CMMC security awareness training
CMMC Level 1 asks defense contractors to affirm, every year, that 15 basic safeguards protect Federal Contract Information. None of the 15 is a training requirement, yet most of them fail when people do the wrong thing.
Five-to-ten-minute 3D exercises mapped to each CMMC duty, with completion evidence your auditor can export.
At a glance
- Rule
- 32 CFR Part 170, effective 16 December 2024
- In contracts
- DFARS clause live since 10 November 2025, phased over 3 years
- Level 1
- 15 FAR 52.204-21 safeguards, self-assessed and affirmed yearly
- Training
- Named duty starts at Level 2 (NIST SP 800-171, 3.2.1 to 3.2.3)
What a false cybersecurity claim cost one contractor
An affirmation is a statement to the government. DOJ treats false ones as fraud.
MORSECORP: $4.6 million over an inflated SPRS score
In March 2025, defense contractor MORSECORP agreed to pay $4.6 million to resolve False Claims Act allegations tied to Army and Air Force contracts.
MORSE posted an SPRS score of 104 in January 2021. A consultant later put the real score at -142, and MORSE did not update SPRS until June 2023, after a government subpoena.
The case came from inside
The suit was a qui tam action brought by an insider. The whistleblower received $851,000 of the settlement.
Employees who know a cybersecurity claim is untrue can report it, and the False Claims Act pays them to do so.
Why it matters for Level 1
The MORSE case involved NIST SP 800-171 controls, not Level 1. The mechanism carries over, though.
A Level 1 affirmation in SPRS is a statement to the government. If the 15 safeguards are not really in place, the affirming official has signed something inaccurate.
The 15 Level 1 safeguards, grouped by domain
FAR 52.204-21(b)(1) lists them as items (i) to (xv). Read them and count how many depend on a person making the right call.
- AC · i to iv Access control Only authorised users and devices, limited functions, checked external connections, and control over what gets posted publicly.
- IA · v to vi Identification and authentication Know who or what is connecting, and verify it before granting access.
- MP · vii Media protection Sanitize or destroy media holding FCI before it is thrown out or reused.
- PE · viii to ix Physical protection Restrict physical access, escort and monitor visitors, keep access logs.
- SC · x to xi System and communications protection Monitor network boundaries and keep public-facing systems on separate subnetworks.
- SI · xii to xv System and information integrity Fix flaws quickly, run malware protection, keep it updated, scan external files.
No awareness-training item appears in this list. The Awareness and Training domain begins at Level 2.
How a Level 1 self-assessment works
What the rule asks of a Level 1 contractor, and who signs for it.
01 Stage 1: Confirm you hold FCI, not CUI
FCI is information provided by or generated for the government under a contract that is not intended for public release. If you only handle FCI, Level 1 is your likely target.
If you also handle CUI, the solicitation will usually require Level 2, and the training requirements change.
02 Stage 2: Scope the systems that touch FCI
The assessment covers the information systems that process, store or transmit FCI. That includes email, file shares and laptops used on the contract.
People who use those systems are in scope for the behaviours the safeguards depend on.
03 Stage 3: Score all 15 requirements as MET
32 CFR 170.15 requires a MET result on every Level 1 requirement. No plans of action and milestones (POA&Ms) are allowed at Level 1.
The assessment uses NIST SP 800-171A objectives, with FCI read in place of CUI.
04 Stage 4: Post results in SPRS and affirm
Results go into the Supplier Performance Risk System (SPRS). A senior affirming official confirms compliance for the in-scope systems.
Under the DFARS clause, that affirmation is renewed annually, or sooner when your compliance status changes.
05 Stage 5: Repeat every year and keep the evidence
The self-assessment is repeated annually to keep Level 1 (Self) status. 32 CFR 170.15 also asks you to retain evidence artifacts for six years from the CMMC Status Date.
Training records are among the easiest artifacts to keep in order, if the cycle is automated.
06 Training that backs the affirmation
Train for the safeguards people can break. A staff member who posts a contract document to a public site breaks item (iv). One who shares a login breaks items (v) and (vi).
The same goes for visitors and media. Letting a visitor wander breaks item (ix), and binning a drive full of FCI breaks item (vii).
Keep it short and yearly. A 12-month cycle mirrors the SPRS affirmation, so the training record and the affirmation describe the same period.
Interactive scenarios beat a slide deck here, because the habits in question (checking a sender, challenging a stranger at the door) are actions, not facts.
Plan for Level 2. NIST SP 800-171 3.2.1 to 3.2.3 require security awareness for all users, role-based training, and insider threat awareness.
A Level 1 program that already runs yearly with per-person records is a sound base to extend.
The CMMC Level 1 path, as staff see it
Eight courses in one learning path, assigned again every 12 months so the record lines up with your annual affirmation.
- Eight steps
- From security policy and phishing to device security, workplace security and incident reporting.
- Yearly cycle
- The path recurs every 12 months, the same rhythm as the SPRS affirmation.
- Proof per person
- PDF certificates, a tenant CSV and a compliance report page, with Vanta or Drata sync.
Level 1 safeguards, matched to exercises
Pick the scenarios that test the safeguards your staff can break by accident: public posting, credentials, visitors and media.
AC.L1-3.1.1 Limit System Access AC.L1-3.1.20 / 3.1.22 External Connections & Public Systems IA.L1-3.5.1 / 3.5.2 Identify & Authenticate Users MP.L1-3.8.3 Media Sanitization & Protection PE.L1-3.10.1 / 3.10.3 Physical Access & Visitor Control SI.L1-3.14.1 / 3.14.2 Identify Malicious Code SI.L1-3.14.5 Periodic Scans & Updates Level 1 safeguards that depend on people
Where staff behaviour decides whether a Level 1 safeguard holds.
