TL;DR: CMMC 2.0 turns access review, audit evidence, and lifecycle discipline into prerequisites for defence supply chain work, with Level 2 mapping to all 110 NIST SP 800-171 requirements and Level 3 adding NIST SP 800-172 controls, according to Zluri. The practical lesson is that certification readiness depends on identity governance maturity, not point tools or one-time cleanup.
At a glance
What this is: This guide explains CMMC compliance and shows that access reviews, documented processes, and lifecycle discipline are central to meeting Level 2 and Level 3 expectations.
Why it matters: It matters because IAM and IGA teams supporting defence supply chains need evidence-ready governance, not just technical controls, to sustain certification and contract eligibility.
Context
CMMC compliance is a defence supply chain governance problem first and a cybersecurity checklist second. For organisations that handle Controlled Unclassified Information or Federal Contract Information, the question is not whether access exists, but whether it is governed, reviewed, documented, and demonstrable against the required certification level.
The article frames CMMC 2.0 as an ongoing maturity model rather than a one-time audit event. That matters for identity teams because access certification, entitlement scope, and process evidence become part of the certification posture, especially where Level 2 and Level 3 expectations overlap with NIST SP 800-171 and additional higher-assurance controls.
Key questions
Q: How should IAM teams support CMMC compliance in practice?
A: They should treat access governance as evidence generation. That means scoping identities that can reach FCI or CUI, running regular access certifications, documenting approvals and removals, and keeping remediation records tied to the certification level the organisation is pursuing.
Q: Why do access reviews matter for CMMC readiness?
A: Access reviews matter because CMMC readiness depends on proving that only authorised people can reach CUI and that access changes are controlled. If reviews are inconsistent, the organisation may still function, but it cannot reliably demonstrate governance. That becomes a problem during assessment and in prime-contractor scrutiny.
Q: What breaks when identity hygiene is treated as a one-time cleanup project?
A: Access reviews, group governance and ownership drift apart, so the programme produces compliance activity without reliable control. Dirty identity data makes it hard to explain why access exists, who owns it, or when it should be removed. The result is more noise, more manual effort and less confidence in actual privilege reduction.
Q: What should organisations prioritise first for CMMC-related identity controls?
A: They should prioritise scope definition, access review cadence, and documented remediation ownership. Those three elements determine whether identity governance can support audit evidence for Level 2 and Level 3 obligations.
Technical breakdown
How CMMC maps identity governance to certification evidence
CMMC 2.0 translates cybersecurity maturity into a structured certification model for Defence Industrial Base contractors. Level 1 is basic cyber hygiene for Federal Contract Information, while Level 2 covers Controlled Unclassified Information and aligns to all 110 requirements in NIST SP 800-171. In practice, that shifts identity work from informal access cleanup to repeatable governance evidence: approvals, certifications, role scope, and documented remediation. The article also notes that Level 2 requires assessment by a CMMC Third-Party Assessment Organization, which makes traceable identity controls part of audit readiness rather than internal preference.
Practical implication: Treat identity evidence as a certification artifact, not an operational by-product.
Why access reviews matter more as CMMC maturity increases
The article repeatedly points to access control, policy documentation, and ongoing process improvement as part of meeting CMMC expectations. That is important because access reviews are not just about removing excess access, they are how an organisation proves governance over who can reach CUI and FCI. As maturity increases, the burden shifts from isolated control presence to consistent operation and documented follow-through. In identity terms, recertification, role alignment, and entitlement cleanup become part of the compliance story, not separate admin tasks.
Practical implication: Build recurring access certification cycles that produce auditable evidence, not just revoked accounts.
Why POA&M discipline and assessor readiness shape identity operations
The guide highlights Plan of Action and Milestones work, third-party assessor selection, and ongoing maintenance as part of the compliance journey. That makes identity governance a lifecycle discipline: identify gaps, assign owners, track deadlines, and preserve proof of closure. Where organisations rely on manual review or ad hoc spreadsheets, they risk losing evidence continuity even when the underlying control exists. CMMC therefore rewards programmes that can show control design, operational consistency, and remediation tracking across time.
Practical implication: Tie access review findings to a tracked remediation workflow with evidence retained for assessment.
NHI Mgmt Group analysis
CMMC compliance turns identity governance into an evidence problem, not a tooling problem. The article is explicit that organisations must continually update and improve cybersecurity measures to stay compliant, which means identity controls have to be provable over time. For defence supply chain teams, that shifts the centre of gravity from feature selection to governance evidence, and access reviews become a certification input rather than an administrative chore.
