CMMC Access Controls: How Avatier Helps Support Level 2 Evidence
CMMC Level 2 uses the NIST SP 800-171 Rev. 2 access control and authentication requirements. What each one asks, how a C3PAO scores the evidence, and how Avatier helps support it.
CMMC Level 2 uses the NIST SP 800-171 Rev. 2 access control and authentication requirements. What each one asks, how a C3PAO scores the evidence, and how Avatier helps support it.
- CMMC Level 2's access control requirements are NIST SP 800-171 Rev. 2's Access Control (3.1.x) family; this post also covers Identification and Authentication (3.5.x) and 3.9.2 for terminations and transfers.
- 32 CFR Part 170 says Level 2 requirements are identical to NIST SP 800-171 R2, even though NIST published Rev. 3 in May 2024.
- Phase 2 begins November 10, 2026, one calendar year after the DFARS rule took effect, when DoD intends to require Level 2 (C3PAO) status as a condition of award for applicable solicitations and contracts.
- A C3PAO scores MET only on final-form evidence, and hashed artifacts must be kept for six years from the CMMC Status Date.
- Avatier Access Governance, IT Shopping Cart, Strong MFA Login, Password Firewall and HR User Provisioning record approvals, reviews and removals that help support that evidence.
CMMC Level 2 access control requirements are the NIST SP 800-171 Rev. 2 Access Control (3.1.x) requirements that decide who can reach a system holding Controlled Unclassified Information (CUI) and what they can do there. Alongside them sit the Identification and Authentication (3.5.x) requirements, which decide how users prove who they are, and 3.9.2 for terminations and transfers. In a Level 2 assessment, self or C3PAO, each one needs evidence in final form, not a draft policy.
This post stays on the identity side of NIST SP 800-171. For secure areas where phones are not allowed, see Air-Gapped MFA for Phone-Free Sites. For the federal phishing-resistant framing, see Phishing-Resistant MFA: What CISA and NIST Require. For contractor and supplier accounts in general, see Contractor and Third-Party Access Governance.
Which rules and which NIST revision apply
The CMMC Program rule, 32 CFR Part 170, took effect on December 16, 2024. It states that "the security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2," and it incorporates Revision 2 of February 2020, with updates as of January 28, 2021. NIST published Revision 3 in May 2024, and NIST lists it as superseding Rev. 2, but the CMMC rule text still names R2. The requirement numbers below are R2's.
The acquisition side is DFARS 252.204-7021. The DFARS final rule that revised it took effect on November 10, 2025, which started Phase 1 under 32 CFR 170.3(e). Phase 2 "begins one calendar year following the start date of Phase 1," which puts it on November 10, 2026. In Phase 2, DoD intends to include Level 2 (C3PAO) status "as a condition of contract award" for applicable solicitations and contracts. The clause requires a contractor to "have and maintain for the duration of the contract a current CMMC status" at the level the contracting officer inserts.
DFARS 252.204-7012 is a separate clause. For covered contractor information systems not operated on behalf of the Government, it applies the NIST SP 800-171 version "in effect at the time the solicitation is issued or as authorized by the Contracting Officer."
The access control and identification requirements, in plain terms
The identity work in a Level 2 scope centers on a short list of requirements. The wording in the table is NIST's; the evidence column is general guidance on what an assessor can look at.
Six identity requirement areas from NIST SP 800-171 Rev. 2: limit access, least privilege, separate duties, MFA, password rules and exit access.
| Requirement | What NIST SP 800-171 R2 says | Evidence to have ready |
|---|---|---|
| 3.1.1 | "Limit system access to authorized users, processes acting on behalf of authorized users, and devices" | Account lists tied to an approval record |
| 3.1.2 | "Limit system access to the types of transactions and functions that authorized users are permitted to execute" | Role and group definitions |
| 3.1.4 | "Separate the duties of individuals to reduce the risk of malevolent activity without collusion" | Separation-of-duties rules and review results |
| 3.1.5 | "Employ the principle of least privilege, including for specific security functions and privileged accounts" | Privileged-access review records |
| 3.5.3 | "Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts" | MFA policy and login configuration |
| 3.5.7, 3.5.8 | "Enforce a minimum password complexity" and "Prohibit password reuse for a specified number of generations" | Screenshots of enforced password settings |
| 3.9.2 | Protect systems containing CUI "during and after personnel actions such as terminations and transfers" | Dated HR events matched to access removal |
Requirements 3.5.1 and 3.5.2 sit under all of these: identify system users, processes and devices, and authenticate them "as a prerequisite to allowing access to organizational systems."
