NIST SP 800-171 Rev 2 · 3.2 Awareness & Training

3.2.2 Role-based security training

Ensure that personnel are trained to carry out their assigned information securityrelated duties and responsibilities.

SPRS weight: 5; 5 points deducted from 110 when not implemented.
CMMC level: L2; Level 2 only; not among the 17 Level 1 practices.
Assessment objectives: 3; From NIST SP 800-171A, each one a “determine if” an assessor answers.

What an assessor checks

NIST SP 800-171A breaks 3.2.2 into 3 objectives. Every one has to be met for the requirement to be met; a partial answer scores as not implemented.

[a]Determine if information security-related duties, roles, and responsibilities are defined.
[b]Determine if information security-related duties, roles, and responsibilities are assigned to designated personnel.
[c]Determine if personnel are adequately trained to carry out their assigned information security-related duties, roles, and responsibilities.

Examine: [SELECT FROM: Security awareness and training policy; procedures addressing security training implementation; codes of federal regulations; security training curriculum; security training materials; security plan; training records; other relevant documents or records].
Interview: [SELECT FROM: Personnel with responsibilities for role-based security training; personnel with assigned system security roles and responsibilities].
Test: [SELECT FROM: Mechanisms managing role-based security training].

Not POA&M-eligible: above the 1-point ceiling · 5 points deducted

Worth 5 points. No requirement over 1 point may appear on a Level 2 POA&M, so this has to be closed before the assessment.

A POA&M is only permitted at a score of 88 or above, and closes in one 180-day window. Check a full gap list or compute your score.

CC2 Communication and Information - Obtain, generate, and use relevant information

This page and the MacTech CMMC MCP server render the same dataset. Ask your assistant and it will answer from the methodology, not from memory.

lookup_control 3.2.2
get_assessment_objectives 3.2.2
generate_poam_entries ["3.2.2"]

From MacZine