# Small Contractors Document CMMC Separation Controls

A discussion among small defense contractors and CMMC practitioners examines how an organization with a single IT administrator can demonstrate AC.L2-3.1.4 separation of duties. Participants generally consider documented management or change control board approval, separate from IT implementation, a reasonable way to show oversight. They also suggest protected audit logs and targeted independent review as supporting evidence, while noting uncertainty about what individual assessors may expect; one participant said an unfavorable assessment led them to hire an assistant.

- Small contractors can document who approves changes and who implements them, and retain protected audit logs as evidence of oversight.
- Targeted independent review may strengthen the evidence, but the discussion does not establish it as a universal scheduled-review requirement; assessors’ expectations may vary.
- Contractors preparing for CMMC assessments should map their actual staffing and approval process to AC.L2-3.1.4 and be ready to explain how the control works with a one-person IT function.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 22, 2026

### Key Quotes
> Nothing in the CMMC Assessment Guide says a scheduled review is required for 3.1.4, so I can’t promise your assessor will ask for one.
> — Community commenter

### Sources
- [AC. L2-3.1.4 Separation of Duties with a one-person IT](https://www.reddit.com/r/CMMC/comments/1xcpl13/ac_l2314_separation_of_duties_with_a_oneperson_it) - reddit-cmmc