CMMC 2.0 access control gaps are undermining manufacturing readiness

At a glance

What this is: This analysis says CMMC 2.0 readiness in manufacturing is often lost in everyday access decisions, not in missing policy documents.

Why it matters: It matters because IAM and PAM controls only satisfy CMMC expectations when workers can authenticate individually, sessions are controlled, and logs prove who did what on shared stations.

Context

CMMC 2.0 access control is a workflow problem as much as a compliance requirement. In manufacturing environments, shared workstations, rotating shifts, and restricted personal device use can break the assumption that one person uses one device under one login.

The issue is not simply whether a control exists on paper. CMMC Level 2, aligned to NIST SP 800-171, expects identity activity, authentication strength, session handling, privilege, and audit evidence to hold up in production conditions, especially where CUI is present.

Key questions

Q: What breaks when shared accounts are used on manufacturing workstations under CMMC 2.0?

A: Shared accounts break person-level accountability. When multiple operators use the same login, logs may show that an account acted, but they cannot reliably prove which individual performed the action. That weakens audit evidence, complicates incident review, and makes CMMC Level 2 access control harder to defend in a production environment.

Q: Why do inconsistent MFA deployments create CMMC readiness risk in factories?

A: Because assessment quality depends on coverage, not intent. If some access paths to CUI systems enforce MFA and others do not, attackers or insiders can choose the weaker route. Manufacturing environments are especially exposed because legacy systems, remote access, and privileged workflows often coexist, creating uneven enforcement unless teams map every path.

Q: How do you know whether session handling is strong enough for shared workstations?

A: Look for automatic lock, reauthentication after inactivity, and clear session end behaviour that prevents one operator's access from carrying into the next task or shift. If a workstation can stay active while its user is absent, the organisation cannot confidently tie actions to the right person or prove when authority ended.

Q: What is the difference between least privilege and shared access in manufacturing environments?

A: Least privilege limits what a named individual can do, while shared access dilutes attribution and usually expands effective permissions to fit the broadest user need. In manufacturing, shared stations often tempt teams to overgrant access for speed, but that trade-off makes later audit and accountability much harder.

Technical breakdown

Shared workstations break individual accountability

Shared endpoints change the identity model. When multiple operators use the same station, a generic login or reused credential makes it difficult to prove which person performed a given action. That undermines both auditability and incident reconstruction because logs may show an account, not a human operator with a specific task and shift. In these environments, identity controls must preserve person-level attribution even when the device is communal and the workflow is continuous. Without that link, authentication records lose value as evidence and access decisions become hard to defend under CMMC review.

Practical implication: enforce unique user attribution at every shared station so actions can be tied to an individual, not a floor account.

MFA coverage is only as strong as its weakest plant-floor path

MFA is not effective if it is only deployed on some systems or for some access paths. Manufacturing environments often combine legacy tools, modern applications, remote access, and privileged workflows, which creates uneven enforcement unless coverage is deliberately standardised. Assessors look for consistency, not intent. If a system touching CUI can still be reached through a weaker path, the control objective is not being met. The practical challenge is less about choosing MFA and more about eliminating exceptions that become operational habits.

Practical implication: map every access path to CUI systems and close the gaps where MFA is missing, bypassed, or only partially applied.

Session handling and privilege scope determine whether evidence is trustworthy

In shared environments, an authenticated session can outlive the person who started it. If workstations stay unlocked or privileges remain broad after the immediate task, later activity may be attributed to the wrong user or occur under permissions that were never justified for the moment. Least privilege and time-bounded session handling matter here because they reduce both exposure and ambiguity. The audit problem is not only unauthorized access. It is also unprovable access, where the organisation cannot show when a session ended, who approved privileged use, or whether the access was still needed.

Practical implication: shorten session lifetime and narrow privilege scope so every privileged action is both necessary and attributable.

Threat narrative

Attacker objective: The objective is to exploit weak identity controls to reach CUI-connected systems without clear attribution or trustworthy audit evidence.

1. Entry begins through shared accounts, credential reuse, or weak authentication paths on plant-floor workstations that touch CUI systems.
2. Escalation follows when broad privilege and stale sessions let one user perform actions beyond the intended task or beyond the correct operator identity.
3. Impact appears in the audit trail and in operational exposure, because the organisation cannot reliably prove who accessed what, when, and under which permissions.

