CMMC level 2 certification puts identity and evidence first

At a glance

What this is: Dragos describes how its public sector environment achieved CMMC Level 2 certification after a C3PAO assessment confirmed that controls for handling CUI were operating in practice.

Why it matters: This matters to IAM, PAM, and security governance teams because CMMC Level 2 turns identity, privileged access, logging, and evidence into auditable requirements rather than policy statements.

By the numbers:

• Dragos says its public sector environment passed with 110 of 110 security requirements and zero POA&Ms.
• The assessment covered 14 security requirement families, including access control, audit and accountability, and identification and authentication.

Context

CMMC Level 2 is not a paper exercise. It requires an organisation to prove that controls protecting Controlled Unclassified Information are implemented, operating, and supported by objective evidence across the assessed environment. In practice, that means identity controls, logging, configuration management, and secure remote access have to function as a system, not as separate checkboxes.

For identity and access teams, the important lesson is that compliance frameworks increasingly treat privileged access and authentication as verifiable operational controls rather than design intentions. That is why independent assessment matters in environments that handle CUI, especially where third-party service delivery, cloud hosting, and regulated customer obligations intersect.

Key questions

Q: What breaks when CMMC is treated as a documentation exercise instead of an operating control model?

A: When CMMC is treated as paperwork, organisations usually discover that their controls are inconsistent, their evidence is stale, and their access governance cannot support what the assessment asks for. The biggest failure is assuming policy equals implementation. Assessors look for proof that controls work in normal operations, which means access, logging, and data protection must be continuously evidenced.

Q: Why do identity controls matter so much in a CUI environment?

A: Identity controls determine who can enter the enclave, what they can do there, and whether access can be proven during assessment. If general-purpose identities, shared admin roles, or weak MFA rules cross the boundary, the enclave stops being a distinct control environment and becomes much harder to defend.

Q: How do organisations know if CMMC-related access controls are working?

A: They should be able to produce current access inventories, complete review records, exception histories, and offboarding evidence without reconstructing them manually. If assessors or internal auditors have to chase multiple systems to verify one account’s status, the control is operating with too much friction and too little assurance.

Q: How should teams prepare for recurring CMMC assessments?

A: Teams should run compliance as an operating cycle, not a project. That means testing access controls, change records, incident response evidence and maintenance processes on a recurring basis so control gaps are found before the assessor does. The goal is sustained proof of control, not a one-time pass.

Technical breakdown

Why CMMC Level 2 tests operating controls, not just documents

CMMC Level 2 is evidence-based assurance. Assessors review technical configurations, policies, procedures, and operational artefacts to confirm that the security requirements are actually being enforced. That distinction matters because a documented control that is not applied consistently does not protect CUI, even if it appears complete on paper. For identity programmes, the core issue is whether authentication, privileged access, logging, and configuration controls are provably active in the environment that processes regulated data. The assessment model is designed to expose drift between policy and practice. See the NIST SP 800-171 and CMMC 2.0 Guide.

Practical implication: Treat CMMC scoping as an operational evidence exercise, not a policy writing exercise.

How identity, MFA, and privileged access map to CUI protection

The article places identity, MFA, and privileged access at the centre of the assessed control set because CUI protection depends on restricting access to authorised users and approved systems. In practice, MFA alone is not enough if privileged accounts are over-broadened, poorly governed, or loosely scoped across systems that store or transmit regulated information. The governance question is whether the access model matches the sensitivity of the data path and whether the organisation can prove that only the right identities can perform the right actions at the right time. See the IAM and IGA Basics.

Practical implication: Review privileged access scope alongside authentication strength and evidence of enforcement.

Why logging, configuration management, and crypto controls have to work together

CMMC Level 2 assumes that no single control family can compensate for weak surrounding controls. Centralised logging helps show what happened, configuration management limits change-induced exposure, and cryptographic protections reduce the impact of data exposure when CUI is stored or transmitted. The article’s point is that these controls form an interdependent operating model, not isolated domains. That is especially relevant in cloud and regulated environments where security evidence must show that access restrictions, encryption, and monitoring are all active at the same time.

Practical implication: Align logging, configuration, and encryption evidence into one assessment-ready control narrative.

Threat narrative

Attacker objective: To reach regulated information paths by abusing weak identity, access, or operational controls in an environment that handles CUI.

1. Entry occurs through an assessed enterprise environment that must support CUI handling across cloud and access-controlled systems.
2. Escalation is constrained by identity, MFA, privileged access, logging, and configuration controls that must be proven in operation rather than assumed.
3. Impact is avoided when the environment can demonstrate that only authorised users and approved systems can process, store, and transmit CUI.

