“Usually applies to” lists what a typical moving company has in scope for each requirement; your own scope decides. See what's in scope.
“May wait on a POA&M” applies only if your overall score is at least 88 of 110, and the gap must then be closed within 180 days. See how Level 2 works.
3.2.1 Everyone knows the risks
Everyone who uses your systems, including crews, office staff, owners and whoever runs your IT, knows the security risks in their work and your rules, such as phishing emails, shared passwords and photos of paperwork.
Usually applies to: Everyone who uses systems in scope: owners and managers, whoever administers your systems, office staff, estimators, crew leads, drivers and warehouse staff, including seasonal crews.
5 points if not met Cannot wait on a POA&M
Official wording: “Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.”
3.2.2 Train people for their security duties
People with security jobs, such as whoever adds users or runs the backups, are trained to do those jobs.
Usually applies to: The people with security jobs: whoever adds users, runs backups, manages devices or reviews activity records, often the office manager or your IT company.
5 points if not met Cannot wait on a POA&M
Official wording: “Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.”
3.2.3 Spot inside warning signs
Training covers how to recognize and report warning signs that someone inside could harm the company or its information, such as asking for access they do not need, copying service members' records for no clear reason or serious violations of company rules.
Usually applies to: Everyone who gets the training in 3.2.1, managers and seasonal crews included.
1 point if not met May wait on a POA&M
Official wording: “Provide security awareness training on recognizing and reporting potential indicators of insider threat.”
Sources: official wording, NIST SP 800-171 Rev 2; points, 32 CFR 170.24; plans of action, 32 CFR 170.21. The plain-English explanations are ours.
