Insider Threat Awareness

frameworkCMMC Level 2 sectionAT Awareness and Training csf 2.0DE.CM-03 GV.RR-04 PR.AT-01 topicsAwareness & Training, Insider Threat frameworks7 3 2

Official textProvide security awareness training on recognizing and reporting potential indicators of insider threat.NIST SP 800-171 Rev 2 requirement, the basis of the CMMC Level 2 practice (public domain)

gap from CMMC → gap to CMMC →

Wrong or missing mapping? Report it

Equivalents of AT.L2-3.2.3 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	PR.AT-01 PR.AT-02 DE.CM-03 GV.RR-04	Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind; Individuals in specialized roles are provided with awareness and training so that they possess the knowledge and skills to perform relevant tasks with cybersecurity risks in mind…	Crosswalk	Same topic: Awareness & Training, Insider Threat
ISO 27001	A.6.3 Clause 7.3 A.6.1 A.6.4 A.8.16	Information security awareness, education and training; Awareness…	Crosswalk	Same topic: Awareness & Training, Insider Threat 7 loosely related (not mappings) A.6.2 Terms and conditions of employment Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.5 Responsibilities after termination or change of employment Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.6 Confidentiality or non-disclosure agreements Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.7 Remote working Loosely related Only shares CSF GV.RR-04: related, not a mapping A.6.8 Information security event reporting Loosely related Only shares CSF GV.RR-04: related, not a mapping A.7.4 Physical security monitoring Loosely related Only shares CSF DE.CM-03: related, not a mapping Clause 9.1 Monitoring, measurement, analysis and evaluation Loosely related Only shares CSF DE.CM-03: related, not a mapping
CIS v8.1	CIS 14.1 CIS 14.9 CIS 14.2 CIS 14.3 CIS 14.4 CIS 14.5 CIS 14.6 CIS 14.7 CIS 14.8	Establish and Maintain a Security Awareness Program; Conduct Role-Specific Security Awareness and Skills Training…	Crosswalk	Same topic: Awareness & Training 4 loosely related (not mappings) CIS 6.1 Establish an Access Granting Process Loosely related Only shares CSF GV.RR-04: related, not a mapping CIS 6.2 Establish an Access Revoking Process Loosely related Only shares CSF GV.RR-04: related, not a mapping CIS 10.7 Use Behavior-Based Anti-Malware Software Loosely related Only shares CSF DE.CM-03: related, not a mapping CIS 13.6 Collect Network Traffic Flow Logs Loosely related Only shares CSF DE.CM-03: related, not a mapping
SOC 2	CC1.4 CC2.2	Commitment to attracting, developing and retaining competent people; Internal communication of objectives and responsibilities	Editorial	Same topic: Awareness & Training (editorial pick) 1 loosely related (not mappings) CC7.2 Monitoring system components for anomalies Loosely related Only shares CSF DE.CM-03: related, not a mapping
PCI DSS	12.6.1 12.6.3 10.2.1 12.7.1	Formal security awareness programme; Awareness training on hire and at least annually…	Crosswalk	Same topic: Awareness & Training, Insider Threat 6 loosely related (not mappings) 7.2.2 Access assigned by job function and least privilege Loosely related Only shares CSF GV.RR-04: related, not a mapping 8.2.2 Shared or generic accounts only by documented exception Loosely related Only shares CSF DE.CM-03: related, not a mapping 8.2.5 Access revoked immediately on termination Loosely related Only shares CSF GV.RR-04: related, not a mapping 9.3.1.1 Sensitive-area access authorised and revoked promptly Loosely related Only shares CSF GV.RR-04: related, not a mapping 10.4.1 Security event and critical logs reviewed daily Loosely related Only shares CSF DE.CM-03: related, not a mapping 10.6.1 System clocks synchronised Loosely related Only shares CSF DE.CM-03: related, not a mapping
800-53	AT-2 AT-3 AC-2(12)AU-13 PM-12	Literacy Training and Awareness; Role-based Training…	Crosswalk	Same topic: Awareness & Training, Insider Threat 8 loosely related (not mappings) AC-2 Account Management Loosely related Only shares CSF DE.CM-03: related, not a mapping AU-12 Audit Record Generation Loosely related Only shares CSF DE.CM-03: related, not a mapping CA-7 Continuous Monitoring Loosely related Only shares CSF DE.CM-03: related, not a mapping CM-10 Software Usage Restrictions Loosely related Only shares CSF DE.CM-03: related, not a mapping CM-11 User-installed Software Loosely related Only shares CSF DE.CM-03: related, not a mapping PM-13 Security and Privacy Workforce Loosely related Only shares CSF GV.RR-04: related, not a mapping PS-7 External Personnel Security Loosely related Only shares CSF GV.RR-04: related, not a mapping PS-9 Position Descriptions Loosely related Only shares CSF GV.RR-04: related, not a mapping
HIPAA	§164.308(a)(5)§164.308(a)(5)(ii)(A)§164.308(a)(1)(ii)(C)§164.308(a)(3)(ii)(B)	Security Awareness and Training; Security Reminders…	Crosswalk	Same topic: Awareness & Training, Insider Threat 20 loosely related (not mappings) §164.308(a)(5)(ii)(B) Protection from Malicious Software Loosely related Only shares CSF PR.AT-01: related, not a mapping §164.308(a)(5)(ii)(C) Log-in Monitoring Loosely related Only shares CSF PR.AT-01: related, not a mapping §164.308(a)(5)(ii)(D) Password Management Loosely related Only shares CSF PR.AT-01: related, not a mapping §164.308(a)(3)(ii)(A) Authorization and/or Supervision Loosely related Only shares CSF DE.CM-03, GV.RR-04: related, not a mapping §164.308(a)(4)(ii)(B) Access Authorization Loosely related Only shares CSF DE.CM-03, GV.RR-04: related, not a mapping §164.308(a)(1)(ii)(D) Information System Activity Review Loosely related Only shares CSF DE.CM-03: related, not a mapping §164.308(a)(3) Workforce Security Loosely related Only shares CSF DE.CM-03: related, not a mapping §164.308(a)(3)(ii)(C) Termination Procedures Loosely related Only shares CSF GV.RR-04: related, not a mapping …and 12 more in the downloads
GDPR	Art.29 Art.32(4)Art.39(1)(b)	Processing under the authority of the controller or processor; Security of processing…	Editorial	Same topic: Insider Threat, Awareness & Training (editorial pick)
NIS2	8.1 8.2 10.2 10.4	Awareness raising and basic cyber hygiene practices; Security training…	Crosswalk	Same topic: Awareness & Training, Insider Threat 2 loosely related (not mappings) 10.1 Human resources security Loosely related Only shares CSF GV.RR-04: related, not a mapping 10.3 Termination or change of employment procedures Loosely related Only shares CSF GV.RR-04: related, not a mapping
Essential Eight	ISM-0109 ISM-1906 ISM-1907	Event logs from workstations are analysed in a timely manner to detect cyber security…; Event logs from internet-facing servers are analysed in a timely manner to detect cyber……	Loosely related	No mapping. Only shares CSF DE.CM-03: related, not a mapping
DORA	Art.5(4)Art.10(3)Art.13(6)	Governance and organisation; Detection…	Editorial	Same topic: Awareness & Training, Insider Threat (editorial pick) 1 loosely related (not mappings) Art.9(1) Protection and prevention Loosely related Only shares CSF DE.CM-03: related, not a mapping
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.