How to prepare identity evidence for CMMC access control requirements

If your architecture, engineering or construction firm handles controlled unclassified information (CUI) on defense work, identity controls decide a large share of your NIST SP 800-171 score. Assessors do not take a policy at its word. They compare your account list to HR records, look at sign-in settings, and watch someone log in. This guide covers the evidence to assemble for the access control and identification and authentication requirements, and how to keep it current.

Which CMMC requirements depend on identity evidence?

Mostly the Access Control (AC) and Identification and Authentication (IA) families of NIST SP 800-171 Rev 2, plus requirement 3.9.2 on personnel actions. Rev 2 is the version DoD assesses against today, and CMMC Level 2 uses its 110 requirements.

The requirements that rest most heavily on identity records are:

• 3.1.1: limit system access to authorized users, processes acting on behalf of users, and devices.
• 3.1.5: least privilege, including for privileged accounts and security functions.
• 3.1.7, 3.1.8, 3.1.10 and 3.1.11: privileged functions, failed logon limits, session lock and session termination.
• 3.5.1 and 3.5.2: identify and authenticate every user, process and device before granting access.
• 3.5.3: multifactor authentication for privileged accounts and for network access to all accounts.
• 3.9.2: terminate access and credentials when people leave or change roles.

Why do identity gaps cost so many points?

Because several of these requirements carry the highest weights in the scoring method. Under 32 CFR 170.24, requirements 3.1.1, 3.1.2, 3.5.1, 3.5.2 and 3.5.10 are each worth 5 points, and 3.1.5 is worth 3. MFA under 3.5.3 costs 5 points if missing entirely and 3 if it covers only remote and privileged users.

Those values also limit your options. 32 CFR 170.21 allows only 1-point requirements on a plan of action and milestones (POA&M), with one exception for encryption. A firm missing MFA or a clean account inventory cannot defer the fix to a POA&M and still claim Conditional status.

Does this still matter while CMMC Phase 2 is suspended?

Yes. On July 13, 2026, the Department of War suspended the move to Phase 2, which would have started C3PAO certification requirements on November 10, 2026. The same announcement states that Phase 1 self-assessment requirements remain in place and that DFARS 252.204-7012 obligations continue. At the time of writing, the department had not announced a new Phase 2 date.

Under DFARS 252.204-7019, a current NIST SP 800-171 assessment score must be posted in SPRS for covered contracts. Where a contract calls for a CMMC Level 2 self-assessment, 32 CFR 170.16 requires it every three years, with an affirmation at each assessment and annually after that. Every one of those affirmations depends on the identity controls below working as described.

What will an assessor examine for access control?

An approved policy, a system security plan that describes how each requirement is met, and records that show the policy in practice. DoD's CMMC Assessment Guide for Level 2 lists the documents an assessor may examine for 3.1.1. They include a list of active system accounts with the individual tied to each, records of recently transferred or terminated employees, recently disabled accounts, access authorization records and account management reviews.

The assessment objectives in NIST SP 800-171A break 3.1.1 into six determinations: authorized users, processes and devices are each identified, and access is limited to each. If one objective is not satisfied, the requirement is NOT MET. That is why a list of human users alone falls short. Service accounts, scheduled tasks, integrations and enrolled devices belong in the inventory too.

For least privilege under 3.1.5, expect questions about which accounts are privileged, who approved them, and which security functions (firewall consoles, endpoint management, backup administration) are restricted. A list of administrators with an approval record for each is the core artifact.

What evidence proves MFA is in place?

Configuration records showing that MFA is enforced for each type of access 3.5.3 names. NIST SP 800-171A splits the requirement into four objectives: privileged accounts are identified, and MFA is implemented for local access to privileged accounts, network access to privileged accounts and network access to non-privileged accounts.

Local access to privileged accounts is the objective most often missed. A firm can enforce MFA on Microsoft 365 sign-in and still let an administrator log on to a server console with a password alone. Evidence should cover:

• Conditional access or equivalent policies that require MFA, with any exclusions listed and justified.
• A report of MFA registration by account, showing no CUI user without a second factor.
• Settings that require MFA for administrator logons to servers, hypervisors and network devices.
• Sign-in logs that show MFA prompts actually being satisfied.

For guidance on choosing the method itself, see phishing-resistant MFA for CMMC.

How do you prove access ends when someone leaves?

By pairing HR records with account records so an assessor can trace each departure to a disabled account and revoked credentials. NIST SP 800-171A asks whether a process for terminating access coincident with personnel actions exists, whether access was actually terminated, and whether systems were protected during and after transfers.

The examine list for 3.9.2 includes records of personnel transfer and termination actions, a list of system accounts, and records of terminated or revoked authenticators. In practice, that means a short offboarding log with dates, the accounts disabled, the MFA methods removed, and the person who did the work. Role changes need the same treatment. A project manager who moves off a defense job should lose access to that project's CUI.

Will screenshots be enough?

Rarely. The Assessment Guide describes three methods: examine, interview and test. Screenshots support the examine method, but an assessor may also interview the administrator who manages accounts and test a control by attempting a logon or checking a live setting. The guide also states that drafts and unapproved policies are not acceptable evidence.

Evidence works best when it can be regenerated on request. A report exported from your identity platform with a date stamp, tied to a written procedure, holds up better than a folder of images captured once. If you are preparing for a Level 2 self-assessment, 32 CFR 170.16 requires the artifacts used as evidence to be kept for six years from the CMMC Status Date.

What should your firm do this quarter?

Build an identity evidence package that holds up when an assessor tests it:

• Export every account in the CUI environment, including service and shared accounts, and tie each one to a named owner or documented process.
• Reconcile that list against current HR records and disable anything without a match.
• List privileged accounts and attach an approval for each, then confirm administrators use separate non-privileged accounts for daily work, as requirement 3.1.6 expects.
• Confirm MFA covers local and network access to privileged accounts and network access to all others, and record any exclusions.
• Document failed logon limits, session lock time and session termination conditions in the system security plan, and confirm the settings match.
• Start an offboarding and role change log, and review it alongside a quarterly access review.
• Store dated exports in a location that cannot be edited, sized for the six-year retention period.

If your SPRS score was calculated before these checks, recalculate it. Our guide to SPRS gaps during the CMMC pause covers how to prioritize what is left.

How does s90 help?

s90 runs identity posture reviews for AEC firms working on defense contracts. We map your accounts, administrators and MFA coverage to the NIST SP 800-171 requirements, produce dated reports you can hand to an assessor, and keep them current as staff come and go. If you want a second look before your next affirmation, we are glad to talk it through.