2025, when the DFARS acquisition rule took effect. The phases are defined in 32 CFR 170.3(e), each starting one calendar year after the previous one. However, on July 13, 2026 the Department announced the suspension of the Phase 2 requirements, and the program is paused in Phase 1 while a CMMC reform task force reviews it.

1. Phase 1, from November 10, 2025: DoD intends to require Level 1 (Self) or Level 2 (Self) as a condition of award in applicable solicitations, and may require Level 2 (C3PAO) at its discretion. This is the phase in effect, and paused, as at September 2026.
2. Phase 2, scheduled in the rule for November 10, 2026 but suspended: would add Level 2 (C3PAO) as a condition of award for applicable contracts, and Level 3 (DIBCAC) at DoD's discretion.
3. Phase 3, one year after Phase 2 in the rule text: Level 2 (C3PAO) for all applicable contracts, including as a condition to exercise option periods, and Level 3 (DIBCAC) for all applicable contracts.
4. Phase 4, one year after Phase 3 in the rule text: full implementation in all applicable solicitations and contracts, including option periods on older contracts.

The DFARS rule also explains that for three years after November 10, 2025, the clause appears only where program managers decide to apply a CMMC requirement; after that, it applies wherever the contractor will handle FCI or CUI, excluding purchases solely of commercially available off-the-shelf items. Under the implementing memo, program managers may designate only Level 1 (Self) or Level 2 (Self) during the suspension, and existing Level 2 (C3PAO) and Level 3 (DIBCAC) requirements are to be removed from solicitations and contracts. DFARS 252.204-7012 remains in effect, and the training requirements themselves are unchanged. Later phase dates depend on the outcome of the review; confirm the position against the solicitation in hand.

Map each requirement to an observable learning outcome and to evidence an assessor can examine, because assessors test the objectives behind each requirement, not the existence of a course. The table below is illustrative and would need tailoring to each contractor's systems, roles and System Security Plan.

A training matrix linking each in-scope role to its requirements is the simplest way to show coverage. For a method, see how to map training to compliance obligations, and for assessment readiness, how to prepare training records for an audit. Organizations that also certify to ISO/IEC 27001 can reuse much of the same evidence; see ISO 27001 awareness training requirements.

Knowledge Foundry models each CMMC requirement and its NIST assessment objectives as nodes in a knowledge framework, then links them to roles, learning outcomes and assessment points. Coverage gaps by role are visible before an assessment, and the evidence trail supports the annual affirmation. See the approach for government and defense organizations.