CMMC level 2: what public sector teams need to prove

TL;DR: Its public sector environment achieved CMMC Level 2 certification with 110 of 110 NIST SP 800-171 requirements met and zero POA&Ms, according to Dragos, showing that documentation alone is not enough when CUI controls must operate in practice. Independent validation matters because access, logging, cryptography, and configuration controls have to be evidenced, not assumed.

Editorial analysis by NHI Mgmt Group, based on content published by Dragos: “Dragos Public Sector Achieves CMMC Level 2 Certification”.

By the numbers:

• Dragos says its public sector environment passed with 110 of 110 security requirements and zero POA&Ms.
• The assessment covered 14 security requirement families, including access control, audit and accountability, and identification and authentication.

Key questions

Q: What breaks when CMMC is treated as a documentation exercise instead of an operating control model?

A: When CMMC is treated as paperwork, organisations usually discover that their controls are inconsistent, their evidence is stale, and their access governance cannot support what the assessment asks for.

Q: Why do identity controls matter so much in a CUI environment?

A: Identity controls determine who can enter the enclave, what they can do there, and whether access can be proven during assessment.

Q: How do organisations know if CMMC-related access controls are working?

A: They should be able to produce current access inventories, complete review records, exception histories, and offboarding evidence without reconstructing them manually.

Practitioner guidance

• Document the exact CUI boundary Define which systems, users, and privileged pathways are in scope for CUI handling and make that boundary part of the assessment narrative.
• Collect operational evidence for identity controls Retain proof that MFA, privileged access restrictions, and account governance are actually enforced in the assessed environment.
• Align logging evidence to access decisions Show how centralised logs support review of authentication events, privileged actions, and configuration changes affecting CUI systems.

Bottom line: CMMC Level 2 shifts the burden from stating controls to proving that they are operating across the environment that handles CUI.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →