| name | Role-Based Training (03.02.02)_role-based-training |
| description | Provide role-based security training to organizational personnel: Before authorizing access to the system or CUI, before performing assigned duties, a |
| category | configuration |
| version | 3.0 |
| author | cyberstrike-official |
| tags | ["nist","sp800-171","rev3","role-based training (03-02-02)","family-03.02","cui-protection","cmmc"] |
| tech_stack | ["any"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Role-Based Training (03.02.02) Role-Based Training
High-Level Description
Family: Awareness and Training
Framework: NIST SP 800-171 Rev 3
Applicability: Systems processing, storing, or transmitting CUI
Provide role-based security training to organizational personnel:
Before authorizing access to the system or CUI, before performing assigned duties, and [organization-defined] thereafter
When required by system changes or following [organization-defined].
Update role-based training content [organization-defined] and following [organization-defined].
What to Check
How to Test
Step 1: Review System Security Plan
Examine the SSP for Role-Based Training (03.02.02) implementation description and responsible parties.
Step 2: Assess Implementation
# Verify security controls protecting CUI
# Check access controls, encryption, monitoring as applicable
# For Linux systems:
ls -la /etc/security/ 2>/dev/null
grep -r "CUI\|controlled" /etc/security/ 2>/dev/null
# For cloud:
# Use cloud-audit-mcp tools to assess posture
Step 3: CMMC Assessment Validation
Verify this requirement passes CMMC Level 2 assessment methodology per SP 800-171A Rev 3.
Tools
| Tool | Purpose | Usage |
|---|
| cloud-audit-mcp | Assess cloud CUI environment | cloud_audit_* tools |
| Manual Review | SSP and POA&M review | Documentation analysis |
Remediation Guide
Requirement Statement
Provide role-based security training to organizational personnel:
Before authorizing access to the system or CUI, before performing assigned duties, and [organization-defined] thereafter
When required by system changes or following [organization-defined].
Update role-based training content [organization-defined] and following [organization-defined].
Supplemental Guidance
