# CMMC Stakeholders Evaluate Air-Gapped IAM

A discussion about CMMC Level 2 environments assesses whether a self-hosted, cloud-independent identity and access management (IAM) platform can support systems handling controlled unclassified information (CUI) when a true air gap rules out cloud identity services. Suitability depends on how the identity provider is treated within the system boundary and whether organizations can demonstrate effective operational controls and assessment evidence—not simply on product features. The discussion also identifies an unresolved question about reporting to the Defense Cyber Crime Center (DC3) using a medium security certificate.

- Procurement teams and contractors evaluating IAM solutions should assess the identity provider’s treatment as a Security Protection Asset and verify the system’s boundary, controls, and evidence against their CMMC assessment needs.
- Solution evaluations should address disconnected identity lifecycle management, patching, certificate issuance, renewal and revocation, certificate revocation list distribution, time synchronization, log handling, and recovery.
- The DC3 reporting question using a medium security certificate remains unresolved in the signal; organizations considering such reporting should validate the applicable method rather than assume an air-gapped deployment supports it.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 08, 2026

### Government Entities
- National Institute of Standards and Technology (NIST)
- Defense Cyber Crime Center (DC3)

### Key Quotes
> The hard parts are lifecycle, not login. Certificate issuance, renewal, and revocation without OCSP. CRL distribution that actually reaches every relying party. Time sync so Kerberos and TOTP do not drift.
> — Community commenter

### Sources
- [Looking for feedback on an on-prem/air-gapped IAM approach for CMMC environments](https://www.reddit.com/r/CMMC/comments/1x0d3ux/looking_for_feedback_on_an_onpremairgapped_iam) - reddit-cmmc