CMMC 2.0 now ties defense contracts to continuous compliance

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Proofpoint's blog post: The DoD's final CMMC rule turns continuous compliance into an award condition for many contracts handling FCI or CUI.

Why it matters: Defense suppliers now need to prove that access, configuration, auditability, and data protection controls stay effective throughout contract performance, not just at certification time.

By the numbers:

• The final CMMC rule takes effect on November 10, 2025.

Context

CMMC 2.0 is a compliance regime for defence suppliers, but the real governance issue is broader: contract eligibility now depends on whether security controls can be evidenced continuously, not just documented once. That changes how organisations think about audit readiness, data governance, and access control across contractor and subcontractor environments.

For identity and access teams, the important shift is that CMMC pulls IAM, IA, AC, AU, and CM into a single contractual obligation. Organisations that can show only periodic review or isolated evidence will struggle where the DoD expects ongoing control operation, especially for systems storing Federal Contract Information and Controlled Unclassified Information.

Key questions

Q: What breaks when CMMC compliance is treated as a one-time audit exercise?

A: A one-time audit approach breaks down because CMMC ties contract eligibility to sustained control effectiveness, not a temporary snapshot. If identity, access, configuration, and logging controls drift after assessment, an organisation can still fail the conditions that support award, performance, or renewal. Continuous evidence is what survives the procurement cycle.

Q: When should contractors treat CMMC as a governance problem rather than a documentation task?

A: As soon as certification is in scope, because CMMC tests the operating reality behind the paperwork. If SSPs, POA&Ms, supplier obligations or cloud boundaries are not kept current, the issue is governance of control truth, not simply document preparation.

Q: How do teams know whether CMMC controls are actually operating?

A: Teams know controls are operating when they can show current, mapped evidence that matches real system behaviour, not just written policy. Useful signals include configuration baselines, access enforcement records, and repeatable evidence linked to the exact practices under review. If evidence is stale or manually assembled, the control is not operationally reliable.

Q: Should teams prioritise data discovery or access control first for CMMC readiness?

A: They should sequence both, but data discovery usually comes first because you cannot secure or evidence what you have not scoped. Once sensitive data is mapped, access boundaries and identity hygiene become easier to validate against CMMC requirements. Discovery defines the control surface; access control proves it is protected.

Technical breakdown

How CMMC 2.0 changes compliance from point-in-time to continuous

CMMC 2.0 is structured as a maturity and verification model, but the practical shift is from paperwork-based readiness to evidence that controls remain active during contract performance. The final DFARS rule allows the DoD to add clauses that make compliance part of award and performance, which means a contractor can be technically eligible at one moment and non-compliant later if controls drift. That makes configuration state, access hygiene, and data visibility part of the compliance surface. In effect, certification is no longer the end state; it is a current condition that must be sustained.

Practical implication: Build compliance evidence collection into operational workflows so control status can be shown continuously, not reconstructed after a request.

Why identity, access, and audit controls sit at the centre of CMMC

The article ties CMMC evidence to access control, identification and authentication, audit and accountability, and configuration management because these controls determine whether sensitive defence data is actually protected in use. Misconfigured accounts, excessive permissions, missing MFA, and weak logs all undermine the ability to prove that only authorised access occurred. For defense suppliers, this is not just a technical issue. It is a governance issue because failed identity hygiene can become failed contract performance. The compliance challenge is therefore less about broad security intent and more about proving that access and traceability are operating as designed.

Practical implication: Prioritise identity hygiene and access evidence where CMMC depends on being able to show who accessed sensitive data and under what conditions.

How DSPM supports CMMC evidence for sensitive data estates

Data Security Posture Management becomes relevant because CMMC obligations depend on knowing where CUI sits, whether it is exposed, and whether the storage and access conditions remain acceptable. DSPM tools can classify data, surface misconfigurations, map findings to control families, and maintain evidence trails for audit. That matters when a supplier has cloud and on-premises environments, multiple business units, or subcontractor data flows. The technical point is that CMMC readiness depends on data discovery and control validation across the environment, not just on policy documents. Without that visibility, organisations cannot reliably prove scope or control state.

Practical implication: Use continuous data discovery and control mapping to keep CUI in scope and to show whether protection measures are still working.

Threat narrative

Attacker objective: The objective is to exploit weakly governed defence data environments for espionage, theft, or sabotage while the supplier remains contractually exposed.