How a C3PAO scores identity evidence
Part 170 gives each requirement one of three findings: Met, Not Met or Not Applicable. MET means "all applicable objectives for the security requirement are satisfied based on evidence," and "all evidence must be in final form and not draft." Working papers, drafts and "unofficial or unapproved policies" are named as unacceptable.
A gap can go on a Plan of Action and Milestones (POA&M) only within limits. The assessment score divided by the total number of Level 2 requirements must be at least 0.8, and no POA&M item can carry a point value above 1, with one encryption exception. A short list can never be on it, including AC.L2-3.1.20 External Connections and AC.L2-3.1.22 Control Public Information. The scoring methodology "is designed to credit partial implementation only in limited cases," and its example is multifactor authentication, IA.L2-3.5.3.
A C3PAO scores MET only on final-form evidence, and hashed artifacts stay on file for six years from the CMMC Status Date.
Evidence also has a retention period. For a Level 2 certification assessment, "the hashed artifacts used as evidence for the assessment must be retained by the OSC for six (6) years from the CMMC Status Date," and the results submitted include a "List of the artifact names" with their hash values. Under 252.204-7021, Final Level 2 (C3PAO) status counts as current for up to three years, provided compliance has not changed and an affirmation of continuous compliance is "not older than 1 year."
As general guidance, identity evidence holds up best when the work itself produces it: the approval when access was granted, the reviewer's decision when it was certified, and the request record when it was removed.
What Avatier ships toward this pattern
Avatier's products leave a record at each of those points.
Reviews, approved requests, MFA, password rules, HR events and request records each leave evidence that helps support a Level 2 assessment.
Access control (3.1.1, 3.1.2, 3.1.4, 3.1.5). Avatier Access Governance captures Access Certification Snapshots, "a real-time view of who has access to what," and reviewers "approve or revoke in a click." Its Compliance Manager "flags risk, tracks status, supports multi-level approvals, and captures evidence," and its use cases include Privileged-Access Review and Separation-of-Duties Review. With IT Shopping Cart, "Access is granted only after approval, and every decision is logged." Group Automation drives membership from "title, department, location, and manager," and includes Separation-of-Duties Enforcement. Patent-pending Continuous Governance™ "detects orphaned accounts and revokes access that no longer fits."
Authentication (3.5.3, 3.5.7, 3.5.8). Strong MFA Login, part of Credential Governance™, binds a strong second factor, such as Microsoft Authenticator, Okta Verify, Duo, RSA or the Avatier Identity Challenge Card™, "to every password authentication event." It "Supports RDP, Citrix, and shared workstations and servers," and risk-based step-up "applies stricter verification to privileged accounts." Password Firewall installs as an agent on every Active Directory domain controller and checks each change "against enterprise policy, NIST Common Passwords, and Have I Been Pwned before the change is accepted." It blocks "weak, breached, reused, and predictable passwords."
Personnel actions (3.9.2). HR User Provisioning connects to "70+ HR and payroll systems through a single unified integration." On a transfer or promotion, it "applies the new role's access and removes what no longer fits," and "the moment HR marks someone terminated, Avatier disables their accounts and revokes access."
Request records. Through the Avatier MCP Server, staff can "Unlock, reset, request, approve and provision in plain language, with the same verification, policy and approvals as the Avatier console." Its Disable Account action puts "a reason and a justification on the record," and "Requests land in Request History, ready to review and export." Together, these help support the evidence needs for the access control, authentication and personnel-security requirements.
Getting started
For the credential pillars, see Credential Governance™. For MFA on Windows login and RDP, see Strong MFA Login. For access certification campaigns, see Access Governance. For another regulated access-review pattern, see NERC CIP Access Management. For security documentation, see the Avatier Trust Center; Avatier completed its SOC 2 Type II audit with no exceptions noted.
Under Pay Per Identity Action™, each completed, verified action is one Secure Outcome, and attempts, failures and retries are never billed. Getting started is free, deployment services are included, and a 45-day money-back guarantee applies; full terms are in the invitation-only preview. For the preview, see the Avatier Identity Anywhere 2027™ site; for the company, see avatier.com.
ABOUT THE AUTHOR
More from Identity by Industry
NERC CIP Access Management: CIP-004 Revocation with Avatier
CIP-004-7 asks utilities to authorize access on need, verify it every quarter and remove remote access within 24 hours of a termination. How Avatier starts revocation from the HR event and records each review and request.
Identity Governance for State and Local Government, with Avatier
CISA's state and local grant program lists MFA, enhanced logging and no default passwords. How a lean county or state IT team covers resets, shared counters and term-end churn with Avatier.
Bank MFA Rules and Help-Desk Resets: Identity Governance with Avatier
NYDFS requires MFA for any individual on any information system, and the FFIEC flags help-desk resets. What banks and insurers owe examiners, and the Avatier controls behind it.