Compliance
San Diego, CA
Your firewall blocked the malware. Your antivirus flagged the suspicious file. Then an employee clicked a spoofed "HR" email and handed an attacker the credentials that bypassed all of it. Security awareness training CMMC compliance San Diego defense contractors need isn't a soft skill initiative — it's an auditable control with documented evidence requirements.
Why CMMC 2.0 Treats Your Employees as a Security Control — Not Just End Users
CMMC 2.0 Level 2 includes an Awareness and Training (AT) domain with controls AT.2.056 and AT.2.057, both derived from NIST SP 800-171. These controls are directly assessed during a C3PAO audit — they are not assumed to exist because you have an IT department.
Most San Diego defense contractor SMBs invest heavily in technical controls — MFA, encryption, endpoint detection — while leaving their AT domain undocumented. A machinist handling Controlled Unclassified Information (CUI) who has never been formally trained on phishing recognition or data handling can generate a Plan of Action and Milestones (POA&M) or an outright failing result. For machine shops handling CUI, that gap alone can cost certification.
What CMMC Auditors Actually Look for in Your Security Training Program
A C3PAO auditor assessing AT domain controls expects four evidence categories: a written training policy, individual employee completion records, role-based content for CUI handlers, and documented periodic refreshers. A one-time onboarding video satisfies none of these requirements.
Common Evidence Gaps That Generate AT Domain Findings
- Written training policy: Must exist as a standalone document, not embedded in a general employee handbook.
- Individual completion records: Each employee's training must be logged by name and date — aggregate counts are insufficient.
- Role-based content: Personnel with CUI access require training specific to data handling obligations, not the same module served to all staff.
- Periodic refresher documentation: Evidence of recurring training cycles, not a single onboarding event.
Pointing an auditor to a Microsoft 365 configuration page or an all-hands email is not proof of training. AT controls are among the most frequently misunderstood during readiness assessments because contractors confuse general awareness with a documented, repeatable program.
The Five Threats a Well-Trained Workforce Stops Before They Escalate
Five attack vectors common in San Diego's defense industrial base are primarily mitigated by trained employee judgment — not technical controls alone. Each relies on human behavior as the final decision point, which is why IT support built for defense contractors must include workforce training as a core component.
- Spear phishing targeting DoD contract personnel: Attackers reference specific program names or prime contractor personnel. A spam filter cannot evaluate context the way a trained employee can.
- Pretexting calls impersonating prime contractors: A caller demands urgent credentials from a subcontractor's program manager. No firewall intercepts a phone call.
- USB drop attacks in shared facilities: Infected drives left at Escondido or Chula Vista supplier sites exploit curiosity. Recognition stops the act before insertion.
- Credential harvesting via fake VPN login pages: Pixel-perfect portal replicas capture credentials before MFA is reached. Trained users spot URL anomalies automated tools miss.
- Insider mishandling of CUI on personal devices or unapproved cloud storage: Emailing a file to personal Gmail is a CUI breach regardless of intent. Training makes policy real at the moment of decision.
What a CMMC-Ready Security Awareness Training Program Actually Looks Like
A program built to satisfy CMMC 2.0 AT domain requirements has five components: baseline training, role-specific modules, simulated phishing campaigns, SSP-documented completion records, and annual refresher cycles with version-controlled policy acknowledgments.
Platform Subscription vs. Compliance-Integrated Program
| Element | Generic LMS Subscription (e.g., KnowBe4 standalone) | ITS Team CMMC-Integrated Program |
|---|---|---|
| Training content | Off-the-shelf modules | Modules aligned to NIST 800-171 AT requirements |
| Completion records | Platform certificate only | Records stored in and referenced by the SSP |
| Policy wrapper | None provided | Written training policy drafted and version-controlled |
| Audit trail | No C3PAO-ready documentation | Pre-assessment evidence package for AT.2.056 and AT.2.057 |
| SSP integration | Not included | Training schedule and records mapped to SSP entries |
A generic cybersecurity services subscription hands a contractor a completion certificate. ITS Team builds the documentation layer — the part that gets you through the C3PAO audit.
How Security Awareness Training Connects to the Rest of Your CMMC Compliance Program
Security awareness training must be linked to your System Security Plan (SSP), Incident Response plan, Access Control policies, and Configuration Management procedures. Training that exists in isolation will not satisfy a C3PAO auditor even if employees completed every module.
An SSP that states employees are trained not to store CUI in personal OneDrive accounts — but carries no training record — will be marked non-compliant. The policy says one thing; the evidence says nothing. ITS Team's CMMC compliance services in Southern California cover policy drafting, training, and pre-assessment preparation so AT domain controls are built into the broader compliance roadmap.
Why San Diego Defense Contractors Cannot Afford to Treat Training as an Afterthought
DFARS 252.204-7021 makes CMMC certification a contract requirement — an AT domain finding during a C3PAO audit can delay or deny certification, costing a contractor the ability to bid on covered DoD contracts.
First-try certification with zero POA&Ms is achievable when every domain — including training — is fully addressed before the auditor arrives. San Diego's defense industrial base spans Carlsbad, Escondido, Oceanside, and Chula Vista, and CMMC enforcement is extending further down the supply chain. Aerospace and naval contractors in the San Diego region and their subcontractors — even those handling CUI briefly in a supporting role — face the same AT domain requirements as primes. Treating phishing awareness training as optional is no longer viable.
Frequently Asked Questions
Is security awareness training required for CMMC 2.0 Level 2 certification?
Yes. CMMC 2.0 Level 2 includes AT domain controls AT.2.056 and AT.2.057 derived from NIST SP 800-171. A C3PAO auditor will directly assess these controls and expect documented evidence — a verbal confirmation or general IT policy does not satisfy the requirement.
What documentation do I need to prove my employees completed CMMC security training?
You need a written training policy, individual completion records by name and date, role-specific content records for CUI handlers, and evidence of recurring refresher cycles — all referenced in your System Security Plan. A platform-generated certificate without SSP integration is not sufficient for a C3PAO audit.
How often does security awareness training need to happen to satisfy CMMC requirements?
CMMC AT domain controls require periodic, recurring training — not a one-time event. Annual refresher cycles with documented completion records are the baseline. Role-based content for CUI handlers may warrant more frequent updates when policies or threat conditions change.
Can I use an off-the-shelf platform like KnowBe4 for CMMC training and still pass a C3PAO audit?
A platform like KnowBe4 can provide training content, but it does not produce the policy documentation, SSP integration, or role-based evidence records a C3PAO auditor requires. Without a compliance-integrated documentation layer, a standalone subscription is unlikely to satisfy AT domain controls on its own.
Find Out If Your Employee Training Program Would Survive a CMMC Audit
In a free consultation, ITS Team will review your current training posture against CMMC 2.0 AT domain requirements and show you exactly what documentation gaps would put your certification — and your contracts — at risk.
Schedule Your Free Consultation
