CMMCDocs.comHome / Glossary / Awareness and Training (AT) Family
Awareness and Training (AT) Family
Also known as: AT family
The AT family covers 3 NIST SP 800-171 requirements governing security awareness training, role-based training, and insider threat awareness.
The Awareness and Training (AT) family is one of the smaller NIST SP 800-171 Rev 2 control families, with just 3 security requirements. It governs how the contractor ensures personnel understand their security responsibilities and recognize insider threats.
Key AT requirements include AT.L2-3.2.1 (security awareness training for all users), AT.L2-3.2.2 (role-based training for personnel with significant security responsibilities), and AT.L2-3.2.3 (insider threat awareness training).
The AT family is typically owned by HR or the compliance lead. A C3PAO will ask for training records, completion percentages, and the curriculum itself. Generic 'click-through' annual training is usually not sufficient — assessors expect role-relevant, CMMC-aware content.
Stop Googling. Start working.
CMMCDocs has all 110 NIST SP 800-171 Rev 2 requirements built in — with the language, the templates, and the evidence vault you need. Spin up a free demo workspace and click around the way an assessor would.
Get my demo account