CMMC phase 2 makes access security a proof point, not a policy

At a glance

What this is: This is an Appgate analysis of how CMMC Phase 2 changes the assessment bar for defence contractors, with access control, identity verification and segmentation moving from policy topics to operational proof.

Why it matters: It matters because IAM, PAM and security architects supporting federal contractors will need to show that access decisions are enforced consistently across users, devices, remote access and third-party connections.

Context

CMMC Phase 2 is the point where defence contractors must show that access control is actually operating, not merely documented. The article frames the problem as a shift from paper compliance to evidence that controls work in production across users, devices, third parties and sensitive environments.

For identity and access teams, the practical issue is that traditional network-centric access models can make least privilege, segmentation and auditability harder to demonstrate during third-party assessments. That creates a direct governance problem for organisations handling Controlled Unclassified Information in distributed, hybrid and supplier-heavy environments.

Key questions

Q: What breaks when CMMC Level 1 controls are only partially implemented across an environment?

A: Partial implementation creates a false sense of compliance. At Level 1, every requirement and assessment objective must be met, and no Plan of Action and Milestones is allowed for unmet items. If even one control is missing, the organisation cannot score the assessment as complete, cannot affirm compliance, and may receive no CMMC status in SPRS.

Q: Why do broad VPN access models create more CMMC risk?

A: Broad VPN access expands trust beyond the task that needs to be performed, which makes least privilege, segmentation and auditability harder to prove. In a CMMC assessment, that broad reach can undermine evidence that sensitive environments were kept constrained and that lateral movement was controlled.

Q: How should contractors prove access control during a CMMC Level 2 assessment?

A: They should present evidence that access decisions were identity-based, resource-specific and consistently monitored across the environment. That means showing policy enforcement, authentication records, segmentation boundaries and logs that connect each session to the approved scope of access.

Q: What should organisations do first to prepare access controls for CMMC Phase 2?

A: Start by identifying where network-level trust still substitutes for explicit access policy, then close the biggest evidence gaps in remote access, third-party connectivity and sensitive environment segmentation. The first priority is not new documentation, but demonstrable control enforcement.

Technical breakdown

Why implicit trust breaks under CMMC assessments

Traditional VPN-centric access models assume that once a user authenticates, broad network reach is acceptable. That assumption conflicts with CMMC Phase 2 because assessors are looking for evidence of identity verification, least privilege, segmentation and monitored access in real environments. The technical problem is not only reachability, but the mismatch between coarse network trust and the need to prove controlled access paths for sensitive information. In practice, broad connectivity makes it harder to show who accessed what, from where, and under which policy conditions.

Practical implication: re-evaluate any access architecture that grants network-level visibility broader than the task requires.

How ZTNA changes the access enforcement model

Zero Trust Network Access replaces network adjacency with resource-specific authorisation. Instead of placing a user on the network and trusting subsequent movement, access is granted only to explicitly approved services based on identity, device posture and policy. That matters for CMMC because it creates a more auditable control boundary around remote access, subcontractor connectivity and segmented environments. The value is not the label, but the proof trail: access can be tied to narrower policy decisions rather than implicit network membership.

Practical implication: map each protected resource to an explicit access policy and document the enforcement points assessors will ask to see.

What auditability means for identity and lateral movement controls

Auditability in this context is not log volume. It is the ability to show that access was consistently restricted, authenticated and monitored across the full session path. CMMC’s concern with lateral movement means organisations must demonstrate that sensitive environments are not reachable simply because a user authenticated somewhere upstream. For contractor ecosystems, that also extends to third-party and subcontractor access, where identity assurance and connection controls must remain visible enough for assessment evidence.

Practical implication: treat logging, segmentation and external access governance as one evidence package, not separate security tasks.

NHI Mgmt Group analysis

Phase 2 turns access security into an evidence discipline. CMMC Level 2 assessments are not asking whether organisations have policies that mention access control. They are asking whether the controls actually constrain real sessions, real users and real environments in a way a third-party assessor can verify. That makes access governance a production-state question, not a documentation exercise. Practitioners should assume the assessor will test operational consistency, not intent.