Breaches seen in the wild

• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Shared-workstation access control is a CMMC readiness issue, not a narrow login problem. Manufacturing environments do not fail assessments because they lack policy language. They fail when one workstation supports many operators, many shifts, and many exceptions, while the identity model still assumes a single user context. That makes accountability, session control, and evidence collection the real test. Practitioners should treat communal access as a governance design problem, not a user convenience issue.

Accountability collapses when authentication is detached from the individual operator. CMMC Level 2 expects the organisation to show who did what, but shared accounts and reused credentials turn identity into a location marker instead of a person-level control. This is the core governance gap: the control exists, but the evidence does not survive the workflow. The implication is that identity architecture must preserve operator attribution at the point of access, not after the fact.

Weak session handling creates an auditability gap even when credentials are nominally unique. If a workstation remains open between tasks or shifts, the permission set and the actor can drift apart. That is not merely a hygiene issue; it is a control integrity problem because the record no longer proves who held authority at the moment of action. Manufacturing teams need to understand that session discipline is part of compliance evidence, not just endpoint convenience.

Least privilege in manufacturing is constrained by throughput pressure, which is why broad access often persists. Plants expand permissions to avoid delays, then struggle to justify them later. This is where CMMC readiness and operational reality collide: the environment rewards speed, but the assessment rewards traceability and restraint. The practical conclusion is that privilege scope has to be designed around shifts, stations, and task boundaries, not just job titles.

Identity evidence must be usable under plant-floor conditions or it will fail as governance evidence. Logging that cannot be tied back to a person, a session, and a privileged action is weak evidence, even if it is technically complete. That distinction matters because compliance is not just about collecting records, but about producing records that explain behaviour. Teams that can prove access lineage will be far better positioned for both assessment and incident review.

What this signals

Shared-workstation identity needs its own control model: manufacturing teams cannot rely on office-style assumptions that a user, device, and session are one and the same. The practical shift is to design for communal endpoints where attribution survives rotation, handoff, and task switching.

Access governance in this environment is really evidence governance. If the organisation cannot reconstruct who accessed CUI, under what privilege, and from which session context, then the control failed even when a login technically succeeded.

For practitioners

• Standardise unique operator identity at shared stations Replace generic logins and reused credentials with individual authentication that preserves person-level attribution on every workstation that can reach CUI systems.
• Close inconsistent MFA paths Inventory all routes to systems that store or process CUI, then remove the exceptions where strong authentication is missing or only partly enforced.
• Tighten session handling on communal endpoints Configure automatic lock, reauthentication, and session termination so an unattended workstation cannot continue under another operator's context.
• Restrict privilege to the task and the shift Review broad admin rights and convert standing access into narrowly scoped permissions that match the work being performed at the station.
• Test audit evidence before the assessment Walk a shared-workstation scenario end to end and verify that logs show the individual, the action, the time, and the system touched.

Key takeaways

• CMMC 2.0 readiness in manufacturing is often undermined by routine access choices, especially where shared endpoints blur user attribution.
• The most visible weaknesses are shared accounts, uneven MFA coverage, weak session handling, and privilege that expands to preserve uptime.
• Teams that can prove individual identity, control session lifetime, and show trustworthy logs will be better positioned for both assessment and operational review.

Key terms

• Shared Workstation Identity: A shared workstation identity is the practical relationship between a person, a device, and a session when multiple users access the same endpoint. In manufacturing, it must preserve attribution across handoffs, idle periods, and privileged actions, or the audit trail becomes ambiguous and hard to defend.
• Person-Level Attribution: Person-level attribution is the ability to connect an action to a specific individual rather than just an account or device. It matters when compliance and incident review depend on proving who accessed a system, what they did, and under which permissions they acted.
• Session handling: Session handling is the way an application creates, stores, validates, and expires a user's authenticated state. It is central to application security because weak session design creates inconsistent access enforcement, replay risk, and unclear ownership across code paths.
• Audit Evidence: Audit evidence is the record set used to prove that access was authorised, limited, and revoked according to policy. For modern identity programmes, evidence must come from runtime logs, approval events, and lifecycle records rather than from manual spreadsheets assembled after the fact.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.