CMMC compliance puts identity and access controls back at the center

At a glance

What this is: Zero Networks frames CMMC as a contractual enforcement model that pushes identity, access, logging and segmentation controls back to the center of defence contractor security.

Why it matters: It matters because IAM, PAM and NHI teams now have to show that access control, authentication and audit evidence are operationally real, not just documented, across contractor and subcontractor environments.

By the numbers:

• The average cost of a data breach in the United States hit $10.22 million in 2025, a 9% year-over-year increase.
• CMMC Level 2 maps to 110 requirements across 14 categories, including Access Control, Audit & Accountability, Identification & Authentication and System & Communications Protection.
• Phase 4 begins after November 10, 2028, when CMMC requirements are fully integrated across the DoD acquisition process.
• CMMC Level 3 includes 134 requirements total, including 24 key requirements from NIST SP 800-172 that are affirmed annually after government-led assessment.

Context

CMMC is a contracting-driven security framework, not just a paperwork exercise. For defence suppliers, subcontractors and service providers, the practical question is whether identity, access and boundary controls can be demonstrated as working controls for systems that handle FCI or CUI. That makes CMMC a governance test for IAM, PAM and network segmentation as much as a compliance one.

The article’s identity angle is direct: CMMC puts authentication, least privilege, auditability and external connection control back into the centre of contractor security programmes. For NHI governance, the lesson is that the same control logic used for users has to extend to service accounts, integrations and machine access paths inside supplier environments.

Key questions

Q: What breaks in CMMC 2.0 when identity controls are only documented, not enforced?

A: The control set becomes hard to verify. If MFA, access restrictions, or logging exist only in policy or isolated systems, a contractor may be unable to prove that identity enforcement is consistent across the environment. Under CMMC, that gap can undermine assessment readiness even when the control appears present on paper.

Q: Why do segmented networks matter so much for CMMC compliance?

A: Because authentication alone does not stop lateral movement. CMMC depends on proving that a valid identity cannot freely traverse contractor environments and reach protected data or adjacent systems. Segmentation reduces blast radius, supports boundary control evidence and makes assessments easier to defend when a compromise occurs.

Q: What do teams get wrong about CMMC evidence collection?

A: They treat evidence as a pre-audit deliverable instead of an operating process. That leads to screenshots, spreadsheets, and missing timestamps that are hard to validate under assessment pressure. Strong programmes capture evidence continuously, tie it to control ownership, and keep it traceable back to the environment that produced it.

Q: How should contractors prepare for CMMC without overfocusing on paperwork?

A: Start with the controls most likely to fail under real operational pressure: access restriction, authentication, audit trails, external connection control and segmentation. Then tie those controls to named owners, evidence sources and review cadence. That approach turns CMMC into a programme of measurable control performance rather than a document repository.

Technical breakdown

How CMMC maps to identity and access control layers

CMMC 2.0 is built as a tiered compliance model that inherits requirements from FAR 52.204-21, NIST SP 800-171 Rev. 2 and NIST SP 800-172. The important technical point is that the framework does not treat identity as a single control. It spreads the requirement across access control, identification and authentication, auditability, boundary protection and, at the higher level, resilience and isolation. That means contractors must prove who can access what, how that identity is authenticated, and how the access path is contained when risk rises.

Practical implication: Map user, service and administrative access paths to the CMMC level they support, then validate that each path has a corresponding control owner and evidence trail.

Why segmentation matters when identity controls are not enough

The article’s emphasis on microsegmentation reflects a basic control reality: authentication proves an identity, but it does not limit blast radius once that identity is active. In contractor networks, lateral movement risk becomes acute when one compromised account can reach multiple systems carrying CUI or FCI. Segmentation changes the problem from broad trust to constrained reachability, so the security model depends on isolating assets and reducing the ability of a valid identity to move freely between zones.

Practical implication: Use network and workload segmentation to enforce access boundaries that remain effective even when an identity is compromised.

What annual affirmation and periodic assessment mean operationally

CMMC is not a one-time certification. The article makes clear that annual affirmations, self-assessments, third-party assessments and government-led assessments create a recurring evidence obligation. Operationally, this pushes teams to maintain continuous control state rather than assemble proof at assessment time. If logging, MFA, least privilege or incident response drift during the year, the organization can still fail even if the last assessment looked clean.

Practical implication: Treat CMMC evidence as a living control dataset, not an audit binder, and tie control drift monitoring to your identity and access programme.

Threat narrative

Attacker objective: The attacker objective is to move from initial access to protected contract information and broader contractor environment access with minimal resistance.

1. Entry occurs when an externally reachable contractor environment exposes systems that handle FCI or CUI without enough access boundary discipline.
2. Credential or account abuse then turns a valid identity into a pathway into higher-value systems, especially where authentication exists but reachability is broad.
3. Escalation and impact follow when the compromised identity can traverse poorly segmented environments and access protected contract data or adjacent assets.

Breaches seen in the wild

• reviewdog Action compromise 2025: A stolen maintainer token poisoned reviewdog/action-setup, leaking CI secrets including the tj-actions bot token used in the next attack.
• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

CMMC is forcing identity governance to become evidentiary, not aspirational. The framework’s value is not in the labels attached to its levels but in the requirement to prove access control, authentication, logging and segmentation across real contractor environments. That shifts IAM from policy ownership to control verification, which is exactly where many programmes are weakest. Practitioners should treat every CMMC requirement as an evidence-producing control, not a statement of intent.

Contractor identity sprawl: CMMC exposes how quickly access governance weakens when suppliers, subcontractors and service providers inherit the same trust model as employees. The article shows that the defence industrial base is now a multi-entity identity problem, not a single-organisation one. That makes offboarding, external access review and delegated administration central, because contract scope expands faster than manual governance can track. Practitioners should assume third-party access paths are part of the compliance boundary.

Authentication is necessary, but it is not the control that limits damage. The article’s focus on least privilege, boundary monitoring and isolation is the important signal here. MFA and individual identification help establish trust, but they do not stop lateral movement once an identity is valid. For IAM and PAM teams, CMMC strengthens the case for controls that constrain session reach and asset exposure, not just the login event itself. Practitioners should measure whether identity controls actually reduce blast radius.

CMMC will increasingly expose NHI governance gaps inside contractor environments. The article talks in human identity terms, but the same controls necessarily apply to service accounts, integrations and automated access paths that support CUI workflows. If those identities are not inventoried, authenticated, scoped and audited, they become invisible compliance liabilities. That makes NHI lifecycle management part of the CMMC conversation even when the framework does not name it explicitly. Practitioners should extend CMMC evidence collection to machine identities and service credentials.

Zero Trust controls are becoming a compliance enabler, not a design preference. The article’s emphasis on segmentation and isolation shows that CMMC is rewarding architectures that limit trust by default. That aligns with broader CMMC readiness because a control model that assumes constrained reachability is easier to attest than one that depends on implicit network trust. Practitioners should align identity boundaries, segmentation and audit logging so the architecture can support recurring assessments.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• The global average cost of a data breach reached $4.99 million in 2026, up 12% on the previous year, according to IBM's 2026 Cost of a Data Breach Report.
• Read next: Identity Security Programme Guide

What this signals

Contractor identity sprawl will become a recurring compliance problem. CMMC pushes organisations to govern external users, subcontractors and machine access as part of the same assurance boundary. If access paths are not inventoried and reviewed end to end, assessment evidence will lag the actual risk surface. The practical response is to tighten lifecycle controls around every identity that can touch contract data.

Identity controls must be measured by blast radius, not by login success. A mature CMMC programme does not stop at MFA or user authentication. It asks whether an authenticated identity can still move laterally, reach sensitive systems or bypass boundary controls once inside. Practitioners should treat segmentation and least privilege as the measurable outcome of identity governance.

Supply chain exposure remains the pressure point for defence contractors, with 92% of organisations exposing NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs. That figure reinforces why CMMC readiness now has to include service accounts, vendor integrations and other non-human access paths, not just employee accounts.

For practitioners

• Map CMMC controls to identity-owned evidence Assign clear owners for access control, authentication, logging and boundary protection evidence so assessment readiness does not depend on ad hoc document collection.
• Extend governance to non-human access paths Inventory service accounts, integrations and automated workflows that can reach FCI or CUI, then document their authentication, privilege scope and offboarding process.
• Build segmentation evidence into compliance testing Demonstrate that contractor systems handling sensitive information are isolated into enforceable zones, with access paths tested against lateral movement scenarios.
• Align assessment cadence with control drift monitoring Track annual affirmation, three-year assessment timing and internal control reviews together so expired evidence or drift is caught before certification risk appears.
• Prepare subcontractor access reviews for CMMC scope Include third-party access paths, external connections and delegated administration in the same review cycle as internal identities because the contract boundary is broader than the employee directory.

Key takeaways

• CMMC is turning identity and access control into a contractual obligation for defence suppliers, subcontractors and related service providers.
• The strongest compliance programmes will prove that authentication, logging, segmentation and privilege controls actually reduce exposure across real environments.
• NHI governance now sits inside the CMMC conversation because machine and service access paths can create the same assurance gaps as human accounts.

Key terms

• CMMC: CMMC is a US Department of Defense cybersecurity certification model for contractors that handle controlled information. It uses maturity levels and control requirements to determine whether an organisation can bid on or support defence work, with identity controls playing a central role in readiness.
• Federal Contract Information: Federal Contract Information is information created for or provided by the government under contract that is not intended for public release. It usually requires protection, but the control burden is lighter than CUI, which is why environment choice and access scoping can differ materially.
• Controlled Unclassified Information: Controlled Unclassified Information, or CUI, is sensitive federal information that must be protected according to defined handling rules outside federal systems. For practitioners, the key issue is not only storage security but also proving that every system, identity, and data path in scope preserves those rules.
• Defense Industrial Base: The Defense Industrial Base is the ecosystem of organisations that build, supply, support, and maintain products and services for defense missions. It includes primes and subcontractors, which means security obligations extend beyond the largest contractors to the smaller suppliers that can still hold sensitive information or access.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps security practitioners connect identity control design to the wider governance requirements that compliance programmes depend on.