1. Entry occurs through defence supply-chain environments that handle FCI or CUI without sustained compliance evidence.
2. Privilege and access weaknesses, such as excessive permissions or missing MFA, create the conditions for unauthorised access to sensitive data.
3. Impact follows when contractors cannot demonstrate continuous control operation and may lose eligibility for awards or existing contracts.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Continuous compliance is now a governance requirement, not an audit project. CMMC 2.0 makes the defence supply chain prove control durability over time, which changes the unit of management from a certification packet to an operating state. For IAM and GRC teams, the key issue is whether access, logging, and configuration evidence can be produced continuously. Practitioners should treat this as a control-operating model, not a documentation exercise.

Identity hygiene has become a contractual control plane. The article shows that MFA gaps, inactive accounts, and excessive permissions are no longer merely security weaknesses. They become evidence failures when a contractor must demonstrate that access to CUI is bounded, traceable, and current. The practical conclusion is that identity and access governance now sits directly inside procurement and performance risk.

CMMC compresses data governance and access governance into one obligation. The framework forces organisations to know where sensitive data lives, who can reach it, and whether those conditions stay stable across cloud and on-premises estates. That creates a direct intersection between NHI governance, human IAM, and data control monitoring. Practitioners should assume data classification, permission review, and audit evidence will be judged as one connected control story.

Continuous evidence exposes the weakness of one-time compliance rituals. Annual attestations and periodic assessments are insufficient when contract status can be affected by drift between reviews. This is the same structural problem seen in other governance models: if the control state cannot be observed in motion, the organisation is relying on stale assurance. Teams should shift to live validation of control operation and exception handling.

Data Security Posture Management becomes a compliance enabler only when it is tied to control ownership. The article’s DSPM angle is not that tooling replaces governance. It is that discovery, classification, and misconfiguration detection become materially useful only when ownership, remediation, and evidence collection are assigned to the right teams. The practitioner takeaway is to connect data posture data to contract risk decisions, not treat it as a standalone dashboard.

What this signals

Continuous compliance is changing defence supplier governance. CMMC 2.0 makes control evidence part of contract performance, which means security teams need operating models that can withstand review at any point in the procurement cycle. For identity and data teams, the practical shift is from periodic certification to persistent proof that controls still work.

Identity evidence and data evidence now rise and fall together. If an organisation cannot show who had access to sensitive information, where that information lived, and whether the surrounding controls stayed intact, CMMC readiness will remain fragile. That makes IAM, access review, and data classification a single programme concern rather than separate workstreams.

For practitioners

• Map CMMC scope to all systems handling FCI and CUI Maintain a current inventory of systems, repositories, and collaboration tools that store or process Federal Contract Information and Controlled Unclassified Information, including subcontractor paths.
• Tie identity controls to audit evidence Verify MFA coverage, inactive-account handling, and permission boundaries for users with access to sensitive defence data, then retain evidence that supports annual affirmation and assessment.
• Automate control-state monitoring across data stores Continuously check for misconfigured buckets, unencrypted databases, and other storage exposures so CMMC evidence reflects live posture rather than a one-off assessment.
• Prepare for phased assessment requirements by level Separate self-assessment workflows for lower-tier contracts from third-party assessment readiness for higher-risk Level 2 work, and track which engagements move between those expectations.
• Align subcontractor evidence with prime contractor obligations Require downstream partners to provide control evidence for the data and access paths they operate, because CMMC performance risk extends across the supply chain.

Key takeaways

• CMMC 2.0 turns continuous evidence into a contract requirement for many DoD suppliers handling FCI or CUI.
• The compliance burden now spans identity hygiene, auditability, configuration state, and data visibility across the supply chain.
• Programmes that cannot prove live control operation will struggle more than those that only maintain periodic certification paperwork.

Key terms

• Continuous Compliance: Continuous compliance is the practice of keeping controls and evidence current as the environment changes, rather than proving compliance after a review cycle. For identity and NHI programmes, it means access, logging, and revocation must operate together in real time.
• Controlled Unclassified Information: Controlled Unclassified Information, or CUI, is sensitive federal information that must be protected according to defined handling rules outside federal systems. For practitioners, the key issue is not only storage security but also proving that every system, identity, and data path in scope preserves those rules.
• Data Security Posture Management: Data Security Posture Management, or DSPM, is the continuous discovery and monitoring of where sensitive data lives, how it is exposed, and where policy gaps exist. Its value rises when it feeds remediation rather than generating findings alone, especially in environments where AI expands the number of data paths.
• Contractual security evidence: Contractual security evidence is the operational proof that a supplier can produce to show controls are working during contract performance. It includes access logs, configuration state, assessment results, and remediation records, which together support procurement, assurance, and ongoing eligibility decisions.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, IAM, secrets management, and workload identity. It helps security and identity practitioners connect lifecycle controls to broader governance and assurance programmes.