CUI training for a small contractor's staff
Published 2026-10-23, 12 min read
- AT.L2-3.2.1
Awareness
5
points, never on a POA&M
Managers, admins and users know the risks and your rules.
- AT.L2-3.2.2
Role-based training
5
points, never on a POA&M
People with security duties are trained to do them.
- AT.L2-3.2.3
Insider threat
1
point, may go on a POA&M
Everyone can spot and report the warning signs.
Out of a maximum Level 2 score of 110. A shop with no training program at all starts 11 points down.
If you hold CUI, your people need training, and you need proof they had it. This guide shows what the rule actually asks, which free official courses exist, and how a small shop runs a plan that an assessor will accept. What CUI is in the first place is covered in What is CUI?, so this page does not repeat it.
What the rule asks: 3.2.1, 3.2.2 and 3.2.3
Training for CUI is not a separate regulation. It is the Awareness and Training family of NIST SP 800-171, three requirements out of 110. DoD binds Rev 2: Part 170 incorporates it, and the deviated DFARS 7012 names "Revision 2". The CMMC program around it is changing, so this is what applies today:
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
Here is each requirement in NIST's words, and what an assessor checks under it. The checks are the assessment objectives in NIST SP 800-171A (June 2018), the document Part 170 uses to assess Level 2. A requirement is met only when all its applicable objectives are satisfied, based on evidence.
Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.NIST SP 800-171 Rev 2, 3.2.1
What the assessor checks (800-171A)
- [a]The security risks of your work involving CUI are identified.
- [b]Your security policies, standards and procedures are identified.
- [c]Managers, admins and users are made aware of those risks.
- [d]They are made aware of your policies, standards and procedures.
Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.NIST SP 800-171 Rev 2, 3.2.2
What the assessor checks (800-171A)
- [a]Security duties, roles and responsibilities are defined.
- [b]They are assigned to named people.
- [c]Those people are adequately trained to carry them out.
Provide security awareness training on recognizing and reporting potential indicators of insider threat.NIST SP 800-171 Rev 2, 3.2.3
What the assessor checks (800-171A)
- [a]Potential insider threat indicators are identified.
- [b]Managers and employees are trained to recognize and report them.
Read 3.2.1[b] and [d] twice. The policies and procedures in question are yours: where CUI may live in your shop, who may see it, how a drawing is shredded. No outside course can teach those, which is why a certificate from a free course covers only part of the requirement.
If your shop holds federal contract information but no CUI, none of the 15 basic safeguards of Level 1 is a training requirement. Training becomes a scored requirement the day CUI arrives.
DoD's own training rule, and what reaches you
Search for CUI training and you meet two other rules with firmer numbers than NIST's: DoD's CUI instruction, DoDI 5200.48, and the government-wide CUI rule, 32 CFR Part 2002. Both are written for government people first. Here is who each one binds.
| Source | Who it binds | How often | Records |
|---|---|---|---|
| NIST SP 800-171 Rev 2, 3.2.1 to 3.2.3 | You, through DFARS 252.204-7012 in your contract or the prime's flowdown. | You decide. NIST: organizations determine the content and frequency. | Training records are on the list of what an assessor may examine. |
| DoDI 5200.48 (March 6, 2020) | DoD civilian and military personnel, and contractors supporting DoD under contractual requirements. | Initial, then an annual refresher. | DoD components keep documentation of the training for audit. |
| 32 CFR 2002.30 | Federal agencies, for their own employees. | When an employee starts, then at least once every two years. | Not stated. |
| 32 CFR 2002.16 and your agreement | You indirectly: the agency's agreement passes the CUI rules on to you. | Not stated. | Not stated. The sharer must expect you know how to handle CUI. |
The government-wide rule does not apply to you directly. In its own words it applies "indirectly to non-executive branch CUI recipients, through incorporation into agreements". For a defense shop that agreement is the contract, and the contract's security clause is DFARS 252.204-7012, which points to NIST SP 800-171. So the training duty you are scored on is 3.2.1 to 3.2.3, at a frequency you set and write down.
DoD's annual refresher reaches a contractor through a contract that asks for it. If your contract or a prime's purchase order names CUI training, that wording is your floor. If nothing names it, annual is still the cadence we suggest: it is what DoD asks of its own people, it is easy to explain to an assessor, and it puts a date by which everyone has heard each new procedure. That suggestion is ours, not a rule. One reading note: the training standards themselves are paragraph 3.6.g of the issuance, the table below; 3.6.b's cross-reference prints "3.6.f", which in the published text is a paragraph on other agencies' CUI categories.
