Topic starter
10/07/2026 9:19 pm
TL;DR: Phase 2 of CMMC begins on November 10, 2026 with mandatory third-party Level 2 assessments for prioritized contracts, pushing defense contractors to prove access control, segmentation, logging, and identity enforcement in live environments, according to Appgate. The practical shift is from documented intent to auditable execution, which makes implicit-trust access models harder to defend.
Editorial analysis by NHI Mgmt Group, based on content published by Appgate: “Why the November 2026 CMMC Phase 2 Deadline Is Driving Access Security Changes Now”.
Key questions
Q: What breaks when CMMC Level 1 controls are only partially implemented across an environment?
A: Partial implementation creates a false sense of compliance.
Q: Why do broad VPN access models create more CMMC risk?
A: Broad VPN access expands trust beyond the task that needs to be performed, which makes least privilege, segmentation and auditability harder to prove.
Q: How should contractors prove access control during a CMMC Level 2 assessment?
A: They should present evidence that access decisions were identity-based, resource-specific and consistently monitored across the environment.
Practitioner guidance
- Assess access proof gaps against CMMC readiness Review where policies describe least privilege, segmentation and monitoring, but operational evidence does not show consistent enforcement across real user sessions.
- Map remote access to explicit resources Replace broad network reach with resource-specific access paths so each protected system has a clearly documented policy, control point and audit trail.
- Tighten third-party and subcontractor access lifecycles Verify that external users, vendors and subcontractors are approved, scoped and removed through the same lifecycle discipline used for internal identities.
Bottom line: CMMC Phase 2 raises the bar from written access policy to observable enforcement across production environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:42 pm
Phase 2 turns access security into an evidence discipline. CMMC Level 2 assessments are not asking whether organisations have policies that mention access control. They are asking whether the controls actually constrain real sessions, real users and real environments in a way a third-party assessor can verify. That makes access governance a production-state question, not a documentation exercise. Practitioners should assume the assessor will test operational consistency, not intent.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do first to prepare access controls for CMMC Phase 2?
A: Start by identifying where network-level trust still substitutes for explicit access policy, then close the biggest evidence gaps in remote access, third-party connectivity and sensitive environment segmentation. The first priority is not new documentation, but demonstrable control enforcement.
👉 Read our full editorial: CMMC phase 2 makes access security a proof point, not a policy