TL;DR: CMMC compliance is a U.S. Department of Defense supply-chain framework that pushes contractors and subcontractors to prove they can protect FCI and CUI through maturity, documentation, and access control discipline, according to Zluri. For identity teams, the practical issue is not certification alone but whether access review, least privilege, and lifecycle processes are actually operating at audit depth.
At a glance
What this is: This is a guide to CMMC compliance that frames defence supply-chain certification as an identity governance problem, not just a cyber checklist.
Why it matters: It matters because IAM, IGA, and PAM teams supporting defence contractors must show that access reviews, lifecycle controls, and least privilege are audit-ready across the full contract chain.
By the numbers:
- Level 1 CMMC requires 17 basic cybersecurity practices for safeguarding federal contract information.
- Level 2 CMMC covers all 110 security requirements from NIST SP 800-171.
Context
CMMC compliance is a defence supply-chain governance requirement that ties contract eligibility to demonstrated protection of FCI and CUI. In practice, that makes identity governance part of the certification problem because access, entitlement history, and documentation all have to stand up during assessment, not only during implementation.
Zluri frames CMMC 2.0 as an ongoing obligation rather than a one-time certification event. That matters for IAM and IGA teams because the programme has to prove that review cycles, least privilege, and lifecycle controls are maintained continuously across contractors and subcontractors.
The compliance burden rises as certification levels increase, and the article repeatedly links that burden to access control discipline, self-assessment, POA&Ms, and third-party assessment readiness. The core issue for identity teams is whether governance evidence is complete enough for audit, not whether controls exist on paper.
Key questions
Q: How should security teams prepare identity controls for CMMC assessments?
A: Security teams should map identity controls to the CMMC maturity level they need, then test whether MFA, assurance levels, and access approvals can be evidenced during assessment. The goal is not just technical deployment. It is demonstrating repeatable control operation, especially for subcontractor access and workstation authentication.
Q: Why do subcontractor identities matter so much in CMMC programmes?
A: Because CMMC extends control expectations across the defence supply chain, subcontractor access becomes part of the trust boundary. If third-party accounts are poorly scoped, unclearly owned, or left active after need ends, the contractor may be unable to prove that sensitive information was protected end to end.
Q: What breaks when identity controls are not ready for CMMC assessment?
A: The main failure is not simply a weaker security posture, but an inability to prove control maturity to a certified assessor. If access assurance, MFA enforcement, or evidence collection is inconsistent, a contractor can lose eligibility for the contracts it wants to pursue. In regulated environments, lack of proof becomes an operational blocker.
Q: Should organisations use automation or manual processes for CMMC evidence collection?
A: Automation is preferable for recurring evidence such as entitlement reviews, approvals, and documentation trails because manual collection is slow and inconsistent. The practical test is whether the process can continuously produce assessor-ready records without relying on ad hoc effort during certification windows.
Technical breakdown
Why CMMC turns access control into an audit requirement
CMMC is not simply a policy framework. It is a maturity model that requires organisations to demonstrate that controls exist, are documented, and can be evidenced under assessment. For Level 1, the article cites 17 basic practices for FCI. For Level 2, it points to all 110 NIST SP 800-171 requirements for CUI. That means identity controls are not judged only by design intent. They are judged by whether access decisions, documentation, and review records can survive external scrutiny.
Practical implication: Treat access control evidence as part of certification scope, not as an afterthought to technical implementation.
How access reviews map to CMMC maturity
The article’s strongest identity signal is its emphasis on access review and certification tooling as a way to reduce CMMC effort and cost. That places recertification, entitlement validation, and role scoping in the centre of the compliance conversation. In CMMC terms, the issue is not whether access is technically restricted in the moment. The issue is whether the organisation can prove who had access, why they had it, and whether that access was still justified when reviewed.
Practical implication: Build access review evidence into the certification workflow so auditors can trace decisions back to documented approvals and removals.
Why subcontractor governance is part of the control surface
CMMC extends beyond the prime contractor because the article explicitly includes subcontractors of DoD contractors. That widens the identity governance boundary from internal users to third-party access, delegated entitlements, and cross-organisational accountability. Once the supply chain is in scope, orphaned accounts, stale permissions, and weak offboarding are no longer local hygiene issues. They become certification risks because the contract chain depends on every participant maintaining the same control discipline.
Practical implication: Inventory and certify third-party access paths with the same discipline used for internal identities.
