TL;DR: CMMC 2.0 shifts file auditing from a logging task to evidence of controlled access across the defence supply chain, with Level 1 self-assessments, Level 2 third-party assessments every three years, and Level 3 government-led assessments aligned to NIST 800-53 and NIST-800-171, according to IS Decisions. The governance test is no longer whether access is visible, but whether logs are complete, centralised, tamper-resistant, and reviewable enough to support proof.
At a glance
What this is: This is an analysis of how CMMC 2.0 shifts file auditing from operational logging to compliance evidence for controlled access across the defence supply chain.
Why it matters: It matters because IAM, PAM, and governance teams need audit trails that can withstand assessment, not just detect activity, when proving access control for sensitive files.
Context
CMMC 2.0 raises the bar from knowing that file access happened to being able to prove that access was controlled, logged, and reviewable. In the defence industrial base, that changes file auditing from an IT hygiene task into an evidentiary control that supports contract eligibility and assessment readiness.
The practical problem is not whether logs exist, but whether they are complete across cloud and on-premises locations, centralised, tamper-resistant, and usable enough for assessors. That is the governance gap this article addresses: access controls have to leave an audit trail that can stand up to third-party scrutiny.
Key questions
Q: What breaks when file auditing is not complete enough for CMMC 2.0?
A: The control breaks when access activity cannot be reconstructed across all relevant file systems, because assessors need evidence of who accessed what, when, and how. If logs are fragmented, missing, or hard to interpret, the organisation may still have permissions and alerts but no defensible proof that access was controlled.
Q: When does file auditing become a compliance problem rather than an IT reporting issue?
A: It becomes a compliance problem when the organisation cannot use logs to show that access controls were actually enforced. Under CMMC 2.0, the issue is not whether telemetry exists in the background, but whether it supports assessment, retention, and accountability across the full file estate.
Q: What do teams get wrong about auditing file access in Windows?
A: A common mistake is relying on manual native tools and ad hoc scripts, which scale poorly and can miss unauthorized access. Another error is focusing only on detection while ignoring reporting, which weakens compliance evidence. Teams also overlook the need to monitor account activity across cloud platforms and to include denied access attempts, not just successful reads or edits.
Q: How should organisations decide whether their file logs are good enough for CMMC assessments?
A: They should test whether an assessor can trace access, see the relevant user and file activity, and trust the record without extra manual interpretation. If the answer depends on scripts, exports, or multiple consoles, the logging model is too brittle for compliance evidence.
Technical breakdown
Why file auditing becomes evidence under CMMC 2.0
CMMC 2.0 does not treat logging as a passive record-keeping function. It treats file access evidence as proof that users could only reach sensitive data through governed access paths, and that the organisation can show what happened after the fact. That means read, write, delete, copy, and denied-access events all become part of the control story. The technical challenge is completeness across platforms, because assessment evidence fails if activity is fragmented across Windows, cloud storage, and separate admin consoles.
Practical implication: centralise file access telemetry so assessment evidence is consistent across every storage location.
Why native file auditing often fails the compliance test
Native auditing is usually fragmented, manual, and hard to review at scale. Windows Event Viewer and ad hoc PowerShell scripts can surface some access activity, but they struggle with central reporting, long retention, and fast investigation across large file estates. That creates an evidence gap: even if access was technically logged, the organisation may not be able to retrieve or interpret the record quickly enough for an assessment, incident review, or policy challenge.
Practical implication: do not assume built-in logging is sufficient unless it can produce assessor-ready reports on demand.
Why tamper resistance and log scope matter
A file audit trail only proves control if the logs themselves are trustworthy. If administrators can alter, delete, or selectively view the evidence, the record becomes weak as compliance proof. CMMC 2.0 also pushes teams to avoid blind spots, especially in cloud repositories where users may access regulated data outside the traditional file server boundary. The technical requirement is therefore not just logging, but protected logging with enough scope to cover the real data estate.
Practical implication: protect audit logs as a governed asset and include cloud file platforms in the same evidence model as on-premises shares.
Threat narrative
Attacker objective: The objective is to exploit weak auditability so sensitive file access cannot be proven, challenged, or reconstructed during compliance review or investigation.
- Entry occurs through ordinary file access by authorised users, contractors, or service identities working inside the defence supply chain.
- Credentialed access is then exercised through read, write, copy, delete, or denied-access actions that may be legitimate but still need evidence.
- Impact appears when the organisation cannot reconstruct who touched sensitive files, whether access was policy-compliant, or whether an assessor can trust the logs.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Proof, not visibility, is the real control objective: CMMC 2.0 pushes file auditing out of the monitoring category and into the evidentiary category. That matters because a log that exists but cannot be centralised, retained, and trusted does not satisfy the governance test. The discipline shift is from observing access to proving access control, which is the only standard that matters in assessment-driven environments.
