CMMC 2.0 makes identity evidence the real test for defense contractors

At a glance

What this is: This is a CMMC 2.0 analysis of why identity proof, access control, and auditability now determine whether defense contractors can demonstrate compliance, especially in legacy and privileged workflows.

Why it matters: It matters because IAM teams supporting defense contractors must move from stated control ownership to assessor-ready evidence that every identity path, privileged action, and remote access route is enforceable and logged.

Context

CMMC 2.0 is the point where identity controls stop being policy statements and become bid eligibility evidence for defense contractors. The practical issue is not whether MFA exists in parts of the environment, but whether every relevant identity path to FCI and CUI can be shown to be controlled, attributable, and auditable.

That shifts attention away from the easiest systems to govern and toward the places where identity control is hardest to prove: legacy applications, shared accounts, shop-floor workstations, VPN, RDP, SSH, and privileged workflows. In CMMC terms, the programme fails where enforcement is inconsistent or documentation cannot demonstrate how the control actually operates.

For contractors in the Defense Industrial Base, this is a governance problem as much as a technical one. The assessment question is no longer whether a control exists in principle, but whether the organisation can produce evidence that the control is active across the systems the DoD will care about.

Key questions

Q: What breaks in CMMC 2.0 when identity controls are only documented, not enforced?

A: The control set becomes hard to verify. If MFA, access restrictions, or logging exist only in policy or isolated systems, a contractor may be unable to prove that identity enforcement is consistent across the environment. Under CMMC, that gap can undermine assessment readiness even when the control appears present on paper.

Q: Why do legacy remote access paths create the most CMMC audit risk?

A: Legacy remote access often bypasses the strongest identity controls, relies on older authentication patterns, or leaves attribution gaps in logs. That makes it difficult to prove who accessed what and whether privileged activity was properly constrained. For assessors, those missing proof points are often more damaging than the technical control itself.

Q: How should contractors prioritize identity work before a CMMC assessment?

A: Start with the systems that handle CUI and the access paths that are least visible: shared accounts, remote administration, VPN, RDP, SSH, and legacy apps. Then make sure each of those paths has unique identity, enforced authentication, and reconstructable logs. That is where assessment findings are most likely to emerge.

Q: How do CMMC teams know whether audit logging is strong enough for identity proof?

A: Logging is strong enough when a reviewer can reconstruct a user’s access, privileged action, and authentication change from end to end without relying on manual explanation. If logs are incomplete, modifiable, or disconnected from the identity record, they do not provide the proof CMMC expects. The test is traceability, not volume.

Technical breakdown

Identity evidence in CMMC 2.0

CMMC 2.0 moves identity assurance from asserted compliance to demonstrated control operation. In practice, that means assessors want evidence that the identity lifecycle, authentication method, access scope, and logging all line up for the systems handling FCI or CUI. MFA alone is not the full test. The programme also expects proof that access is attributable to a unique identity, that privileged access is constrained, and that records exist to show the control is working in real use, not just in policy documents.

Practical implication: build evidence packs that show enforcement, not just configuration screenshots.

Why legacy access paths fail CMMC evidence tests

Legacy systems often sit outside the strongest identity controls because they were built for password-based access, shared admin habits, or remote connectivity that predates modern governance. That creates a proof problem as much as a security problem. If VPN, RDP, SSH, or shop-floor access cannot be tied back to a verified user and a logged action, the control may exist on paper but fail under assessment. Shared credentials and inherited privilege make this worse because they destroy the ability to prove who did what.

Practical implication: inventory every path to CUI and isolate the ones that cannot produce user-level accountability.

Auditability is the control that makes identity verifiable

Audit and accountability controls are what convert identity policy into assessor-visible evidence. Logging successful and failed logins, changes to authentication settings, access to sensitive data, and privileged actions gives the organisation a reconstruction trail. Without that trail, even strong authentication can be hard to validate in a formal review. CMMC treats this as a core proof layer because the assessor needs to see that identity decisions are not only made but preserved in records that cannot be casually altered or deleted.

Practical implication: treat log integrity and log review as part of identity assurance, not as a separate monitoring project.

Threat narrative

Attacker objective: The objective is to exploit weak or unprovable identity controls to reach sensitive contractor systems while leaving insufficient evidence for compliance review.

1. Entry begins where identity is weakest: legacy systems, shared accounts, and remote access pathways that may still rely on passwords or inconsistent authentication.
2. Credential access or account abuse follows when privileged workflows or remote sessions do not produce attributable user-level evidence, making misuse harder to detect and prove.
3. Impact occurs when contractors cannot demonstrate control enforcement to an assessor, which can jeopardise CMMC readiness, bid eligibility, and contract continuation.