Level 2 raises the bar from access presence to access accountability. Because the article ties Level 2 to all 110 NIST SP 800-171 requirements and third-party assessment, it effectively makes identity lifecycle discipline part of a formal control narrative. That means role scope, approval records, and certification cadence must survive audit scrutiny, not just internal operational review.
POA&M discipline is the real differentiator between partial compliance and defensible maturity. The guide’s emphasis on identifying gaps, prioritising fixes, assigning responsibility, and tracking completion shows that CMMC is as much about governance execution as technical enforcement. In practice, teams that cannot trace entitlement issues to closure will struggle to defend their certification posture.
Access review tooling is only valuable when it preserves governance intent. The article’s automation examples matter because they point to evidence generation, not just task reduction. That is the named concept here: certification-ready access evidence. It means the programme must be able to show who reviewed what, when, why, and with what outcome, or the control remains incomplete for CMMC purposes.
For defence contractors, identity governance is now a supply chain assurance function. The certification model does not stop at endpoints or perimeter controls. It extends into who can touch sensitive data, how that access is attested, and whether the organisation can prove continuing discipline to customers and assessors alike.
From our research library:
- Nearly 60% of IT leaders cite restrictive cost and complexity as a weakness of legacy identity governance, according to the 2025 State of Identity Governance Report.
- Read next: Access Reviews and Certification Guide
What this signals
Certification-ready access evidence: CMMC does not just ask whether access exists. It asks whether access decisions, reviews, and remediation actions can be demonstrated consistently enough to survive a third-party assessment, which pushes identity governance toward evidence-first operations.
Identity teams supporting defence contractors should expect tighter coupling between lifecycle governance and compliance artefacts. The practical effect is that access review, POA&M tracking, and entitlement documentation become recurring operational controls, not one-time audit projects.
For practitioners
- Map access reviews to CMMC scope Identify which identities, groups, and entitlements can reach FCI or CUI, then align review cadence to the certification level and assessment evidence you must produce.
- Document entitlement decisions and exceptions Record who approved access, which roles are in scope, what was removed, and what exception remains open so the compliance trail survives assessor review.
- Tie remediation to a tracked POA&M workflow Convert each certification gap into an owner, due date, and closure record so remediation evidence remains visible across the full compliance cycle.
- Validate certification evidence before assessment Run an internal evidence check on access certifications, policy artifacts, and remediation records before the C3PAO review begins.
Key takeaways
- CMMC compliance makes identity governance part of defence supply chain assurance, so access scope and review evidence matter directly to certification.
- Level 2 and Level 3 expectations push organisations toward documented, repeatable control operation rather than one-off cleanup.
- Teams that cannot show access certification, remediation ownership, and retained evidence will struggle to defend compliance during assessment.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | CMMC readiness here depends on governing who can access CUI and FCI. |
| Recommendation — Apply PR.AA-05 to make access certification and entitlement scope auditable. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is central to limiting access for CMMC-scoped information. |
| IA-5 — Authenticator Management | Credential lifecycle discipline supports the broader identity governance posture. | |
| Recommendation — Enforce AC-6 so only approved roles retain access to sensitive defence data. Apply IA-5 to keep authenticators current and revocation records complete. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account management underpins recurring access review and cleanup work. |
| Recommendation — Use CIS-5 to keep account lifecycle, approvals, and removals under control. | ||
| ISO/IEC 27001:2022 | A.5.15 — Access control | CMMC evidence aligns with formal access control governance and review. |
| Recommendation — Align access control records to A.5.15 so governance evidence survives assessment. | ||
Key terms
- CMMC: CMMC is a US Department of Defense cybersecurity certification model for contractors that handle controlled information. It uses maturity levels and control requirements to determine whether an organisation can bid on or support defence work, with identity controls playing a central role in readiness.
- Controlled Unclassified Information: Controlled Unclassified Information, or CUI, is sensitive federal information that must be protected according to defined handling rules outside federal systems. For practitioners, the key issue is not only storage security but also proving that every system, identity, and data path in scope preserves those rules.
- Plan of Action and Milestones: A Plan of Action and Milestones is a structured remediation record that shows what gaps exist, who owns them, when they will be closed, and how completion will be verified. In compliance work, it turns unresolved weaknesses into tracked obligations rather than informal intentions.
- Access Certification: Access certification is the periodic review of whether an identity still needs its current entitlements. For NHIs, certification is only reliable when reviewers know the identity's owner, purpose, and expiry, otherwise stale machine access can persist long after the original use case has ended.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org