CMMC and NIST SP 800-171
Insider Threat Awareness
Recognize and report the indicators that protect your colleagues, your company and controlled information
Awareness · 1.5 hours · Certificate valid 12 months
The person who causes the most damage to a defense supplier is often already inside: an employee, a contractor or a trusted partner with a badge and a login. Sometimes they mean harm. More often they are careless, pressured or tricked. This course teaches you what an insider threat is, what the early signs look like, why the controls you live with every day exist, and how to report a concern in a way that protects everyone, including the person you are worried about.
You will learn the difference between malicious, negligent and compromised insiders, why controlled unclassified information and export-controlled data make defense suppliers a target for foreign intelligence and competitors, and what NIST SP 800-171 Rev 2 requirement 3.2.3 and the CMMC Awareness and Training domain expect of you. The indicators module covers behavioural and technical warning signs and the equally important caution against profiling or acting on a single sign.
The controls module explains least privilege, separation of duties, access reviews, onboarding and offboarding, removable media rules, monitoring and acceptable use, so that you understand them as protection rather than friction. The reporting module tells you whom to tell, what to include, how confidentiality and non-retaliation work, and walks through realistic scenarios with a decision in each.
This is awareness-level training for every employee of a company that handles federal contract information or CUI. Companies with a facility clearance must give every cleared employee insider threat awareness training before access to classified information and every year after that (32 CFR 117.12(g)), under a programme run by their insider threat programme senior official. This course is written around CUI rather than classified information and does not by itself satisfy that requirement unless your programme official accepts it as part of the programme. It is not legal advice; follow your company's procedures and your security officer. The course closes with a 10-question examination drawn from a bank of 20. On passing you receive a PlanetISO Certificate of Completion with lifetime access to the course. The certificate is valid for 12 months, to match an annual refresher cycle.
What people learn
- Define insider threat and distinguish malicious, negligent and compromised insiders with examples from a defense supplier.
- Explain why CUI and export-controlled data make insiders valuable to foreign intelligence services and competitors.
- State what NIST SP 800-171 Rev 2 requirement 3.2.3 and the CMMC Awareness and Training domain require.
- Recognise behavioural and technical indicators of potential insider threat and explain why no single sign is proof.
- Describe the purpose of least privilege, separation of duties, access reviews, offboarding, removable media rules and monitoring.
- Report a concern through the correct path with the right facts, and explain how confidentiality and non-retaliation apply.