AT.L2-3.2.1
Role-Based Risk Awareness
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AT.L2-3.2.1 in the reference catalog with its NIST cross-references
Official requirement
Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
Assessment objectives
a. security risks associated with organizational activities involving CUI are identified;
b. policies, standards, and procedures related to the security of the system are identified;
c. managers, systems administrators, and users of the system are made aware of the security risks associated with their activities; and
d. managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Make managers, administrators, and users aware of security risks and their applicable policies.
Implementation example
Example from the source assessment guide (not a mandatory implementation): Your organization holds a DoD contract which requires the use of CUI. You want to provide information to employees so they can identify phishing emails . To do this, you prepare a presentation that highlights basic traits, including: • suspicious-looking email address or domain name; • a message that contains an attachment or URL; and • a message that is poorly written and often contains obvious misspelled words. You encourage everyone to not click on attachments or links in a suspicious email [c]. You tell employees to forward such a message immediately to IT security [d]. You download free security awareness posters to hang in the office [c,d]. You send regular emails and tips to all employees to ensure your message is not forgotten over time [c,d].
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Security awareness and training policy; procedures addressing security awareness training implementation; relevant codes of federal regulations; security awareness training curriculum; security awareness training materials; system security plan; training records; other relevant documents or records
Common mistakes
Providing generic awareness material without connecting it to employees' responsibilities.