Insider Threat Awareness Training Guide: Content, Cadence and Evidence for NISPOM and CMMC

Defence contractors are required to train staff to recognise and report insider threat indicators, yet many programmes fail assessment because the content is generic, the cadence is undocumented or the completion records cannot be produced. Two US rules drive most of this work: the National Industrial Security Program Operating Manual (NISPOM, 32 CFR Part 117) for cleared contractors, and the Cybersecurity Maturity Model Certification (CMMC) Level 2 requirement AT.L2-3.2.3 for organisations handling Controlled Unclassified Information (CUI). This guide sets out what each rule asks for, how to build content that meets both, how often to deliver it, and what evidence an assessor or Cognizant Security Agency (CSA) will expect. It is written for facility security officers, insider threat programme senior officials, compliance leads and awareness managers. It does not repeat programme design, which is covered in the Insider Threat Programme Guide, or board level framing, which is in the Insider Risk Executive Briefing.

Status, checked 14 November 2026: 32 CFR Part 117 is in force as published on the eCFR, and 117.12(g) requires insider threat awareness training before a newly cleared employee is granted access to classified information, then annually. This page is not legal advice.

Key takeaways

• Two rules, one curriculum. NISPOM 117.12(g) and CMMC AT.L2-3.2.3 overlap heavily, so one module with a cleared employee supplement usually satisfies both.
• Timing is fixed for cleared staff. NISPOM requires insider threat awareness training before newly cleared employees are granted access to classified information, then annually.
• Reporting routes matter as much as indicators. Both rules expect staff to know how to report, so name the channel, the owner and what happens after a report.
• Evidence is a design requirement. NISPOM requires procedures to validate completion, and CMMC assessors examine curriculum, materials and the mechanism that manages training.
• Fair culture keeps reporting alive. NISPOM says adverse information reports must not be based on rumour or innuendo; teach observation of behaviour, not profiling of people.

What the two rules require

The table below compares the training obligations side by side. NISPOM text is from 32 CFR 117.12 on the eCFR; the CMMC text is from the DoD CIO CMMC Assessment Guide Level 2, version 2.13 (September 2024).

Revision numbering: CMMC Level 2 assessment material is written against NIST SP 800-171 Revision 2, where insider threat awareness is requirement 3.2.3. In NIST SP 800-171 Revision 3 the same content sits inside 03.02.01 Literacy Training and Awareness, which requires training on recognising and reporting indicators of insider threat, social engineering and social mining, as part of initial training and at an organisation-defined frequency thereafter. If you also map to Revision 3, keep both identifiers in your control matrix so the evidence serves both.

For the wider compliance picture see the NIST SP 800-171 and CMMC 2.0 Guide and the CMMC 2.0 Level 2 Assessment Guide.

Building the curriculum

A single core module, with role-specific add-ons, is easier to maintain and to evidence than separate courses per rule. Map every module objective to a requirement so an assessor can trace it.

Use government material where it fits: the Center for Development of Security Excellence (CDSE) offers Insider Threat Awareness (INT101), a 60 minute eLearning course for military, civilian and industry staff with access to classified information, with objectives on recognising vulnerabilities, concerning behaviour and reporting procedures, and a certificate at 75% on the final exam. Check with your CSA whether it meets your annual requirement before relying on it, and add your own reporting channels, because a generic course cannot name them.

Teaching indicators without profiling

CMMC objective [a] requires the organisation to identify its own indicators, so write the list down and keep it versioned. The CMMC assessment guide discussion gives examples: long-term job dissatisfaction, attempts to access information not needed for the job, unexplained access to financial resources, bullying or harassment, workplace violence and serious policy violations. Its assessment considerations add repeated security violations, unusual work hours, unexpected large data transfers, suspicious contacts and concerning off-duty behaviour. For a ranked view of indicators see Top 10 Insider Threat Indicators.

• Behaviour, not identity: frame every indicator as an observable action against a baseline. The CMMC example is an employee working until 9:00 PM every day with no assigned work needing extra hours, which departs from the normal pattern, reported by a co-worker through the agreed route.
• Clusters, not single signs: teach that one indicator is rarely meaningful and that the reporter's job is to pass on what they saw, not to judge intent. The insider threat team assesses.
• Digital indicators: include unusual access to repositories, bulk downloads, use of personal cloud storage, attempts to bypass controls and sharing of credentials or tokens. Staff should know that shared service account passwords and API keys count, which is covered in the Insider Threat and Identity Guide.
• Recruitment approaches: the Coinbase insider bribery breach shows criminals paying support staff with legitimate tool access to copy customer data. Use it as a scenario: what should an agent who receives such an offer do, and how quickly?
• Remote hiring fraud: add a short scenario on fraudulent remote workers for teams that hire or onboard contractors. See the Insider Threat from Fake IT Workers Guide.

Reporting routes and fair culture

Training that teaches indicators but leaves reporting vague produces either silence or a flood of low quality reports. Both rules expect people to know how to report, so the reporting section deserves as much time as the indicators.

