AT.L2-3.2.3
Insider Threat Awareness
Source and approval
CMMC Assessment Guide — Level 2 · Revision 2.13
Publisher approved · Complete cited source edition 2026-10-31
Read the official guideSee AT.L2-3.2.3 in the reference catalog with its NIST cross-references
Official requirement
Provide security awareness training on recognizing and reporting potential indicators of insider threat.
Assessment objectives
a. potential indicators associated with insider threats are identified; and
b. security awareness training on recognizing and reporting potential indicators of insider threat is provided to managers and employees.
Implementation guidance
Editorial examples to help you plan. Adapt them to your environment; the official requirement and objectives remain authoritative.
In plain language
Train personnel to recognize and report potential insider-threat indicators.
Implementation example
Example from the source assessment guide (not a mandatory implementation): You are responsible for training all employees on the awareness of high -risk behaviors that can indicate a potential insider threat [b]. You educate yourself on the latest research on insider threat indicators by reviewing a number of law enforcement bulletins [a]. You then add the following example to the training package: A baseline of normal behav ior for work schedules has been created. One employee’s normal work schedule is 8:00 AM–5:00 PM, but another employee noticed that the employee has been working until 9:00 PM every day even though no projects requiring additional hours have been assigned [b]. The observing employee reports the abnormal work schedule using the established reporting guidelines.
Evidence examples
Examples suggested by the source guide (not an exhaustive or mandatory checklist): Security awareness and training policy; procedures addressing security awareness training implementation; security awareness training curriculum; security awareness training materials; insider threat policy and procedures; system security plan; other relevant documents or records
Common mistakes
Discussing insider risks without explaining the reporting route.