CMMC training your team truly understands.
Lessons built around the real decisions your people make with Controlled Unclassified Information (CUI), so they engage with the training, take it in, and apply it at work. The records your Level 2 assessment needs are built in.
Already a customer? Sign in to your trainingDownload the brochure (PDF)
- 3 of 3Awareness & Training (AT) requirements supported
- 110Level 2 requirements taught, each cited to NIST SP 800-171
- 7 · 18courses · modules
- 5graded questions per module
- 80%closed-book pass mark
- 12-monthrenewal; test out if you still know it
Training people engage with, take in, and use.
Every lesson is built around a real moment at work: an unexpected email, a visitor at the door, a file that needs sharing. People learn by making those calls, getting them wrong safely, and seeing why.
People engage.
Courses written for each role, a clear view of what is assigned and what comes next, and short lessons that fit the workday. Training feels relevant, so people start it and stay with it.
People take it in.
A first guess about a real situation primes attention. Then one idea at a time, and practice decisions with feedback that explains why. Built on how adults actually learn.
People can apply it.
A closed-book check using new scenarios, the questions an expert asks made explicit, and concrete actions for their own job. Understanding is shown, not assumed.
The Learn-by-Deciding Method.
Five steps designed for understanding, based on Decision-Based Learning and Merrill's First Principles of Instruction. Learners guess first, learn one idea at a time, practice with feedback, show what they know closed book, then apply it to their own job.
Start
A quick, ungraded guess about one or two real situations before reading anything. Guessing first, even wrongly, primes people to notice and keep the answer.
Pretesting effect (Richland et al., 2009); Merrill's activation
Learn
One short chunk of reading at a time. Each module shows its decision path: the three to five questions an expert asks, in order, and the cue that settles each one.
Mayer's segmenting principle; cognitive load theory (Sweller)
Try it
Two to six practice decisions on that chunk, each explained the moment it's answered. The feedback names the decision it exercised and, where it matters, says what would change the answer.
Retrieval practice (Roediger & Karpicke, 2006); feedback (Hattie & Timperley, 2007)
Check
Five closed-book scenario questions, in situations the practice didn't use. 80% to pass, with retakes. The reading is closed, so a pass is evidence of understanding, not just completion.
Mastery learning (Bloom, 1968); scenario-based learning (Clark, 2013)
Put it to work
Two or three concrete actions for their own job this week, so the lesson turns into a "when X, I'll do Y" plan.
Merrill's integration; implementation intentions (Gollwitzer, 1999)
At renewal
A returning learner can take the check first. Pass, and they're done. If not, they work the lesson and try again. It respects what experienced people already know, and keeps renewal focused on understanding.
Adult learning (Knowles)
Make the call.
Real practice items from the Facilities & Physical Security course. Pick an answer and see the explanation, just as your team would.
Decision path: a person, badge, or piece of CUI media is in front of me. Is this allowed, and what do I do?
- Is this person on the current authorized list for this area? Yes: they may enter (3.10.1). Not on the list: go on.
- Not authorized: are they escorted, or is CUI cleared away first? Escort and monitor visitors, crews and contractors, or clear and lock away CUI before they come in (3.10.3).
- Is every badge, key, fob and combination accounted for? Keep an inventory (3.10.5).
- Is CUI media locked away, or accountable while it travels? Lock it away; clear desks at day's end (3.8.1, 3.8.2).
- Is the media being disposed of or reused? Sanitize or destroy it first (3.8.3).
1 of 2 · OK or not OK?
The side door to the engineering area is propped open on a hot day.
Physical access to CUI areas is limited to authorized people (3.10.1). A propped door lets anyone in.
2 of 2 · OK or not OK?
A contractor fixing the air conditioning works alone in the CUI area for an afternoon.
Decision 2 · Not authorized? Are they escorted, or is CUI cleared away first?
Escort and monitor people who are not authorized (3.10.3), or clear CUI from the area first.
What would change it: If someone stayed with them the whole time, or the CUI had been cleared and locked away before they came in, it would be OK.
Built for CMMC, not adapted to it.
How it compares with the options contractors usually weigh.
| Topic | Generic security-awareness libraries | Slide deck + sign-in sheet | Long video courses | DefenseLogix CMMC Training |
|---|---|---|---|---|
| Written for CMMC and CUI | Often general topics such as phishing and passwords | Depends on who wrote it | Sometimes | Yes. Teaches all 110 CMMC Level 2 requirements, each cited to NIST SP 800-171 |
| Role-based training (AT.L2-3.2.2) | Often limited | No | One size fits all | Six role courses, assigned per person |
| Assessment | Often open book | Usually none | Quiz at the end, often open book | Closed-book scenario check, 80% to pass |
| Learner experience | Often long modules, easy to click through | Passive | Mostly watching | Short chunks, practice with instant feedback, 5 graded questions |
| Annual renewal | Typically retake everything | Sit through it again | Typically rewatch everything | Test out by passing the check |
| Assessor-ready evidence | Typically a completion report | Paper sign-in sheet | Typically a certificate | Signed attestation (time and IP), certificate, compliance panel, CSV exports |
The right training for each role.