DoD also lists what CUI training must cover at minimum. It is written for DoD staff, but it is the best curriculum outline there is, and an assessor will recognize it. Here it is in shop terms.
| Number | DoD's minimum topic | What it means in your shop |
|---|---|---|
| 01 | Each person's responsibilities for protecting CUI | Who in your shop touches CUI, and the three or four things each of them must always do. |
| 02 | The index and categories of CUI people routinely handle | The categories on your own orders, such as Controlled Technical Information on drawings or Export Control for ITAR data. What is CUI? |
| 03 | The CUI Registry: purpose, structure, location | Where to look a marking up (archives.gov/cui) when a drawing carries one nobody recognizes. |
| 04 | CUI Basic and CUI Specified | Why some banners carry extra letters, and that those need the handling their law sets. |
| 05 | Who oversees the CUI program | For you: the prime or contracting officer who sent the CUI, and the person in your shop who owns the program. |
| 06 | Marking requirements | Reading the banner on what arrives, and marking the copies, travelers and files you make from it. CUI marking |
| 07 | Physical safeguards and protection methods | The controlled area, the locked drawer at shift end, no photos of drawings on personal phones. |
| 08 | Destruction requirements and methods | Which shredder, and who sanitizes old laptops, drives and controller memory. Media sanitization |
| 09 | Incident reporting procedures | Who to tell inside the shop, at once. A cyber incident goes to DoD within 72 hours of discovery. |
| 10 | Disseminating CUI inside and outside government | Sending a drawing to the plater or heat treater only when they need it and the clause flows to them. |
| 11 | Decontrolling CUI | Decontrol comes from the government side, not from you. Shipping the last part does not decontrol the drawing. |
Free official training, and what it covers
You do not have to buy a course. The agency that runs the CUI program and DoD both publish training for free. Here is what we could open on 2026-10-23, and what we could not.
CUI training modules from the National Archives
NARA says the modules "can be used to supplement any training or awareness efforts by Executive branch entities or other stakeholders (i.e., Nonfederal organizations)". Each comes as slides in PDF, a transcript and a video file, with no sign-in. The page offers no test and no completion certificate, so the record of who watched what is yours to keep.
- CUI Program Overview2017
- Controlled Environments2017, August 2018
- Introduction to Marking2017, August 2018
- Marking: Non-Traditional2017
- Marking Commingled InformationAugust 2018
- Lawful Government Purpose2017, August 2018
- Destruction2017, August 2018
- Decontrolling2017
- Freedom of Information Act (FOIA)August 2018
- Unauthorized Disclosures: Preventing and Reportingundated
The page was last reviewed on October 7, 2019, and the newest edition is from August 2018. The rule they teach, 32 CFR Part 2002, is the same rule. Open the modules
Center for Development of Security Excellence
DoD's CUI instruction names CDSE as the channel for CUI training to DoD personnel and contractors. Its site refused our reader on 2026-10-23, so we cannot confirm the current course title, length or whether it issues a completion certificate. Search the CDSE catalog for CUI, and check whether it also offers an insider threat awareness course for 3.2.3.
DoD Cyber Exchange training pages
When we opened cyber.mil's training pages on 2026-10-23 they sent us to the DoD sign-in portal (CAC, PIV or ECA token). If your people have no DoD token, open the link from a shop computer before you build a plan around it.
A starter set for the whole shop, in our view: Program Overview, Controlled Environments, Introduction to Marking, Destruction, and Unauthorized Disclosures. They speak to government offices, so you will translate as you go. The topics table above is that translation.
A training plan for a 10 to 50 person shop
A plan that holds up has four parts: who is trained, on what, when, and where the proof is kept. Write it as one paragraph in your system security plan and the rest of this page fills it in. The calendar below is our suggestion, not a rule.
A new hire, a temp or someone changing roles gets the shop session and signs the record before the first login or the first marked drawing.
The whole shop sits a refresher. Same date each year, so nobody falls through, and one record sheet for the session.
A new system, a new procedure, a lost drawing or a near miss: a short session for the people it touches, on the record.
Reminders count as awareness, not as training: a notice from the owner, a logon message, a poster by the plotter.
Not everyone needs the same session. The floor needs paper habits, the office needs email habits, and whoever runs your systems needs the technical training 3.2.2 asks for. Pick a role:
Office, estimating, purchasing, quality and engineering: anyone who opens a CUI file, email or drawing.
- When
- Before first access, then every 12 months.