File auditing exposes the gap between policy and operational reality: Organisations often believe access control is implemented because permissions exist, but CMMC asks whether the resulting activity can be shown cleanly and consistently. If cloud repositories, local file systems, and admin tools produce different audit stories, the control is fragmented. The practical conclusion is that governance fails when evidence is distributed faster than it is normalised.
Granular file telemetry is now a compliance design requirement: The article’s emphasis on reads, writes, deletions, copies, alerts, and access-denied events shows that file auditing has become a behavioural evidence layer, not a simple event feed. That creates a named concept worth tracking: auditability debt, where the organisation may have controls in place but lacks the usable evidence to defend them. Teams should treat that debt as a governance risk in its own right.
Defence supply chain compliance is increasingly evidence-led: CMMC 2.0 aligns the supply chain to a common proof standard, which means smaller suppliers are held to the same evidentiary expectations as larger primes. That is structurally important because it compresses tolerance for informal logging and ad hoc reporting. The result is a market shift toward control verification that favours assessable evidence over claims of good practice.
Access governance and audit governance are converging: File access control is no longer separable from the quality of the audit trail it produces. In practical terms, IAM and IGA teams need to think about whether permissions, alerts, retention, and reporting all support the same proof model. When they do not, the organisation may have security activity but not compliance-grade assurance.
What this signals
Auditability debt: file auditing becomes a governance liability when access events exist but cannot be centralised, retained, and defended as evidence. That gap matters because CMMC 2.0 judges control quality by the strength of the record, not by the existence of a monitoring tool.
Defence suppliers should expect file auditing to converge with broader identity governance workflows, especially where access reviews and evidence retention must support recurring assessments. In practice, the organisations that win audits will be the ones that treat file telemetry as part of the control plane, not as a separate reporting layer.
For practitioners
- Centralise file access logs Consolidate read, write, delete, copy, and denied-access events from Windows and cloud file platforms into one reviewable record so assessors can follow a single evidence chain.
- Protect audit logs from tampering Restrict who can view, alter, or delete audit data and keep a clear trail of access to the logs themselves so the record remains defensible during review.
- Build assessor-ready reports Generate reports that map file activity to CMMC 2.0 requirements and retain them long enough to support annual self-assessments, third-party assessments, or investigations.
- Eliminate cloud blind spots Include OneDrive, SharePoint, Google Drive, Dropbox Business, and Box in the same audit scope as internal file servers so evidence does not stop at the network edge.
- Tune alerts to abnormal access Flag mass deletion, off-hours activity, and unusual access patterns so admins can distinguish routine business use from behaviour that should be reviewed or blocked.
Key takeaways
- CMMC 2.0 moves file auditing from a monitoring task to a proof requirement, which changes how access control is judged in the defence supply chain.
- The main risk is not missing logs alone, but logs that are incomplete, fragmented, or too hard to trust during assessment or investigation.
- Teams need centralised, tamper-resistant, reviewable file audit trails across cloud and on-premises systems if they want evidence that stands up to CMMC review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-2 — Audit Events | CMMC evidence depends on recording the right access events. |
| AU-9 — Protection of Audit Information | Logs must be tamper-resistant to support assessment and investigation. | |
| Recommendation — Define and capture file access events that must be logged for compliance evidence. Protect audit records from alteration and unauthorised deletion. | ||
| NIST CSF 2.0 | PR.DS-4 — Data is adequately backed up and recovery information is maintained | Long-term retention and recoverability support defensible audit evidence. |
| PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about proving who can access files and what they do. | |
| Recommendation — Maintain audit data retention and recovery so evidence survives assessment cycles. Review file permissions and entitlement evidence so access can be demonstrated and challenged. | ||
| CIS Controls v8 | CIS-5 — Account Management | File auditing supports accountability for user activity across controlled access paths. |
| Recommendation — Tie file access records to managed accounts and review anomalies against expected access. | ||
Key terms
- Auditability debt: The growing gap between machine-generated decisions and the organisation’s ability to inspect, explain, and correct them. It appears when autonomous systems act faster than governance processes can review, creating hidden operational and compliance risk.
- Assessor-ready evidence: Assessor-ready evidence is operational proof that matches the control statement in the system security plan and can be produced quickly during review. It includes live logs, access records, owner assignments, exception handling, and records that demonstrate the environment works as described.
- Tamper-Evident Logging: A logging approach that records system events in a way that shows if the record has been altered, removed, or obscured. For regulated AI, the point is not just traceability but durable evidence that can reconstruct decisions, interventions, and system behaviour after the fact.
Deepen your knowledge
NHI governance, identity lifecycle, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on July 8, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org