Notifications
Clear all
Topic starter
12/06/2026 12:48 am
TL;DR: CMMC 2.0 turns access review, audit evidence, and lifecycle discipline into prerequisites for defence supply chain work, with Level 2 mapping to all 110 NIST SP 800-171 requirements and Level 3 adding NIST SP 800-172 controls, according to Zluri. The practical lesson is that certification readiness depends on identity governance maturity, not point tools or one-time cleanup.
NHIMG editorial — based on content published by Zluri: CMMC Compliance, an in-depth guide
By the numbers:
- Level 2 aligns with the 110 security requirements in NIST SP 800-171.
- Level 1 requires 17 basic cybersecurity practices derived from FAR Clause 52.204-21.
Questions worth separating out
Q: How should security teams prepare identity controls for CMMC compliance?
A: Start by scoping the systems, identities, and data that fall inside the CMMC boundary.
Q: What breaks when access reviews do not produce audit evidence for CMMC?
A: The review may still find problems, but it will not prove that the organisation acted on them.
Q: Why do identity lifecycle controls matter in defence supply chain compliance?
A: Because subcontractor, vendor, and internal access all affect the same CUI and FCI exposure path.
Practitioner guidance
- Map CMMC scope to identity systems first Identify which identities, applications, and data stores support FCI or CUI, then tie them to the specific CMMC level and assessment boundary before remediation starts.
- Turn access reviews into audit-ready evidence Capture reviewer decisions, exceptions, approvals, and remediation actions so every certification review leaves a traceable record for assessors.
- Operationalise POA&M ownership Assign each identity control gap to a named owner, due date, and verification step so remediation progress can be demonstrated instead of assumed.
What's in the full article
Zluri's full guide covers the operational detail this post intentionally leaves for the source:
- Step-by-step CMMC level selection guidance for contractors and subcontractors
- Detailed POA&M workflow examples for closing compliance gaps
- Access review automation examples tied to certification evidence
- Cost discussion covering assessments, remediation, and ongoing maintenance
👉 Read Zluri's guide to CMMC compliance and access control readiness →
CMMC compliance and access reviews: what IAM teams should change?
Explore further
12/06/2026 10:17 am
CMMC compliance is really an identity evidence problem. The article treats certification as a cybersecurity checklist, but the practical burden sits with who can access what, how that access is reviewed, and whether those decisions can be proven later. That is why IAM and IGA teams end up central to CMMC readiness, even when the business thinks of the programme as procurement compliance. Practitioners should read CMMC as evidence-heavy identity governance.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to Ultimate Guide to NHIs.
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
A question worth separating out:
Q: Which frameworks help translate CMMC into IAM practice?
A: NIST Cybersecurity Framework 2.0 and NIST SP 800-171 are the most useful anchors for turning CMMC requirements into identity controls. Use them to structure access governance, evidence collection, and remediation tracking, then verify that your internal processes can support assessment questions.
👉 Read our full editorial: CMMC compliance and identity governance: what teams need to know
