CMMC and NIST SP 800-171
Phishing and Email Security
Spot the message that is trying to trick you, and know exactly what to do next
Awareness · 1.5 hours · Certificate does not expire
Many cyber incidents at defense suppliers start with one person acting on one message. The message might be an email that looks like it came from your prime contractor, a text that looks like it came from your boss, a QR code on a poster, or a push notification asking you to approve a login you did not start. This course teaches you to recognise each of these and to act safely in the few seconds that matter.
You will learn why small and mid-sized suppliers are targeted for controlled unclassified information, federal contract information and payments, how to inspect a sender, a link and an attachment, and what artificial intelligence has changed about the phishing you now receive. You will practise with realistic scenarios drawn from machine shops, purchasing desks and programme offices, each with a decision to make.
The course is written for every employee of a company that holds or is preparing for a DoD contract. It is awareness-level training that a company can use as part of the security awareness training required by NIST SP 800-171 Rev 2 requirement 3.2.1 and the CMMC Awareness and Training domain. Neither sets a fixed retraining interval; your company decides how often, and many choose yearly. It explains the DFARS 252.204-7012 rapid reporting obligation so that you understand why your company needs to hear from you within minutes, not days. Always follow your own company's procedures and your security officer's direction.
The course closes with a 10-question examination drawn from a bank of 20. On passing you receive a PlanetISO Certificate of Completion with lifetime access to the course content and your certificate. The certificate does not expire.
What people learn
- Explain why defense suppliers are targeted and what attackers want from a phishing message.
- Distinguish spear phishing, whaling, business email compromise, smishing, vishing, QR code phishing, MFA fatigue and consent phishing.
- Inspect a sender address, a link and an attachment and identify the signs of a lookalike or a lure.
- Apply safe habits for multi-factor authentication, passwords, payment changes and handling controlled information in email.
- Decide the correct action in realistic phishing scenarios, including when to stop and verify by a second channel.
- Describe what to do in the first 10 minutes after clicking a bad link or entering a password on a fake page.
- State the internal reporting path and explain how it supports the company's 72-hour DoD reporting obligation.