Item (iv): control what gets posted publicly
FCI is by definition not meant for public release. Staff need to recognise contract details before they post them on social media, a public repository or a shared link.
The Protecting Sensitive Information course covers what counts as sensitive and where it may go.
Items (v) and (vi): identify and authenticate
Shared accounts and reused passwords undo authentication. Phishing undoes it faster, by handing credentials to someone else.
The Passwords & Account Security and Phishing & Impersonation courses cover both routes.
Item (vii): sanitize or destroy media
A laptop sent for recycling or a USB drive left in a drawer can still hold FCI.
Device Security covers what to do with old media and why an unknown USB drive should never be plugged in.
Items (viii) and (ix): physical access and visitors
Badge readers do not stop someone who follows an employee through the door. Escort and logging rules only work if staff apply them.
Workplace Security covers tailgating, unescorted visitors and clean desks.
Items (xii) to (xv): flaws and malicious code
Patching and antivirus are mostly IT jobs. Staff still decide whether to delay an update, open an attachment from outside, or download a tool from an unknown site.
Web & Browser Safety and Device Security cover those choices.
Reporting: how the safeguards get checked
An affirmation is only as good as what the official hears. Staff who report a lost laptop or a suspicious login give you the chance to fix it before you affirm.
The Incident Reporting course closes the path for that reason.
Recommended exercises
Short scenarios for the people who handle FCI every day.
- Social Media Oversharing Item (iv): contract details have a way of leaking through a proud post about a new award. Try the exercise
- Phishing Items (v) and (vi): a harvested password defeats authentication without touching a firewall. Try the exercise
- Password Manager Habits Unique credentials per user, so identification means something. Try the exercise
- MFA Setup Best Practices Stronger authentication for the accounts that open FCI. Try the exercise
- USB Drop Attack Items (vii) and (xv): unknown media and files from outside the network. Try the exercise
- Unescorted Visitors Item (ix): the escort rule, practised at the moment it is easiest to skip. Try the exercise
- Visitor Sign-In Gaps Item (ix) again: the physical access log only works if every visitor is in it. Try the exercise
- Clean Desk Basics Item (viii): printed FCI on a desk is physically accessible to anyone passing. Try the exercise
- General Incident Reporting Gets problems to the affirming official before the yearly SPRS entry. Try the exercise
Further reading
Related glossary terms
References
- Cybersecurity Maturity Model Certification (CMMC) Program, final rule (89 FR 83092) Federal Register via govinfo
- DFARS: Assessing Contractor Implementation of Cybersecurity Requirements, final rule (90 FR 43560) Federal Register via govinfo
- 48 CFR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems Cornell Legal Information Institute (eCFR text)
- 32 CFR 170.3 Applicability (phased implementation) Cornell Legal Information Institute (eCFR text)
- 32 CFR 170.14 CMMC model Cornell Legal Information Institute (eCFR text)
- 32 CFR 170.15 CMMC Level 1 self-assessment Cornell Legal Information Institute (eCFR text)
- NIST SP 800-171 Rev. 2, Protecting CUI in Nonfederal Systems NIST
- Defense Contractor MORSECORP Inc. Agrees to Pay $4.6 Million to Settle Cybersecurity Fraud Allegations U.S. Department of Justice
Give the affirming official something to stand on
A yearly training record for everyone who touches FCI, ready before the SPRS entry is due.
Frequently asked questions
What is CMMC security awareness training?
CMMC Level 1 covers any defense contractor that handles Federal Contract Information. A senior official must affirm compliance in SPRS every year, and DOJ has already settled False Claims Act cases over inaccurate cybersecurity claims. Training is how the 15 safeguards survive contact with real staff.
Does CMMC Level 1 require security awareness training?
No. Level 1 consists of the 15 requirements in FAR 52.204-21(b)(1), and none of them is a training requirement. The Awareness and Training domain appears at Level 2, through NIST SP 800-171 3.2.1 to 3.2.3.
Training still matters at Level 1, because several safeguards (public posting, authentication, visitors, media disposal) depend on staff behaviour.
What training does CMMC Level 2 require?
Level 2 adopts NIST SP 800-171 Rev. 2. Its Awareness and Training family has three requirements: make users aware of security risks and the applicable policies, train staff for their security roles, and provide awareness training on recognising and reporting insider threat indicators.
How often is a Level 1 self-assessment done?
Every year. 32 CFR 170.15 requires an annual self-assessment, with results in SPRS and an affirmation from a senior official. The DFARS clause also requires a fresh affirmation when your compliance status changes.
When does CMMC appear in my contracts?
The DFARS rule took effect on 10 November 2025, starting Phase 1. Phase 2, which adds Level 2 third-party certification, begins one year later on 10 November 2026.
Phases 3 and 4 follow at one-year intervals. After full implementation, CMMC applies to all contracts that involve FCI or CUI, except those solely for COTS items.
Can a false CMMC affirmation lead to a False Claims Act case?
The Department of Justice has already settled False Claims Act cases over inaccurate cybersecurity claims by defense contractors. In 2025, MORSECORP paid $4.6 million after reporting an SPRS score far higher than its real one.
A CMMC affirmation is a similar statement to the government. Get legal advice on your own exposure.
Is a plan of action allowed at Level 1?
No. 32 CFR 170.15 states that no POA&Ms are permitted for Level 1. All 15 requirements must be MET before you can claim Level 1 (Self) status.