CMMC compliance and access reviews: what IAM teams should change

TL;DR: CMMC 2.0 turns access review, audit evidence, and lifecycle discipline into prerequisites for defence supply chain work, with Level 2 mapping to all 110 NIST SP 800-171 requirements and Level 3 adding NIST SP 800-172 controls, according to Zluri. The practical lesson is that certification readiness depends on identity governance maturity, not point tools or one-time cleanup.

NHIMG editorial — based on content published by Zluri: CMMC Compliance, an in-depth guide

By the numbers:

• Level 2 aligns with the 110 security requirements in NIST SP 800-171.
• Level 1 requires 17 basic cybersecurity practices derived from FAR Clause 52.204-21.

Questions worth separating out

Q: How should security teams prepare identity controls for CMMC compliance?

A: Start by scoping the systems, identities, and data that fall inside the CMMC boundary.

Q: What breaks when access reviews do not produce audit evidence for CMMC?

A: The review may still find problems, but it will not prove that the organisation acted on them.

Q: Why do identity lifecycle controls matter in defence supply chain compliance?

A: Because subcontractor, vendor, and internal access all affect the same CUI and FCI exposure path.

Practitioner guidance

• Map CMMC scope to identity systems first Identify which identities, applications, and data stores support FCI or CUI, then tie them to the specific CMMC level and assessment boundary before remediation starts.
• Turn access reviews into audit-ready evidence Capture reviewer decisions, exceptions, approvals, and remediation actions so every certification review leaves a traceable record for assessors.
• Operationalise POA&M ownership Assign each identity control gap to a named owner, due date, and verification step so remediation progress can be demonstrated instead of assumed.

What's in the full article

Zluri's full guide covers the operational detail this post intentionally leaves for the source:

• Step-by-step CMMC level selection guidance for contractors and subcontractors
• Detailed POA&M workflow examples for closing compliance gaps
• Access review automation examples tied to certification evidence
• Cost discussion covering assessments, remediation, and ongoing maintenance

👉 Read Zluri's guide to CMMC compliance and access control readiness →

CMMC compliance and access reviews: what IAM teams should change?

Explore further

View Full Forum →  |  NHI Foundation Course →