3.2.1OFFICIAL STATEMENT BELOWBASIC REQUIREMENTPENDING NIST SME REVIEW

3.2.1 — Role-appropriate security awareness

3.2 Awareness and Training · NIST SP 800-171 Rev. 2 · The heading label is this site's navigational shorthand; the official language is the statement below.

Official requirement statement (verbatim)

Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.

NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems ↗NIST SP 800-171A — Assessing Security Requirements for CUI ↗

Independent interpretation

What this requirement is after

Everyone who touches the system — managers, administrators, everyday users — needs to know the risks their own work carries and the rules that apply to it. For a small contractor this is less about a training platform and more about people knowing what CUI is, how it must be handled, and what a phishing attempt looks like in their actual inbox.

Across revisions

Carried into Rev. 3 as Literacy Training and Awareness (03.02.01), with recurring updates on an organization-defined frequency and insider-threat and social-engineering recognition folded in rather than standing alone.

Mapped practices

Brilliant at the Basics practices that support this requirement

IT-10 — Technical workforce readinessIT

Direct implementation supportHigh confidence

Why: The requirement names managers, systems administrators, and users as the populations to be made aware of security risks; the practice's role mapping and recurring training rhythm work directly on the administrator and manager slices of that population.

What this does not claim: Supports implementation of the requirement for the technical and leadership roles the practice concentrates on; the general user population's awareness program is separate work the practice does not carry. Records for the whole population, not just technical staff, are what an assessor examines within the organization's defined system boundary.

Practice-side activities

Map each core defensive capability to its operators and train against the largest gaps first
Run recurring exercises that keep risk awareness current rather than annual

Evidence this produces

Role-to-operator mapping with identified gaps
Training and exercise completion records for technical and leadership roles

Review status: Technical review complete · Reviewed by inDirectIT practitioner review — CUI security and NIST SP 800-171 engineering · updated 2026-08-06

Doing the work

Implementation considerations and evidence

Implementation considerationsIndependent guidance — tailor to your environment

Deliver awareness at onboarding and on a recurring cadence, and keep the content tied to what people actually do — CUI handling for the program team looks different from wire-transfer fraud for finance.
Refresh the material when the threat picture or the policies change; a deck from three years ago quietly trains people for a company that no longer exists.
Fold in insider-threat and social-engineering recognition so one program carries the related requirements instead of three parallel ones.

What operating evidence looks likeRecords worth retaining, not a submission checklist

Completion records with names and dates for the whole user population, including new hires
The training content itself, dated, showing role-relevant risk and policy coverage
A record of when the material was last reviewed and what changed

Suggested owners, derived from the mapped practices and artifacts: Executive sponsor · Executive sponsor or HR lead. Ownership is a named person in your organization, not a role on a website.

Artifacts

Templates and worksheets with a mapped relationship

MATRIX · REVIEW ANNUAL FOR THE MATRIX ITSELF; COMPLETION TRACKING MONTHLY UNTIL EVERY ROW SHOWS CURRENTSecurity Training Matrix

The other revision

Where this lands in Rev. 3

03.02.01 — Literacy Training and Awareness

Provenance

Sources and review status

Primary sources	NIST SP 800-171 Rev. 2 — Protecting CUI in Nonfederal Systems · NIST SP 800-171A — Assessing Security Requirements for CUI
Review status	Pending NIST SME review
Content version	1.0
Updated	2026-08-06