NHI Mgmt Group analysis
CMMC exposes an identity governance gap, not just a compliance gap: The article shows that certification depends on whether access, documentation, and control maturity can be evidenced at assessment depth. That makes IAM and IGA part of the defence supply-chain control plane, not a supporting function. Organisations that treat CMMC as a paperwork exercise will miss the fact that entitlement proof is now part of contract readiness.
Access review is the decisive control because it turns entitlement history into auditable evidence: Zluri’s discussion of access certification reflects a broader reality in regulated environments. Technical restriction alone is not enough when a third-party assessor needs to see who approved access, when it changed, and whether it remained justified. Practitioners should read this as a signal that recertification quality now affects certification viability.
CMMC maturity is only as strong as the weakest supplier identity process: The article’s inclusion of subcontractors shows that governance breaks at the boundary where accountability becomes shared. If a defence contractor can control its own access but not prove the same discipline across vendors, the programme is incomplete. The implication is that supply-chain identity governance must be measured end to end, not inside a single tenant or team.
POA&Ms and third-party assessment force identity teams to operationalise lifecycle discipline: The guide links remediation planning, assessor selection, and ongoing maintenance to certification success. That means joiner-mover-leaver processes, role maintenance, and offboarding records are no longer back-office hygiene. They are evidence-bearing controls that determine whether the organisation can sustain CMMC status over time.
What this signals
Access review quality is the control that turns CMMC from a checklist into a governance test: Defence contractors do not just need to restrict access. They need to prove that entitlements were reviewed, justified, and removed in a way an assessor can verify across internal teams and suppliers.
Supplier identity governance now sits inside the certification boundary: CMMC’s supply-chain framing means contractors have to measure third-party access with the same discipline as internal access. The practical implication is that orphaned vendor accounts and weak offboarding are no longer tolerable audit blind spots.
Identity evidence has become contract evidence: For organisations working with the DoD, access histories, POA&Ms, and review records are no longer supporting material. They are part of the case for why the business should be trusted with sensitive federal data.
For practitioners
- Map CMMC scope to identity control owners Identify which business units, contractors, and subcontractors handle FCI or CUI and assign clear owners for access decisions, review evidence, and exception handling.
- Turn access reviews into certification evidence Capture review outcomes, approver identity, removals, and remediation timestamps so the access review record can support assessor testing.
- Close third-party entitlement gaps before assessment Review vendor and subcontractor accounts for standing access, unused privileges, and incomplete offboarding across the defence supply chain.
- Align POA&M tracking to identity findings Track unresolved access-control gaps, stale accounts, and documentation defects as POA&M items with named owners and due dates.
Key takeaways
- CMMC makes identity governance part of defence supply-chain assurance, not just an internal security exercise.
- The article shows that Level 2 and Level 3 compliance depends on documented controls, access evidence, and continuous maintenance, not one-time setup.
- Teams that cannot prove access reviews, least privilege, and lifecycle handling risk failing assessment even if the technical controls exist.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | CMMC depends on provable access governance and entitlement control. |
| Recommendation — Use PR.AA-05 to tighten entitlement review and document access authorisations for CMMC evidence. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | The article centres on limiting access to what CUI and FCI require. |
| Recommendation — Apply AC-6 to reduce standing access and support CMMC least-privilege demonstrations. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account lifecycle and review discipline are central to the guide's compliance path. |
| Recommendation — Use CIS-5 to manage account creation, review, and removal across the defence supply chain. | ||
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article's third-party and lifecycle discussion maps to unresolved access after need ends. |
| Recommendation — Eliminate lingering vendor and contractor access by enforcing timely offboarding and entitlement removal. | ||
Key terms
- CMMC: CMMC is a US Department of Defense cybersecurity certification model for contractors that handle controlled information. It uses maturity levels and control requirements to determine whether an organisation can bid on or support defence work, with identity controls playing a central role in readiness.
- Controlled Unclassified Information: Controlled Unclassified Information, or CUI, is sensitive federal information that must be protected according to defined handling rules outside federal systems. For practitioners, the key issue is not only storage security but also proving that every system, identity, and data path in scope preserves those rules.
- Plan of Action and Milestones: A Plan of Action and Milestones is a structured remediation record that shows what gaps exist, who owns them, when they will be closed, and how completion will be verified. In compliance work, it turns unresolved weaknesses into tracked obligations rather than informal intentions.
- Third-party Assessment Organization: A third-party assessment organization is an external body that evaluates whether an organisation meets the required CMMC maturity level. Its role turns compliance into a provable standard, which means identity controls must be documented, repeatable, and easy to audit across employees, contractors, and subcontractors.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 11, 2026.
Updated on October 8, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org