Topic starter
08/04/2026 3:07 pm
TL;DR: Teleport says CMMC assessments often fail when organisations cannot prove controls, and AI systems make that harder by introducing borrowed credentials, weak audit trails, and undocumented service identities. The core issue is no longer whether a control exists, but whether AI activity can be evidenced end to end inside the compliance boundary.
Editorial analysis by NHI Mgmt Group, based on content published by Teleport: “CMMC Requirements for AI Systems: What Assessors Actually Look For”.
Key questions
Q: What breaks when an AI system uses borrowed user credentials for CMMC-scoped work?
A: Borrowed credentials break attribution, least-privilege review, and identity-bound audit evidence.
Q: Why do AI workflows create audit gaps in CMMC evidence?
A: They create audit gaps when the organisation logs only the prompt and the final output, not the intermediate tool calls, retrievals, and API actions.
Q: How should teams prove AI identity and authentication for CMMC?
A: Teams should inventory every AI service identity, show how it authenticates, and demonstrate that it is covered by the same governance model used for other non-human identities.
Practitioner guidance
- Inventory AI systems as in-scope identities List every assistant, agent, and automated workflow that can reach CUI, then assign each one a distinct service identity with documented ownership, scope, and data access boundaries.
- Bind tool calls to session-level audit records Capture every retrieval, query, and API call made by the AI workflow so an assessor can reconstruct the full sequence from user prompt to data access to output.
- Include service accounts in access review cycles Review AI service identities on the same cadence as human accounts, and retain dated evidence showing who approved the access and why it remained necessary.
Bottom line: AI systems expose a fundamental CMMC problem: organisations often have controls on paper but cannot prove how those controls behaved in a real session.
What's in the full article
Teleport's full blog post covers the operational detail this post intentionally leaves for the source:
- Screenshots and evidence examples for AC, AU, and IA assessments involving AI systems
- The exact AI identity patterns assessors object to, including borrowed credentials and shared service accounts
- How to structure SSP documentation so AI tools are explicitly in scope for CUI handling
- Teleport-specific implementation details for session logging, short-lived certificates, and agent identity
👉 Read Teleport's analysis of CMMC requirements for AI systems and IAM evidence gaps →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
07/10/2026 7:11 pm
AI systems turn CMMC from a control existence test into a proof-of-operation test. The article’s core point is that policy language is no longer enough once AI enters the boundary. Assessors want corroborated evidence across access, logging, and authentication, and AI often weakens all three at once. The consequence is that compliance teams must treat identity evidence as an operational dataset, not a document set. Practitioners should expect evidence quality, not policy intent, to drive assessment outcomes.
A question worth separating out:
Q: What CMMC control evidence should be added when AI touches CUI?
A: Add evidence that connects identity, access, and activity for every AI-assisted workflow. That means account inventories for service identities, documented access scopes, tool call logs, and session records that show exactly what data was accessed and who approved the access model.
👉 Read our full editorial: CMMC requirements for AI systems expose evidence gaps in IAM