If you cannot find information about a compliance topic, please contact us for free support.
CMMC Training Documentation and Evidence
Having a great training program is not enough for CMMC compliance. You must prove it exists and operates effectively. Assessors verify your Awareness and Training controls through documentation and evidence, not just your word that training happens.
CMMC stands for Cybersecurity Maturity Model Certification—the DoD’s mandatory cybersecurity program for defense contractors.
This guide details exactly what documentation assessors expect and how to organize your training evidence for a smooth assessment.
What Assessors Are Looking For
CMMC assessors evaluate three Awareness and Training requirements. For each, they verify:
Existence
Does the training program exist? Is there documented content, policy, and structure?
Implementation
Is the program actually operating? Are people completing training?
Effectiveness
Does training achieve its goals? Do people pass assessments? Does behavior improve?
Documentation and evidence must address all three aspects for each requirement.
Documentation Categories
Organize your training documentation into these categories:
1. Training Policy
A formal document establishing your training program requirements:
What to include:
- Purpose and scope of the training program
- Roles required to complete training
- Training topics required (general awareness, role-based, insider threat)
- Timing requirements (initial, annual, triggered)
- Assessment and passing requirements
- Consequences for non-completion
- Responsibilities for program management
- Records retention requirements
Format: Formal policy document, reviewed and approved by management, with effective date and version control.
2. Training Plan or Curriculum
Documentation of what training covers and how it is structured:
What to include:
- Training modules and their objectives
- Topics covered in each module
- Duration of each training element
- Delivery method (online, in-person, self-study)
- Assessment approach for each module
- Role-based training assignments
- Training calendar or schedule
Format: Training plan document, curriculum outline, or learning management system configuration documentation.
3. Training Materials
The actual content used for training:
What to retain:
- Presentation slides
- Training videos or recordings
- Handouts and reference materials
- Quiz questions and answer keys
- Scenario exercises
- Acknowledgment forms
Format: Electronic files organized by training module and version. Retain historical versions to show what training was delivered at specific times.
4. Completion Records
Evidence that individuals completed required training:
What to capture:
- Employee name
- Training module completed
- Completion date
- Assessment score (if applicable)
- Instructor (for live training)
- Acknowledgment signature
Format: Training management system reports, sign-in sheets, certificates of completion, or training database exports.
5. Assessment Records
Evidence that knowledge was verified:
What to retain:
- Quiz or test results by individual
- Passing scores and any retakes
- Phishing simulation results
- Practical assessment outcomes
Format: Learning management system reports, quiz score exports, phishing simulation platform reports.
Evidence Mapping to Requirements
Map your documentation to specific CMMC requirements:
AT.L2-3.2.1: Security Awareness
| Evidence Type | Example |
|---|---|
| Policy | Training policy requiring security awareness for all users |
| Content | General awareness training materials covering security risks |
| Completion | Records showing all users completed awareness training |
| Assessment | Quiz results demonstrating comprehension |
AT.L2-3.2.2: Role-Based Training
| Evidence Type | Example |
|---|---|
| Policy | Policy identifying roles with security responsibilities |
| Role mapping | Document assigning training requirements to roles |
| Content | Training materials for each identified role |
| Completion | Records showing individuals completed role-specific training |
| Assessment | Role-specific assessment results |
AT.L2-3.2.3: Insider Threat Awareness
| Evidence Type | Example |
|---|---|
| Policy | Policy requiring insider threat training |
| Content | Training materials covering insider threat indicators |
| Reporting procedures | Documentation of how to report concerns |
| Completion | Records showing insider threat training completion |
| Assessment | Quiz results on insider threat topics |
Sample Documentation Package
A well-organized training documentation package might include:
/Training Documentation
├── Policies
│ └── SEC-POL-003 Security Awareness Training Policy v2.1.pdf
├── Training Plan
│ └── Annual Training Curriculum 2025.pdf
│ └── Role-Based Training Matrix.xlsx
├── Training Materials
│ ├── General Awareness
│ │ └── Security Awareness 2025.pptx
│ │ └── Security Awareness Quiz.pdf
│ ├── Role-Based
│ │ └── IT Administrator Security Training.pptx
│ │ └── CUI Handler Training.pptx
│ │ └── Manager Security Oversight.pptx
│ └── Insider Threat
│ └── Insider Threat Awareness.pptx
│ └── Reporting Procedures Reference.pdf
├── Completion Records
│ └── Training Completion Report Q1-2025.xlsx
│ └── Training Completion Report Q2-2025.xlsx
│ └── Annual Training Completion Summary 2024.pdf
├── Assessment Records
│ └── Quiz Score Summary 2025.xlsx
│ └── Phishing Simulation Results 2025.pdf
└── Acknowledgments
└── Signed Acknowledgment Forms (by employee)Using a Learning Management System
Learning Management Systems (LMS) simplify training documentation:
LMS stands for Learning Management System—software that delivers training content, tracks completion, and generates reports.
Benefits for CMMC:
- Automatic completion tracking
- Built-in quiz and assessment capability
- Reporting for assessors
- Version control for content
- Assignment by role or group
- Deadline enforcement
Selecting an LMS:
When choosing an LMS for CMMC training:
- Ensure it can generate completion reports by individual
- Verify it tracks assessment scores
- Confirm it retains historical data for your retention period
- Check that reports include dates and specific training completed
Even with LMS:
Still maintain documentation outside the system:
- Exported reports (in case of system changes)
- Policy documents
- Training materials (for reference)
- Evidence of in-person training (sign-in sheets)
Records Retention
Retain training documentation appropriately:
Minimum Retention
Keep training records for at least three years, covering the CMMC certification period plus time for any disputes or audits.
Contract Requirements
Some contracts specify longer retention periods. Check your contracts for specific requirements.
What to Retain
- All completion records
- Assessment results
- Training materials (by version)
- Policies (by version)
- Evidence of program reviews and updates
Secure Storage
Protect training records appropriately:
- Restrict access to HR and security personnel
- Back up electronic records
- Protect from unauthorized modification
Preparing for Assessment
Before your CMMC assessment:
Gather Documentation
Compile all training evidence into an organized package that assessors can review.
Verify Completeness
Check that:
- All personnel have completion records
- Role-based training is documented by role
- Insider threat training is specifically documented
- Assessment scores are available
- Policy is current and approved
Prepare to Demonstrate
Be ready to show assessors:
- How training is assigned and tracked
- Sample completion records
- How assessments verify knowledge
- How the program is reviewed and updated
Identify Gaps
Before assessment, verify:
- Everyone required has completed training
- All roles have appropriate training defined
- Documentation is complete and current
- No one is overdue for refresher training
Common Documentation Mistakes
Mistake 1: No Written Policy
Verbal training requirements are not sufficient. Document your policy formally.
Mistake 2: Missing Completion Records
If you cannot prove someone completed training, they effectively did not complete it. Track completions meticulously.
Mistake 3: Generic Records Without Specifics
“Completed security training” is too vague. Records should show specific modules and dates.
Mistake 4: No Role-Based Evidence
Showing everyone completed the same training does not demonstrate role-based training. Document role-specific completion.
Mistake 5: Outdated Materials
Training materials from three years ago may not reflect current threats or policies. Keep materials current and document updates.
Mistake 6: No Assessment Evidence
Completion without assessment does not demonstrate knowledge transfer. Include quiz or test results.
Key Takeaways
CMMC assessors verify training through documentation, not observation. Maintain formal policy, documented curriculum, training materials, completion records, and assessment results for all three Awareness and Training requirements.
Organize documentation clearly and map evidence to specific requirements. Use a learning management system to simplify tracking, but maintain exported records outside the system.
Prepare documentation packages before assessment and verify completeness. Gaps in training documentation are gaps in compliance evidence.
Free tools
Get to an honest number faster
You will run this more than once: after any material change to your environment, and again before every annual affirmation. Both are free, and both are yours to keep.
Neither is a certified assessment, and neither pretends to be.
The audit is gone. The liability isn't.
Greypike runs the environment your CUI lives in and owns the compliance outcome that proves it's protected. If you are not certain your environment supports the score sitting in SPRS next to your CAGE code, that is the conversation to have.
Talk to Greypike about SPRS Attestation Assurance