Legacy broad-access architectures create proof gaps, not just risk gaps. VPN-style connectivity and other implicit-trust patterns may satisfy connectivity needs, but they often fail the assessment story because they blur least privilege, segmentation and accountability. The issue is not only exposure, it is the inability to produce convincing evidence that access was narrowed to the required scope. Security teams should treat proofability as a design requirement, not a retrospective reporting problem.

Access security for the DIB is now a lifecycle issue across humans, contractors and third parties. CMMC’s operational enforcement model exposes the same governance weakness across joiner-mover-leaver processes, remote access approvals and subcontractor offboarding. Access that persists beyond its business need undermines both compliance and containment. That means identity lifecycle discipline, not just network controls, becomes part of the assessment surface.

Segment-of-one thinking will matter more than perimeter thinking. The article’s emphasis on segmentation and lateral movement reduction points to a broader market shift toward task-scoped access rather than environment-wide entitlement. For organisations handling CUI, the decisive question is whether each access path can be bounded tightly enough to survive third-party review. That is the difference between claiming Zero Trust principles and proving them under CMMC scrutiny.

From our research library:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: Third-Party, B2B and Contractor Access Guide

What this signals

Access proof, not access policy, is the new benchmark: organisations should assume assessors will ask for evidence that user, device and third-party access was constrained in production, not just described in a control narrative. That pushes IAM, PAM and network security teams into a single proof chain where policy, enforcement and logging must line up.

Third-party access becomes part of the control boundary: CMMC Phase 2 makes subcontractor and vendor connectivity an assessment issue, not a side concern. 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.

Least privilege must be auditable at session level: access models that cannot show what was allowed, for whom, and under which policy conditions will struggle in operational assessments. The practical shift is from identity as a login event to identity as a continuously enforced control state.

For practitioners

• Assess access proof gaps against CMMC readiness Review where policies describe least privilege, segmentation and monitoring, but operational evidence does not show consistent enforcement across real user sessions.
• Map remote access to explicit resources Replace broad network reach with resource-specific access paths so each protected system has a clearly documented policy, control point and audit trail.
• Tighten third-party and subcontractor access lifecycles Verify that external users, vendors and subcontractors are approved, scoped and removed through the same lifecycle discipline used for internal identities.
• Test segmentation evidence before the assessment window Validate that sensitive CUI environments are isolated enough to show a C3PAO how lateral movement is constrained and how access events are recorded.
• Align logging with access decisions Ensure logs show who was authorised, what resource was reached and which policy allowed it, so monitoring supports the assessment narrative rather than merely collecting events.

Key takeaways

• CMMC Phase 2 raises the bar from written access policy to observable enforcement across production environments.
• Broad trust models make least privilege, segmentation and monitoring harder to prove during third-party assessments.
• Organisations that can evidence resource-specific access, external access governance and logging will be better positioned for Level 2 reviews.

Key terms

• CMMC Phase 2: CMMC Phase 2 is the part of the Department of War’s rollout that would move contractors toward third-party assessments for higher assurance. In this article, it is paused for review, but that does not eliminate existing cybersecurity obligations or the need to maintain readiness for future enforcement changes.
• C3PAO: A C3PAO is a Certified Third-Party Assessor Organisation that evaluates whether an organisation meets CMMC requirements. Its role is to validate implementation through documentation, interviews, and testing, which means organisations must be able to demonstrate controls rather than simply describe them.
• Zero Trust Network: A Zero Trust Network is a network security approach that does not trust users, devices, or traffic by default. Every connection is continuously verified using identity, device posture, context, and policy before access is granted. It assumes breach, limits lateral movement, and treats network access as conditional rather than implicit.
• Controlled Unclassified Information: Controlled Unclassified Information, or CUI, is sensitive federal information that must be protected according to defined handling rules outside federal systems. For practitioners, the key issue is not only storage security but also proving that every system, identity, and data path in scope preserves those rules.

Deepen your knowledge

NHI governance, IAM, and identity lifecycle management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.