Topic starter
25/10/2026 11:04 am
TL;DR: CMMC Level 2 certification reached 110 of 110 NIST SP 800-171 requirements with zero POA&Ms in Dragos's public sector environment, according to Dragos. CUI controls have to be evidenced in operation, not just described on paper.
Editorial analysis by NHI Mgmt Group, based on content published by Dragos: “Dragos Public Sector Achieves CMMC Level 2 Certification”.
By the numbers:
- Dragos says its public sector environment passed with 110 of 110 security requirements and zero POA&Ms.
- The assessment covered 14 security requirement families, including access control, audit and accountability, and identification and authentication.
Key questions
Q: Why do identity controls matter so much in a CUI environment?
A: Identity controls determine who can enter the enclave, what they can do there, and whether access can be proven during assessment.
Q: How do organisations know if CMMC-related access controls are working?
A: They should be able to produce current access inventories, complete review records, exception histories, and offboarding evidence without reconstructing them manually.
Q: What breaks when CMMC is treated as a documentation exercise instead of an operating control model?
A: When CMMC is treated as paperwork, organisations usually discover that their controls are inconsistent, their evidence is stale, and their access governance cannot support what the assessment asks for.
Practitioner guidance
- Document the exact CUI boundary Define which systems, users, and privileged pathways are in scope for CUI handling and make that boundary part of the assessment narrative.
- Collect operational evidence for identity controls Retain proof that MFA, privileged access restrictions, and account governance are actually enforced in the assessed environment.
- Align logging evidence to access decisions Show how centralised logs support review of authentication events, privileged actions, and configuration changes affecting CUI systems.
Bottom line: CMMC Level 2 shifts the burden from stating controls to proving that they are operating across the environment that handles CUI.
Glossary terms: Cmmc Level 2, Controlled Unclassified Information, C3PAO, Zero POA&M
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:18 pm
Evidence, not policy language, is the real control boundary in CMMC Level 2. The assessment model only has value if it distinguishes what is written from what is enforced. That matters for identity governance because privileged access, authentication, and logging are often the first controls to drift between design and execution. Practitioners should treat objective evidence as the operating standard, not the final audit binder.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How should teams prepare for recurring CMMC assessments?
A: Teams should run compliance as an operating cycle, not a project. That means testing access controls, change records, incident response evidence and maintenance processes on a recurring basis so control gaps are found before the assessor does. The goal is sustained proof of control, not a one-time pass.
👉 Read our full editorial: CMMC level 2 certification puts identity and evidence first
This post was modified 7 days ago by NHI Mgmt Group