# Defense Contractors Strengthen Access Controls

CMMC Level 2 access control is a significant assessment risk for defense contractors because it covers 22 of the 110 requirements in NIST SP 800-171, and assessors expect evidence that controls operate in practice—not policies alone. The signal identifies no specific solicitation, contract, award value, or procurement deadline; its relevance is contractors’ ability to demonstrate access-control practices during CMMC assessments and support DoD work.

- Contractors should prioritize account-privilege reviews, identity-scoped access instead of broad VPN reach, and consistent monitoring of sessions and remote access.
- Organizations should document who owns and manages subcontractor access so those controls can be demonstrated during assessment.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity
**Published:** October 07, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- National Institute of Standards and Technology (NIST)

### Sources
- [CMMC Access Control: Why This Domain Trips Up Contractors
](https://www.smithers.com/resources/2026/october/access-control-the-cmmc-domain-that-trips-up-most) - Smithers