- Job titles do not always reveal the security decisions people make.
- Give everyone a common vocabulary, then practice the decisions relevant to their role.
- Use observable tasks to identify learning gaps without labeling people by confidence alone.
Learning objectives
This lesson teaches you to build a learning map from activities rather than from a generic list of job titles. You will identify a shared concept, translate it into several role-specific decisions, and choose practice that reveals whether each learner can apply it. Use the fictional roles below or create an equally fictional team. Keep real employee performance and sensitive project details out of a public classroom exercise.
- Identify security-relevant decisions embedded in ordinary work.
- Separate common foundational learning from role-specific practice.
- Define an observable learning outcome and a suitable check for each role.
Start with decisions, not departments
An administrative assistant, engineer, manager, and system administrator may all encounter an access question, but their responsibilities differ. One recognizes and routes a request, another identifies the business need, another approves within their authority, and another implements an approved change. Assigning the same advanced technical lesson to everyone may obscure these differences instead of improving coordination.
List the situations each role encounters and the decisions it is expected to make. Include actions it should route to someone else. The distinction between acting and escalating is itself a learning outcome. A person who correctly identifies the limit of their authority may demonstrate better judgment than someone who confidently improvises a technical or contractual answer outside their role.
Build the learning map
Use columns for role, situation, shared concept, role-specific action, prerequisite knowledge, practice activity, and evidence of learning. NIST SP 800-50 Revision 1 discusses learning programs for varied audiences; this map is an original exercise for applying that audience distinction. It is not a prescribed CMMC training matrix or proof that every applicable training requirement has been satisfied.
Write outcomes using observable verbs such as identify, explain, route, compare, or demonstrate. Avoid a row that only says be aware. If the outcome is to route an unexpected file request, the check might ask the learner to select the proper contact and explain the choice. A definition quiz can support vocabulary, but it does not necessarily test the routing skill.
Worked fictional example: one request, four roles
In fictional company Juniper Instruments, an external partner asks for access to a project folder. Coordinator Sam learns to recognize that the request needs review and identify the approved route. Engineer Priya learns to explain the project need and relevant information. Manager Luis learns to evaluate the request within his assigned authority. Administrator Tess learns to implement the authorized permissions and record the action.
All four first learn the difference between identity, business need, and authorization. Their practice then differs. Sam routes a synthetic message, Priya describes the minimum necessary project access, Luis identifies missing approval information, and Tess demonstrates an approved change in a training environment. The map avoids teaching Sam to administer permissions or assuming Tess can independently decide the business need merely because she can change the system.
Test the connections between roles
Ask two learners to exchange the outputs from their exercises. Can the receiving role understand what happened and what decision remains? If not, revise the learning outcome or practice artifact. A role may perform its own step correctly yet provide an unusable handoff. This is why the map should include how information moves between roles rather than treating each learner as an isolated unit.
Review the map when responsibilities change. A promotion, new service, or different workflow may create a learning need even when the job title stays the same. Use learner feedback and observed practice to identify gaps. Do not infer that a quiet participant lacks understanding or that a fluent speaker can perform the task. Give people a safe way to demonstrate their reasoning and receive specific feedback.
Self-check and answer
Question: Every employee passed a quiz defining multifactor authentication. Does that prove the service desk can correctly handle a request to reset a user's authentication method? What additional learning check would help?
Answer: No. The quiz demonstrates a narrow vocabulary result. The service desk needs role-specific knowledge of the organization's authorized verification, escalation, and reset process. A synthetic scenario can ask the learner to identify the required checks and demonstrate the approved steps in a suitable training environment. The exercise should also reveal when the learner must stop and escalate. A strong answer connects the check to the role's task rather than treating a general quiz score as proof of every related skill.
Sources & further learning
Use primary sources and the current requirements relevant to your situation. This guide is a learning resource, not a contract-specific or assessment determination.
Learn the building blocks of access control
Build on this guide with a connected concept, then explain how the two ideas fit together.
Continue learningWhen the concept becomes a practical question
Use specific role decisions and practice gaps to guide an advisory discussion about team readiness education.
Discuss your team's learning map with Federal Bid PartnersSelf-checks are educational reflection activities. They do not confer a credential, demonstrate compliance, or establish certification. Read our editorial approach.