Breaches seen in the wild

• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.
• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity evidence is now the real compliance product: CMMC 2.0 does not reward the presence of controls alone. It rewards the ability to prove that authentication, access limitation, and logging operate consistently across the systems that matter. For defense contractors, the governance failure is not only insecure access, but evidence fragmentation that leaves the control set unverifiable.

Legacy identity paths are the highest-risk audit gap: Cloud applications behind SSO are often not where assessment risk concentrates. The harder problem is the long tail of VPN, RDP, SSH, shared accounts, and plant-floor systems where identity enforcement is uneven and attribution is weak. Those paths create the kind of control inconsistency that CMMC is designed to expose, so they deserve disproportionate attention in programme scoping.

Auditability is a prerequisite for trust, not a reporting afterthought: Audit and accountability controls are the bridge between written policy and assessor confidence. If login events, privileged actions, and authentication changes cannot be reconstructed, then identity controls cannot be defended as operationally real. The practical conclusion is that evidence retention, log integrity, and review discipline belong inside identity governance.

Access accountability must survive the contractor environment: Shared credentials, inherited administrator access, and ambiguous remote workflows are incompatible with a regime that expects user-level proof. CMMC is pushing the market toward identity patterns that can be traced, segmented, and explained under formal scrutiny. That means contractors should assume accountability will be tested at the weakest identity boundary first.

Identity assurance has become a bid-stage control plane: The most important CMMC question is not whether a contractor has a policy for MFA or logging, but whether it can show operational enforcement when a C3PAO asks. That changes IAM from an internal hygiene function into a contract-risk function, and contractors that still manage identity as documentation rather than evidence will struggle to qualify.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Evidence, not assertion, is now the control boundary: CMMC 2.0 pushes contractors to treat identity governance as an evidence supply chain. If a control cannot be shown across legacy systems, remote access, and privileged workflows, it will not survive formal assessment scrutiny.

Legacy access is the most likely place for control drift: The strongest identity programs often fail at the edges where older systems and operational convenience still shape behaviour. Contractors should expect those edges to define the assessor’s view of programme maturity.

Auditability now sits inside identity governance: A useful CMMC programme does not separate authentication from logging and access review. It connects them into one proof model so that every privileged action can be traced back to a verified identity and a documented control path.

For practitioners

• Map every FCI and CUI access path Document every route into in-scope environments, including VPN, RDP, SSH, shop-floor workstations, shared admin jump paths, and legacy applications. Note where identity is unique, where it is shared, and where logging can or cannot attribute actions to one user.
• Eliminate shared and inherited identities Remove shared logins, pool accounts, and informal admin handoffs from systems that touch CUI. Replace them with unique identities and role-based access that can be traced back to a specific person or approved function.
• Prepare assessor-ready identity evidence Build a repeatable evidence set for MFA enforcement, login logs, privileged activity, and authentication changes. Keep screenshots, exported settings, and log samples aligned to the same systems and dates the assessor will examine.
• Harden remote access control points Force all remote access through managed control points and ensure those sessions are monitored, logged, and attributable. Pay particular attention to systems that still support direct RDP or SSH into sensitive environments.

Key takeaways

• CMMC 2.0 turns identity governance into a proof exercise, where contractors must demonstrate controlled access rather than merely describe it.
• The most fragile control areas are the ones that combine legacy systems, shared accounts, and remote access because they are hardest to evidence consistently.
• Contractors that can reconstruct identity actions and authentication outcomes across in-scope systems are far better positioned for assessment and bid eligibility.

Key terms

• Identity Evidence Continuity: The uninterrupted chain of records that shows how a control was defined, approved, executed, and reviewed. In audit settings, it is the difference between claiming compliance and proving it with traceable identity, access, and activity evidence across systems.
• Auditability: Auditability is the ability to reconstruct who or what acted, what permissions were used, and what data or tools were touched. For AI and NHI governance, it is the minimum evidence needed to investigate incidents, validate controls, and prove that autonomous actions stayed within approved scope.
• Shared Account Risk: The security and accountability problem created when multiple people use the same login or credential. Shared accounts weaken traceability, complicate offboarding, and make it difficult to prove who performed an action inside a SaaS application.
• Remote Access Control Point: A remote access control point is the managed boundary through which offsite access is brokered, monitored, and logged. In identity governance, it is the place where authentication strength, session oversight, and evidence of access can be enforced consistently rather than left to ad hoc connections.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.