- Answers
- NIST SP 800-171 3.2.1, 3.2.3
- Which documents on your orders are CUI, and how to tell from the banner
- Where CUI may live in this shop, and where it may never go (personal email, home computers, phones)
- Sharing: who outside the shop may receive it, and how it is sent
- Phishing and calls fishing for job details, and what to do with them
- Who to tell, at once, when something goes wrong
- Insider threat warning signs, and how to raise one quietly
The insider threat part (3.2.3) is the one owners skip, because it feels like accusing their own people. NIST frames it as a list of signs and a way to report them, with managers taught to notice changes in behaviour and everyone else the general signs.
Name two people a worry can go to, so nobody has to report to the person they are worried about. For a small shop, that can be the whole procedure.
Keeping evidence an assessor will accept
Training that left no trace did not happen, as far as an assessment goes. NIST SP 800-171A lists what an assessor may examine for these three requirements, and every item on it is a piece of paper you can prepare now.
- One paragraph in your system security plan: who is trained, on what, how often, and where the records are. 800-171A: system security plan SSP template
- A short training policy, or a training section in your security policy, approved and dated. 800-171A: training policy Policy templates
- The materials: your own session's slides or one-page sheet, and the list of outside modules used. 800-171A: curriculum, materials
- The list of security duties and the named person who holds each one. 3.2.2[a], [b]
- The record of every session: date, trainer, topics, names and signatures, plus any course certificates. 800-171A: training records
- Your people. The assessor may interview ordinary users, so the floor should be able to say where a drawing goes at shift end. 800-171A: interview
So the policy needs an approval and a date, and the record needs real signatures, not a list typed the night before. Keep the records with the rest of your assessment evidence. Under the CMMC rule, assessment evidence is kept for six years from the CMMC Status Date.
Here is a record sheet that carries what the list above asks for. Print one per session, tick the topics covered, and file the signed sheet.
CUI training record, NIST SP 800-171 3.2.1 to 3.2.3, cuideck.com
One sheet per session. Fill it by hand, have everyone sign, and file it with your assessment evidence.
Kind of session
- Initial, before access
- Annual refresher
- After a change
- Role-based (3.2.2)
Topics covered
- Which documents are CUI, and the categories on our orders
- Reading and applying markings
- Where CUI may live here, and where it may not
- Physical safeguards: controlled area, drawers, phones
- Sharing with vendors and the prime
- Destruction: shredding and sanitizing
- Reporting incidents, inside and to DoD
- Insider threat signs and how to report (3.2.3)
- Phishing and social engineering
- Assigned security duties (3.2.2)
| Line | Name | Role | Signature | Next due |
|---|---|---|---|---|
| 01 | ||||
| 02 | ||||
| 03 | ||||
| 04 | ||||
| 05 | ||||
| 06 | ||||
| 07 | ||||
| 08 |
Questions shops ask about CUI training
Do we need CUI training for CMMC Level 1?
No. None of the 15 basic safeguards of Level 1 is a training requirement. The three training requirements come with Level 2, which applies once your shop holds CUI. A short briefing on federal contract information is still cheap insurance, but no rule scores it at Level 1.
How often do we have to train?
NIST leaves the frequency to you, so the answer is whatever your policy says, and you must then do it. DoD trains its own people at the start and every year after; federal agencies train at the start and at least every two years.
If your contract or a prime names a cadence, that wins. Otherwise we suggest every 12 months.
Does a free online course satisfy 3.2.1 by itself?
Only part of it. A course can make people aware of the risks. 3.2.1 also asks that they know your own policies and procedures, and only you can teach those. Add a short shop session and keep both records.
Do machinists who never log in need training?
If they work from marked drawings, yes in practice. They hold CUI on paper, and the CUI rule expects anyone it is shared with to know how to handle it. Keep their session to paper habits: the banner, the drawer, the shred bin, and who to tell.
Can missing training go on a POA&M?
Only the insider threat requirement, 3.2.3, which is worth 1 point. Awareness (3.2.1) and role-based training (3.2.2) are worth 5 points each, and only 1-point requirements may go on a Level 2 POA&M. The POA&M template applies the same rule.
Does the trainer need a certification?
No rule we read names a training provider or a credential for whoever gives the session. NIST leaves the content to you. What matters is that the content matches your procedures and the record shows who attended.
Our MSP runs our systems. Is their training our problem?
Yes, where their people hold security duties on your systems: 3.2.2 asks that those duties are assigned and the people trained. Ask your managed service provider in writing for the training records of the staff who touch your systems, and file them with yours.