NIST 800-171 Controls · Awareness & Training
AT.2.003 — Insider Threat Awareness
Provide security awareness training on recognizing and reporting potential indicators of insider threat.
What AT.2.003 means in plain English
An insider threat is not just a spy movie villain—it is a disgruntled employee copying drawings to a thumb drive before quitting, or a well-meaning machinist who emails a blueprint to his brother at another shop. Your team needs to know the warning signs (coworker downloading unusual amounts of data, accessing files outside their job, talking about financial trouble combined with access to sensitive specs) and exactly how to report it (tell the owner/manager immediately). This is a 30-minute add-on to your annual awareness training.
The assessment question
“Does annual security awareness training include a specific section on insider threat indicators and the process for reporting suspicious behavior?”
How to implement AT.2.003
- Add an "Insider Threat" section to your existing annual training. Cover three categories: (1) unintentional insiders (accidents, mistakes), (2) negligent insiders (ignoring policy), (3) malicious insiders (deliberate theft or sabotage).
- List concrete indicators relevant to your shop: unusual after-hours system access, bulk copying of CUI files to USB, forwarding contract emails to personal accounts, repeated attempts to access areas outside job scope.
- Define your reporting procedure in writing: "If you observe suspicious behavior involving CUI or company systems, immediately notify [Owner Name] in person or at [phone/email]. Do not confront the individual yourself."
- Reference the free CISA Insider Threat resources (cisa.gov/insider-threat-mitigation) and the NITTF (National Insider Threat Task Force) awareness materials—both are free and DoD-aligned.
- Document that this topic was covered in the training sign-off sheet (add a checkbox: "Insider threat indicators and reporting procedures reviewed").
Evidence your assessor will ask for
- Training materials showing an insider threat topic was explicitly covered
- Updated training sign-off sheet with insider threat acknowledgment checkbox
- Written reporting procedure for suspected insider threat incidents
- Evidence that all employees with CUI access attended the training
Does AI prompt monitoring help with this control? Honestly, no.
AT.2.003 is met through the remediation steps above, not through AI traffic controls — an AI prompt firewall neither satisfies nor substitutes for it. We map AI monitoring only to the controls it genuinely evidences (flow control, boundary protection, audit, and incident support); for the full picture of where it does help, see the mapping guide linked below.
Full mapping: which 800-171 controls AI prompt monitoring evidences →
More Awareness & Training controls
Score yourself against all 110 controls
The free ShieldReady assessment walks every NIST 800-171 requirement, computes your SPRS score, and shows exactly which gaps cost the most points.