Notifications
Clear all
Topic starter
11/07/2026 8:35 pm
TL;DR: CMMC 2.0 is now enforced under the Final Rule, and Exostar says contractors must align Level 1 to Level 3 requirements, subcontractor flow-down obligations, and SPRS expectations before award decisions are made. The practical question is no longer whether CMMC applies, but whether identity, evidence, and access controls are mature enough to prove compliance on demand.
NHIMG editorial — based on content published by Exostar: Answering the Top 10 Questions from Our CMMC Readiness Webinar
By the numbers:
- Only 5.7% of organisations have full visibility into their service accounts.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
Questions worth separating out
Q: What breaks when CMMC scope is based on legacy markings instead of contract language?
A: Scope becomes unreliable because labels like ITAR or FOUO do not automatically define CUI under the DoD framework.
Q: Why do CUI handling and access control matter together under CMMC?
A: Because CMMC is tested through both data handling and identity evidence.
Q: What do organisations get wrong about SPRS readiness?
A: They treat the score as the objective instead of the evidence behind it.
Practitioner guidance
- Re-scope CUI against contract language Review each active and upcoming DoD contract, map the data elements that are actually in scope, and record the decision in the SSP with supporting justification.
- Centralise assessment evidence Keep policies, control test results, access records, and assessment artefacts in one evidence model so the CMMC assessment guide and technical evaluation method point to the same source of truth.
- Replace email CUI exchange with controlled sharing Use authenticated file transfer paths with audit logging, expiry, and download controls for CUI, especially when sharing with primes or subcontractors.
What's in the full article
Exostar's full blog covers the operational detail this post intentionally leaves for the source:
- The full CMMC Q&A breakdown for legacy markings, CUI scope, and subcontractor obligations.
- The assessment guidance for selecting between the CMMC 2.0 Assessment Guide and NIST SP 800-171A Rev. 2.
- The secure file-sharing and SPRS workflow examples that practitioners need when moving from readiness planning to execution.
👉 Read Exostar's CMMC readiness Q&A for Defense Industrial Base contractors →
CMMC final rule enforcement: are your readiness controls actually enough?
Explore further
11/07/2026 9:03 pm
CMMC readiness is fundamentally an identity governance problem, not just a compliance exercise. The article’s emphasis on scoping, evidence, and secure collaboration shows that contract compliance depends on who can access controlled data, how that access is proven, and whether those decisions survive audit scrutiny. That makes identity lifecycle, external access, and evidence integrity part of the same control plane. Practitioners should treat CMMC as governance over access, not paperwork around controls.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- A separate NHIMG finding shows that 91.6% of secrets remain valid five days after notification, which underscores how slow revocation makes governance claims brittle.
A question worth separating out:
Q: Who is accountable when subcontractor access to CUI is left standing after contract changes?
A: The prime remains accountable for flow-down governance, but the subcontractor’s access model still has to support offboarding, least privilege, and auditability. If third-party access remains active after the work ends, the contractual control failure is shared across the chain.
👉 Read our full editorial: CMMC readiness after final rule enforcement: what changes now
