NIST 800-171 Controls · Awareness & Training
AT.2.002 — Role-Based Security Training
Ensure that personnel are trained to carry out their assigned information security responsibilities.
What AT.2.002 means in plain English
Certain people in your shop have bigger security jobs than others. Whoever manages your network, sets up Windows computers, or administers your file server needs hands-on training beyond the general awareness session—they should know how to configure Windows firewall, manage user accounts, and respond if something looks wrong. Even in an 8-person shop this might just be you (the owner) or a part-time IT person. Document what they know and how they learned it.
The assessment question
“Has every person with elevated system privileges or IT responsibilities received role-specific security training appropriate to their duties, with documentation on file?”
How to implement AT.2.002
- Identify every role that has security responsibilities: system administrator (installs software, manages accounts), IT administrator (network/firewall), and any backup administrator. In a small shop these may all be one person.
- For each role, list the specific security tasks they perform—e.g., "creates/removes Windows user accounts," "reviews Windows Event Viewer weekly," "applies Windows Update patches monthly."
- Match each task to a free training resource. Microsoft Learn (learn.microsoft.com) offers free courses on Windows Server administration, Azure, and security fundamentals. CompTIA Security+ study materials cover most topics.
- Have each role-holder complete at least one relevant training module per year and save the completion certificate to your CMMC evidence folder.
- Document a "Role-Based Training Matrix": a simple spreadsheet with columns for Role, Person, Training Completed, Date, and Certificate File Name.
Evidence your assessor will ask for
- Role-based training matrix listing each privileged/IT role, the person filling it, training completed, and date
- Training completion certificates or screenshots for each role-holder
- Job descriptions or role descriptions documenting security responsibilities
- Records showing newly hired personnel with IT roles received training before being granted access
Does AI prompt monitoring help with this control? Honestly, no.
AT.2.002 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.
Full mapping: which 800-171 controls AI prompt monitoring evidences →
More Awareness & Training controls
Score yourself against all 110 controls
The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.