CMMC Level 2

CMMC Level 2 Security Awareness & Training Policy Template

Covers all 3 AT practices (3.2.1-3.2.3): new hire and annual training requirements, role-based training matrix, insider threat recognition, and quarterly phishing simulation program.

Buy Now - $37 Browse All Templates

✓ Instant download

✓ Editable .docx

✓ 30-day money-back guarantee

✓ Written by CISSP & CCSP

What You Get

What's Inside

Everything is included - no hidden extras, no consulting required.

✓All 3 AT practices (3.2.1-3.2.3) addressed with practice-level policy language
✓Security literacy requirements for all CUI-system personnel (3.2.1)
✓Role-based training matrix: System Administrators, Finance, HR, Executives, Help Desk (3.2.2)
✓Insider threat awareness training requirements (3.2.3)
✓New hire training requirement: complete before CUI system access
✓Annual refresher training for all personnel
✓Quarterly phishing simulation program with escalating difficulty
✓Training completion tracking for assessor evidence

Ideal For

Who This Is For

Whether you're building from scratch or formalizing what's already in place.

Defense Contractors

Documenting AT domain compliance with a training program structure that maps directly to the 3 AT practices

IT and Security Teams

Formalizing the existing training program into an assessment-ready policy with the role-based training matrix assessors look for

MSPs

Providing DoD clients with AT domain documentation that covers security literacy, role training, and insider threat requirements

Ready to Get Compliant?

$37

One-time purchase · Instant download · Editable .docx

Get the Template - $37

30-day money-back guarantee. If it doesn't work for you, get a full refund - no questions asked.

Common Questions

Frequently Asked Questions

Everything you need to know before you buy.

What CMMC practices does this cover?

All 3 Awareness and Training practices: 3.2.1 (security literacy), 3.2.2 (role-based training), and 3.2.3 (insider threat awareness).

What does practice 3.2.3 require for insider threat?

Practice 3.2.3 requires that personnel are trained to recognize and report potential insider threat indicators. The policy includes the required training topic and reporting process language.

What evidence do assessors expect for this domain?

Training completion records are the primary evidence. The policy requires tracking completion by employee, role, and date. Phishing simulation completion records also serve as evidence of practice 3.2.1.

What format does it come in?

Editable Microsoft Word (.docx). Compatible with Google Docs and LibreOffice.

Stop Starting From a Blank Page