Awareness and Training (03.02)

The "at" control requires organizations to provide their workforce with basic security awareness and specialized training related to handling Controlled Unclassified Information. Personnel must understand CUI protection policies, recognize security risks, and be instructed on proper reporting and incident response procedures. This ensures that all employees are equipped to safeguard CUI throughout its lifecycle.