Ten role-based security awareness courses that satisfy the CMMC Level 2 training requirement, each mapped to the NIST SP 800-171 controls it covers and written for small defense contractors. Editable decks you can brand, customize, and roll out without building a training program from scratch or paying enterprise-suite prices.
Assessors don't just ask whether you train, they ask for records that prove it, per person, against specific requirements. Each course names the CMMC Level 2 controls it satisfies so your employee training maps cleanly to your assessment. Ten courses are ready to deploy today; four more, including administrator and remote-access training, are in development.
| Course | Code | Duration | CMMC Controls |
|---|---|---|---|
| CUI Awareness Training · Free sample | CUI-101 | 45 min | AT.L2-3.2.1, AT.L2-3.2.2 |
| Insider Threat Awareness | INT-101 | 35 min | AT.L2-3.2.3 |
| Media Protection | MED-101 | 20 min | MP.L2-3.8.1, MP.L2-3.8.2 |
| Mobile Device Security | MOB-101 | 25 min | AC.L2-3.1.18, AC.L2-3.1.19 |
| New Employee Security Orientation | NEW-101 | 60 min | AT.L2-3.2.1, PS.L2-3.9.1 |
| Password Security & MFA | PWD-101 | 20 min | IA.L2-3.5.1, IA.L2-3.5.2 |
| Phishing Awareness | PHI-101 | 20 min | AT.L2-3.2.1 |
| Physical Security | PHY-101 | 25 min | PE.L2-3.10.1, PE.L2-3.10.2 |
| Security Awareness Training | SEC-101 | 40 min | AT.L2-3.2.1, AT.L2-3.2.2 |
| Security Incident Reporting | INC-101 | 30 min | IR.L2-3.6.1, IR.L2-3.6.2 |
| Administrator & Privileged User Security · Coming soon | ADM-101 | 40 min | AC.L2-3.1.5, AC.L2-3.1.6, AC.L2-3.1.7 |
| Remote Access & Telework Security · Coming soon | REM-101 | 30 min | AC.L2-3.1.12, AC.L2-3.1.13, AC.L2-3.1.14 |
| Acceptable Use & Software Policy · Coming soon | AUP-101 | 25 min | AC.L2-3.1.20, AC.L2-3.1.21, CM.L2-3.4.8, CM.L2-3.4.9 |
| Sharing CUI Securely · Coming soon | CUI-103 | 30 min | SC.L2-3.13.8, MP.L2-3.8.6 |
Every course targets a specific slice of the CMMC Level 2 employee-training requirement, from CUI training and phishing awareness to incident response training, so you can assign the right course to the right role and prove coverage control by control.
CUI training that teaches employees what Controlled Unclassified Information is, how to recognize it, and the marking, handling, storage, and transmission rules that apply, plus how to report a suspected exposure. The foundation course for any defense contractor handling CUI.
Insider threat training that helps your workforce recognize the behavioral and technical warning signs of insider risk, whether malicious or accidental, and understand their obligation to report concerns through the right channel.
Media protection training covering how to label, store, transport, and sanitize the physical and digital media that holds CUI, including the rules for removable media like USB drives and external disks.
Mobile device security training on protecting the laptops, phones, and tablets that touch CUI: encryption, connection controls, remote access, and acceptable use for devices inside and outside the facility.
New-hire security orientation that onboards employees to their CMMC Level 2 responsibilities from day one: CUI basics, acceptable use, reporting expectations, and the policies they are agreeing to follow.
Password and multi-factor authentication training on building strong credentials, avoiding reuse, and enrolling in MFA, the front-line identity controls assessors expect every user to understand.
Phishing training that teaches employees to spot phishing emails, social-engineering attempts, and malicious links or attachments, and exactly how and when to report them before damage is done.
Physical security training covering visitor control, badging and escort rules, clean-desk practices, and protecting CUI in the physical workspace where digital controls do not reach.
General security awareness training that reinforces the core threats, handling rules, and reporting duties every employee who works with CUI must know. The annual refresher that anchors your AT.L2 program.
Incident response training that teaches employees to recognize a security incident, act quickly, and report it correctly through your incident-response process so nothing goes unreported or mishandled.
Administrator training for the privileged users who run your systems: separating admin accounts from daily-use accounts, applying least privilege, protecting audit logs, and running secure maintenance and remote sessions. The role-based counterpart to your general awareness training, and the evidence assessors expect for privileged users under AT.L2-3.2.2.
Remote access training on how employees connect to CUI systems from outside the facility: approved VPN and remote-access paths, encryption in transit, home-network and public-Wi-Fi hygiene, and the rules for handling CUI while working remotely.
Acceptable use training covering what employees may and may not do on company systems: no unauthorized software, controlling use of external systems and personal devices, restricting portable storage, and following the software allowlist that keeps unapproved programs off CUI systems.
CUI training on how to share and transmit Controlled Unclassified Information without exposing it: encrypted email, approved file-transfer and collaboration tools, and encrypting CUI on any media that leaves the facility. The practical companion to CUI-101 for day-to-day handling.
Not looking for a full platform, just solid, compliant CMMC Level 2 employee training you can run yourself? Get all ten courses for a one-time $799. Enterprise awareness-training libraries routinely run north of $2,000.
Every course in the set: CUI, insider threat, phishing, incident response, media protection, mobile, physical security, passwords, onboarding, and general awareness.
Delivered as editable decks so you can add your logo, security contacts, approved tools, and reporting workflow before you roll them out to staff.
Each course names the exact CMMC Level 2 requirements it satisfies, so your training records line up cleanly with your assessment.
Written around what assessors actually check: documented, role-based training tied to specific controls, not a generic slideshow.
Download the full CUI Awareness deck at no cost and evaluate the production quality before you commit to the set.
New courses (administrator, remote access, acceptable use, and more) are added to the set as they are released, included at no extra cost, so your training stays current with the rule.
Tell us where to send it and we'll get you set up. We follow up to finalize and invoice, no account or checkout required.
Free Resource
Enter your email and the PowerPoint downloads immediately.
Your email is stored so we can follow up about your CMMC training. We never share your data, and you can unsubscribe anytime.