Group Leader FAQ

Quick Answers for CMMC Group Leader

Awareness & Training (AT) Domain

This page is for Group Leaders and Administrators responsible for assigning, tracking, and maintaining CMMC Awareness & Training for their organization.

  • No. You manage training assignments and records — not certification.

  • Yes, when training is completed, tracked, and retained.

  • Anyone who handles or may encounter FCI or CUI.

  • Annually

  • Yes — and you should do it quarterly.

  • No. Training is one required component.

Group Leader Responsibilities

    • Assigning required AT training

    • Monitoring completion

    • Retaining training records as evidence

    • Assigning training to new hires

    • Supporting annual refresher training

      You are not responsible for:

      • Certifying compliance

      • Performing technical security work

      • Writing SSPs or policies

  • This training provides awareness for:

    • Federal Contract Information (FCI)

    • Controlled Unclassified Information (CUI)

    • ITAR (awareness level)

    It supports CMMC requirements but does not replace formal compliance programs.

  • Training records typically include:

    • User names

    • Completion dates

    • Course titles

    • Completion reports or certificates

    These records support:

    • CMMC assessments

    • Prime contractor requests

    • Internal and external audits

  • Training platforms are tools — records are evidence.

    Best practice:

    • Download records every quarter

    • Store them outside the platform

    • Retain them per contract or policy

    If you can’t produce records quickly, they don’t exist to an assessor.

  • Group Leaders should:

    • Assign training to new hires promptly

    • Remove users who no longer need access

    • Reassign seats as needed

    • Include subcontractors when they handle FCI or CUI

  • This training does:

    • Support CMMC AT requirements

    • Reduce organizational risk

    • Demonstrate due diligence

    This training does not:

    • Certify CMMC compliance

    • Replace SSPs or policies

    • Implement technical controls

  • ☐ Assign required training
    ☐ Monitor completion
    ☐ Download training records
    ☐ Store records securely
    ☐ Schedule annual refreshers

  • ☐ Download all training records
    ☐ Verify records are complete
    ☐ Transfer access to successor
    ☐ Store records in compliance repository

  • New employee:
    Assign training → confirm completion → include in quarterly records

    Annual refresher:
    Reassign training → track completion → download updated records

    Assessment prep:
    Download records → verify coverage → provide to assessor or prime