CMMC Practice Requirement:

Provide security awareness training on recognizing and reporting potential indicators of insider threat.

CMMC Requirement Explanation:

A large number of security breaches result from insider threats. Insider threats can result from employee negligence or malicious behavior. Employees need to be trained to identify insider threats and report them to the appropriate persons.

Example CMMC Implementation:

As part of your annual security awareness training, teach employees how to identify insider threats. This can be a few slides in your security awareness slide deck or separate online course. The U.S. has a free course online called "Insider Threat Awareness".


- Scenario 1:

To provide insider threat awareness training you require employees to complete an online course. At the end of this free government provided course your employees are awarded a certificate of completion. Employees are required to take the course annually.

- Scenario 2:

Your employees have all received insider threat awareness training. One employee notices another employee who always stays at the office late into the night. The employee reports this suspicious activity to management. An internal investigation determined that the employee was scanning paperwork containing CUI and saving it to a personal thumb drive. The employee is sanctioned for his actions.

Discover Our NIST SP 800-171 Solutions:


Compliance Accelerator

For contractors seeking compliance

Quantum Assessor

For IT service providers

Supply Chain Verifier

For contractors seeking to verify partner compliance