• Name the channels: line manager, facility security officer, insider threat team mailbox or hotline, and an anonymous option. Give contact details in the training and on the intranet.
• Explain what happens next: a report is assessed by trained programme personnel; most reports are resolved without action; the reporter's identity is protected as far as the law allows.
• Set the evidence bar: NISPOM 117.8(c)(1) says reports of adverse information about cleared employees are not to be based on rumour or innuendo. Teach staff to report what they observed, when and where, and nothing more.
• Know the escalation path: for cleared contractors, information about actual, probable or possible espionage, sabotage, terrorism or subversive activity goes to the FBI in writing, with the CSA notified (117.8(b)). Staff do not make that call themselves, but they should know the security team must act promptly.
• Protect fairness: explain monitoring openly, involve HR, legal and privacy, and state that reporting is not a disciplinary tool. Programme personnel training under 117.12(g)(1) covers civil liberties and privacy, which should be visible in how the organisation talks about the programme. See the Employee Monitoring and Privacy Guide and Security Culture.

Cadence and delivery

Small versus large organisations: a small contractor with a handful of cleared staff can meet the rules with a CDSE course, a one-page local supplement naming reporting channels and a signed or system-logged completion record. A large prime with thousands of staff needs a learning management system feeding completion data to the security team, automated access holds for overdue training and a separate track for subcontractor staff. Reinforce between annual sessions with short items, as the CMMC guide lists posters, email advisories and logon banners as awareness techniques. Pair this with the Security Awareness Plan Template.

Evidence an assessor or CSA will ask for

1. Policy: a security awareness and training policy stating populations, timing, content owner and review cycle, cross-referenced in the system security plan.
2. Indicator list: the organisation-defined list of insider threat indicators, versioned and dated, to satisfy objective [a].
3. Curriculum and materials: the actual slides, eLearning export or script, with a mapping table from module to requirement.
4. Completion records: per person, date, version and score, covering initial and annual training. NISPOM requires a procedure to validate that all cleared employees completed both.
5. Management mechanism: assessors may test the mechanism managing training, so be ready to show the learning system, reminders and what happens to overdue users.
6. Interview readiness: brief a sample of staff and managers; assessors interview people who took the training and those who deliver it, and will ask how they would report a concern.
7. Proof of reporting use: anonymised counts of reports received and how they were handled show the channel works.

How to implement

1. Scope populations (weeks 1 to 2): pull lists of cleared staff, CUI users, managers, programme personnel and contractors with access. Agree who owns each list.
2. Write the indicator list and reporting procedure (weeks 2 to 4): with HR, legal, privacy and the ITPSO. Test the hotline and mailbox.
3. Build or select content (weeks 3 to 6): use CDSE material where your CSA accepts it, then add local modules 4 to 6. Map each to requirements.
4. Pilot (weeks 6 to 7): run with one team and a group of managers; collect quiz results and feedback on whether reporting routes are clear.
5. Roll out and enforce (weeks 8 to 12): wire completion data into access workflows so newly cleared staff cannot be granted classified access without a record, and CUI access requests check training status.
6. Review annually: refresh scenarios, update the indicator list after incidents and record the review. If a change causes problems, revert to the previous content version, which you have kept with its mapping.

Measuring whether it works

• Completion before access: percentage of newly cleared employees with a training record dated before their access grant; target 100%.
• Annual completion on time: percentage complete by the due date, by population.
• Reporting knowledge: share of staff who can name a reporting channel in a short quiz or spot check.
• Report volume and quality: reports per quarter and the share containing observable, specific detail rather than opinion.
• Time to report: from first observation to report, gathered during case closure.
• Manager disclosures handled correctly: share of manager-originated reports escalated without the manager investigating alone.

Framework mapping

Common failure patterns

• Generic vendor course only: the content never names the organisation's own reporting channels, so staff cannot answer the assessor's question about how they would report.
• No defined indicator list: objective [a] fails because indicators exist only inside a third party course, not in an organisational document.
• Access granted before training: clearance onboarding and training run in separate systems, so newly cleared staff get access first and training weeks later.
• Surveillance tone: training that reads as an instruction to watch colleagues suppresses reporting and damages trust. Lead with protection and fairness.
• Outsourced staff left out: contractors and offshore support teams hold the same access but are not enrolled, which is the population the Coinbase case shows is targeted.
• Records that cannot be produced: completion data is lost when the learning system changes, leaving no proof of prior annual cycles.

Practitioner checklist

• List every population in scope: cleared staff, CUI users, managers, programme personnel, contractors.
• Publish a versioned, organisation-defined insider threat indicator list.
• Name at least two reporting channels, including an anonymous one, inside the training.
• Map each module to NISPOM 117.12(g) and AT.L2-3.2.3 objectives [a] and [b].
• Block classified access for newly cleared employees until a training record exists.
• Run annual refresher training and keep per person, per version completion records.
• Deliver a manager supplement and programme personnel training covering privacy and civil liberties.
• Confirm with your CSA whether CDSE INT101 meets your annual requirement.
• Track the six metrics above and review content after every insider case.

Standards and references

• eCFR: 32 CFR 117.12 Security training and briefings
• eCFR: 32 CFR 117.8 Reporting requirements
• DoD CIO: CMMC Assessment Guide Level 2
• NIST: SP 800-171 Rev. 3 Protecting Controlled Unclassified Information
• CDSE: Insider Threat Awareness (INT101)
• CISA: Insider Threat Mitigation Guide
• Carnegie Mellon SEI: Common Sense Guide to Mitigating Insider Threats, Seventh Edition

Related NHI Mgmt Group resources: Insider Threat Programme Guide · Security Awareness and Human Risk Management Guide · Insider Risk Executive Briefing · CUI Guide