Under AT.L2-3.2.3 (Security Awareness Training) and AT.L2-3.2.2 (Insider Threat Training), insider threat awareness training must equip personnel to recognize and report indicators of insider threat activity. Training must focus on organizational processes for reporting suspicious behavior, not just awareness of famous cases or punitive systems. The ability to act and report appropriately is the most critical element.
Exact extracts:
“Training includes recognition of potential indicators of insider threat activity and the organizational processes for reporting suspicious activity.”
“Assessment Objectives … Determine if: insider threat training includes reporting mechanisms.”
“Case studies may be used for context, but training must include clear reporting procedures.”
Expanded explanation:
Insider threat programs under DoD guidance (e.g., NISPOM, CMMC) emphasize:
Awareness of behaviors that may indicate insider threat activity.
Reporting mechanisms — employees must know exactly how to act if they identify an issue.
Procedures for escalation and protection of CUI.
Without reporting procedures, insider threat training is incomplete.
Why other options are incorrect:
A: Bounty systems are not sanctioned practices and could create a hostile work environment.
B: Risk-ranking individuals could be discriminatory and is not a CMMC requirement.
C: Case studies may supplement training but are not sufficient by themselves.
[References:, CMMC Assessment Guide – Level 2, AT.L2-3.2.2 and AT.L2-3.2.3., NIST SP 800-171 Rev. 2, 3.2.2 (Insider Threat Training)., ]