Breaches seen in the wild

• BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Evidence, not policy language, is the real control boundary in CMMC Level 2. The assessment model only has value if it distinguishes what is written from what is enforced. That matters for identity governance because privileged access, authentication, and logging are often the first controls to drift between design and execution. Practitioners should treat objective evidence as the operating standard, not the final audit binder.

Privileged access is now a compliance control, not just an internal security preference. When a framework ties CUI protection to demonstrable access control, the governance burden shifts from account issuance to sustained proof of least-privilege enforcement. That is why IAM and IGA basics remains relevant here: the same governance mechanics that manage people also have to govern machine and service access around regulated data. Practitioners should align access scope, review cadence, and evidence collection.

CMMC is increasingly a test of security operating discipline across cloud, identity, and logging layers. The article shows that certification depends on how controls reinforce each other, not on a single product or checklist. That makes regulated cloud environments a governance problem as much as a technical one, because control failures in one layer quickly weaken the credibility of the whole environment. Practitioners should build assessment readiness into day-to-day operations, not reserve it for certification season.

Independent validation is a useful forcing function for organisations that handle sensitive government data. Internal assurance can miss control drift, especially when teams rely on inherited cloud assurances or stale policy artefacts. A third-party assessment forces the organisation to prove that the current operating model matches the claimed control model. Practitioners should expect external scrutiny to expose process gaps that self-attestation can hide.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: NIST SP 800-171 and CMMC 2.0 Guide

What this signals

CMMC is becoming a governance test for evidence quality as much as a security test for access control. Teams that can only describe their controls will struggle when certification demands proof of operation, especially across regulated cloud environments and privileged pathways. The practical shift is toward continuous evidence capture, not periodic document refresh.

Identity controls sit inside the compliance boundary when regulated data is in scope. The more an environment handles CUI, the harder it becomes to treat MFA, privileged access, and account governance as separate from certification readiness. Practitioners should expect identity evidence to be reviewed alongside configuration and logging evidence, not after it.

Assessment readiness now depends on control integration, not isolated hardening. When access, logging, cryptography, and configuration are meant to support the same regulated workflow, weak linkage between them becomes an audit risk. Teams that map those dependencies early will find it easier to defend both CMMC readiness and day-to-day security posture.

For practitioners

• Document the exact CUI boundary Define which systems, users, and privileged pathways are in scope for CUI handling and make that boundary part of the assessment narrative.
• Collect operational evidence for identity controls Retain proof that MFA, privileged access restrictions, and account governance are actually enforced in the assessed environment.
• Align logging evidence to access decisions Show how centralised logs support review of authentication events, privileged actions, and configuration changes affecting CUI systems.
• Map your assessment scope to control families Track each requirement family to the systems and operating processes that demonstrate it in practice, rather than treating the checklist as documentation only.

Key takeaways

• CMMC Level 2 shifts the burden from stating controls to proving that they are operating across the environment that handles CUI.
• The article’s most important evidence point is the 110 of 110 result with zero POA&Ms, which shows there was no deferred remediation in the assessed scope.
• Identity, privileged access, logging, and configuration controls only satisfy the standard when they work together and can be demonstrated with objective evidence.

Related NHI Mgmt Group resources: NIST SP 800-171 and CMMC 2.0 Guide · CUI Guide · IAM and IGA Basics · FedRAMP Guide

Key terms

• Cmmc Level 2: A defence-contract compliance target that requires a defined set of security practices and supporting evidence. It goes beyond implementing controls in principle and expects organisations to show that the practices are operating consistently and are backed by documentation.
• Controlled Unclassified Information: Controlled Unclassified Information, or CUI, is sensitive federal information that must be protected according to defined handling rules outside federal systems. For practitioners, the key issue is not only storage security but also proving that every system, identity, and data path in scope preserves those rules.
• C3PAO: A C3PAO is a Certified Third-Party Assessor Organisation that evaluates whether an organisation meets CMMC requirements. Its role is to validate implementation through documentation, interviews, and testing, which means organisations must be able to demonstrate controls rather than simply describe them.
• Zero POA&M: Zero POA&M means no Plans of Action and Milestones remained open at the time of assessment. The control set was already in place, rather than being accepted as future remediation. For regulated environments, that signals completed implementation rather than deferred compliance work.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader programmes that have to stand up to scrutiny.