Notifications
Clear all
Topic starter
12/06/2026 12:48 am
TL;DR: CMMC compliance is a U.S. Department of Defense supply-chain framework that pushes contractors and subcontractors to prove they can protect FCI and CUI through maturity, documentation, and access control discipline, according to Zluri. For identity teams, the practical issue is not certification alone but whether access review, least privilege, and lifecycle processes are actually operating at audit depth.
NHIMG editorial — based on content published by Zluri: CMMC compliance, an in-depth guide
By the numbers:
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
- Level 2 requires all 110 security requirements from NIST SP 800-171.
- Level 1 certification requires 17 basic cybersecurity practices.
Questions worth separating out
Q: What breaks when CMMC access reviews are manual and incomplete?
A: Manual or incomplete access reviews create a documentation gap that can fail both security and certification objectives.
Q: Why do defence suppliers need stronger identity governance for CMMC?
A: CMMC ties contractual eligibility to the organisation’s ability to govern access to FCI and CUI.
Q: How do organisations know if CMMC-related access controls are working?
A: They should be able to produce current access inventories, complete review records, exception histories, and offboarding evidence without reconstructing them manually.
Practitioner guidance
- Baseline all CMMC-scoped identities Inventory workforce, contractor, subcontractor, and service identities that can touch FCI or CUI, then tag each entitlement to the relevant contract or data set for audit traceability.
- Convert access reviews into evidence packs Capture reviewer, approver, entitlement rationale, and remediation outcome for each certification cycle so the next assessor can trace decisions without manual reconstruction.
- Use POA&M items to drive identity remediation Track every missing review, unrevoked account, and undocumented exception as a dated remediation item with an owner and closure evidence.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- A breakdown of the three CMMC levels and the associated requirements for each certification tier
- A practical self-assessment checklist for mapping current controls to CMMC readiness
- A POA&M workflow for documenting gaps, milestones, and remediation ownership
- A closer look at how Zluri positions access review automation in the certification process
👉 Read Zluri's guide to CMMC compliance requirements and access review planning →
CMMC compliance and access reviews: what IAM teams need to know?
Explore further
12/06/2026 10:17 am
CMMC is really an identity governance test disguised as a compliance framework. The article focuses on certification, but certification lives or dies on whether access can be explained, reviewed, and revoked across users, vendors, and contractors. That puts IAM, IGA, and third-party access governance in the middle of defence supply-chain assurance. Practitioners should treat CMMC readiness as evidence-backed access governance, not as a standalone security checklist.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, according to Ultimate Guide to NHIs.
A question worth separating out:
Q: Who is accountable when subcontractor access remains open after a project ends?
A: The prime contractor remains accountable for proving that delegated access was removed or reduced at the right time, even when the access sat with a third party. In CMMC terms, accountability follows the organisation that claims compliance, not the external party that received the access.
👉 Read our full editorial: CMMC compliance exposes the identity governance gap in defence supply chains
