Security Awareness and Training Policy
Establishes Your Organization's security awareness and role-based training program — new-hire onboarding, annual refreshers, role-specific training, and insider-threat awareness.
Maps to CMMC Level 2 AT.L2-3.2.1 · CMMC Level 2 AT.L2-3.2.2 · CMMC Level 2 AT.L2-3.2.3
Read it now — the PDF opens either way.
Purpose
People are both Your Organization's strongest control and its most targeted attack surface. This policy establishes Your Organization's security awareness and training program, ensuring every workforce member understands their security responsibilities and that individuals in higher-risk roles receive training tailored to the risks they manage.
Scope
This policy applies to all Your Organization workforce members — employees, contractors, and interns — with access to company systems or data, regardless of role or tenure.
8 more sections in the full template
General security awareness · Role-based training · Insider threat awareness · Specialized audiences · Training records · Non-completion · Roles and responsibilities · Review cadence. Download the full document above, or open it in CMDash to fill in your organization name and effective date automatically.
Use this policy for real, not just on paper
“Open in CMDash” pre-selects the Security Awareness and Training Policy template the first time you create a policy — your organization name and today’s date fill in automatically, and it lands as a DRAFT you can edit before publishing.