Essentials for everyone with CUI access, plus six role courses from system administrator to affirming official, so each person learns what matters in their own job. 7 courses, 18 modules, 90 graded scenario questions.
Required for everyone with CUI access · 6 modulesCMMC Workforce Training (Essentials)
- CMMC, FCI & CUI: Why This Applies to You
- Recognizing & Handling CUI
- Daily Safeguards
- AI, Cloud Tools & CUI
- Social Engineering & Insider Threat
- Incidents, Reporting & Consequences
IT and system admins · 4 modulesCMMC for System Administrators
- Privileged Access & Account Management
- Configuration, Patching & the Boundary
- Secure Design, Maintenance & Media
- Logging, Monitoring & Incident Handling
Supervisors who approve access · 3 modulesCMMC for Managers & Access Approvers
- Approving Access to CUI
- Onboarding, Role Changes & Departures
- Leading on Security: Insider Threat, Incidents & the Affirmation
Security lead, incident response · 2 modulesCMMC for Security Leads & Incident Responders
- Running the Program: System Security Plan (SSP), Assessments & Plans of Action
- Handling a Cyber Incident and Reporting to DoD
HR, recruiting, people ops · 1 moduleCMMC for HR & People Operations
- Screening, Personnel Actions & Training Records
Facilities, reception, physical security · 1 moduleCMMC for Facilities & Physical Security
- Physical Access, Visitors & Media
The senior official who signs the CMMC affirmation, and senior leaders · 1 moduleCMMC for Affirming Officials & Executives
- The Affirmation: What You Sign and What Backs It
Topics generic training often misses Using AI tools with CUI, reporting a cyber incident to DoD within 72 hours of discovery, and what the affirming official is actually signing.
Ready when the assessor asks.
Signed attestations, certificates, a live compliance panel and CSV exports, mapped to the Awareness and Training requirements.
- AT.L2-3.2.1Make everyone aware of security risks and the policies that applyEssentials required for all users; completion dates, scores and attestations recorded
- AT.L2-3.2.2Train people with security duties to carry them outSix role-based courses assigned per person; assignment and completion history recorded
- AT.L2-3.2.3Insider threat awarenessAn Essentials module on social engineering and insider threat, plus insider-threat content in the Managers, HR and Security Lead courses
Supports all three Awareness and Training requirements. Four of the nine assessment objectives (NIST SP 800-171A) are your company's own decisions: identifying your risks and policies, and defining the security roles in your System Security Plan (SSP). The courses cover the rest and record the evidence.
The evidence package
- Who completed which course, when, and with what score
- A signed attestation per person, with timestamp and IP
- A completion certificate, issued once training is complete and the attestation is signed
- Company standing on the compliance panel, and each person's status (complete, renewal due, expired, in progress) in the compliance export
- Renewal history across training years
Simple to run. Secure by design.
Nobody gets in uninvited
Invite-only accounts, with Sign in with Google.
Built to hold no CUI
The platform stores training records only, with nowhere to upload files. Records are hosted in the US.
Delegate the admin
An organization admin role, so your own staff manage your people and pull your reports.
Stays current
Annual renewal by default, per course. When a policy or system changes, we can send a course back to the people who took it.
Records your assessor can read
CSV exports that open cleanly in Excel: learners, compliance status, module results and training history.
Records outlast staff changes
Training history is kept when a person leaves or a course is unassigned.
Content that keeps up with DoD
Course updates track program changes, such as the July 2026 Phase 2 suspension and incident reporting through DoD's portal, run by the DoD Cyber Crime Center (DC3).
Works for everyone
Designed for keyboard and screen-reader use, and it adapts to smaller screens.
Grounded in learning science
- Decision-Based Learning (Plummer & Swan, Brigham Young University): teach the expert's decisions, with the "when and why" made explicit.
- Merrill's First Principles of Instruction: activate, demonstrate, apply, integrate.
- Mayer: short segments keep working memory free for understanding.
- Roediger & Karpicke: retrieving knowledge, not rereading it, is what makes it stick.
- Bloom: mastery learning. The standard is fixed; the time it takes can vary.
The research describes the techniques the design uses; it did not study this product. The method draws on Decision-Based Learning and is not an official DBL implementation.
Questions buyers ask.
See it the way your team would.
We take you through a full lesson as a learner, then show you the admin view: the compliance panel and the evidence exports. Or start a pilot with a small group from your team.
Ready to order? See plans and pricingSharing this with your team? Download the two-page brochure (PDF)
DefenseLogix CMMC Training supports the Awareness and Training requirements of CMMC Level 2 (AT.L2-3.2.1, 3.2.2 and 3.2.3; NIST SP 800-171 3.2.1–3.2.3). Overall CMMC compliance depends on all of an organization's security requirements and is determined by assessment.