How Identity and Access Management Supports CMMC Level 2

Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).

In practice: New hires, contractors and service accounts get access to systems that hold controlled unclassified information only through an approved request, and every account is tied to a known person, process or device.

Limit system access to the types of transactions and functions that authorized users are permitted to execute.

In practice: Roles bundle the transactions and functions each job needs, such as view versus approve, and managers confirm in periodic access reviews that people still need what their role gives them.

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

In practice: A person who can create a vendor cannot also approve payment to that vendor. The governance platform flags conflicting access at request time, and any exception needs a named approver and a compensating control.

Employ the principle of least privilege, including for specific security functions and privileged accounts.

In practice: Administrators hold elevated rights only for the tasks that need them, often through time-limited activation of a privileged role or a vaulted credential check-out, and owners regularly review who still holds those rights.

Use non-privileged accounts or roles when accessing nonsecurity functions.

In practice: An engineer reads email and browses the web with a standard account and uses a separate, clearly labeled admin account only for administration. Account classification helps tell the two kinds apart.

Prevent non-privileged users from executing privileged functions and capture the execution of such functions in audit logs.

In practice: A standard user who tries to run an administrator task is blocked, and when an approved administrator does run one, the privileged access tools record who did it and when.

Limit unsuccessful logon attempts.

In practice: The directory and sign-in service lock an account after a set number of failed attempts, and the help desk follows a defined process to verify the user before unlocking it.

Ensure that the actions of individual system users can be uniquely traced to those users, so they can be held accountable for their actions.

In practice: Every person signs in with their own account, so log entries point to one individual. Shared and orphaned accounts are found and removed, and any shared credential is checked out from a vault and logged.

Limit management of audit logging functionality to a subset of privileged users.

In practice: Only a small group of approved administrators can change logging settings. They receive that role through the privileged access process, and owners review the membership periodically.

Identify system users, processes acting on behalf of users, and devices.

In practice: Each person, service account and device has a unique identity in the directory, and an inventory of service and device identities shows who or what owns each one.

Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.

In practice: A user, an application or a device shows who it is at sign-in, through a password plus MFA for people or a certificate or workload identity for systems, before it reaches anything.

Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts.

In practice: Administrators use MFA for every privileged sign-in, and regular users use MFA when connecting over the network. Many organizations choose phishing-resistant methods such as security keys.

Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.

In practice: Sign-in methods such as security keys, passkeys and certificates are designed so a captured login does not work if an attacker replays it later.

Prevent reuse of identifiers for a defined period.

In practice: When someone leaves, their username is not handed to a new hire for a defined period. The identity lifecycle process checks new usernames against retired ones before creating accounts.

Disable identifiers after a defined period of inactivity.

In practice: A scheduled report finds accounts nobody has used for a defined period, and the identity process disables them automatically or after the owner confirms.

Enforce a minimum password complexity and change of characters when new passwords are created.

In practice: The directory and sign-in service enforce password rules, such as minimum length and complexity, so a weak password is refused when someone sets or changes it.

Prohibit password reuse for a specified number of generations.

In practice: The directory or sign-in service remembers a defined number of earlier passwords and refuses them again; where a cloud directory keeps a shorter history, the rule is enforced in the on-premises directory, or the password is replaced by passwordless sign-in.

Allow temporary password use for system logons with an immediate change to a permanent password.

In practice: A new hire gets a one-time temporary password, often issued by the onboarding process, and the system forces a new permanent password at the first sign-in.

Store and transmit only cryptographically-protected passwords.

In practice: Passwords are stored in protected form in the directory and travel over encrypted connections. Shared and service account passwords live in a privileged access vault instead of spreadsheets.

Require multifactor authentication to establish nonlocal maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete.

In practice: A vendor technician working remotely signs in with MFA through a privileged access broker, and the session closes automatically when the maintenance window ends.

Ensure that organizational systems containing CUI are protected during and after personnel actions such as terminations and transfers.

In practice: When someone leaves, their accounts are removed on their last day through the leaver process. When someone changes jobs, the mover process reviews and trims the access from the old role.

Terminate (automatically) a user session after a defined condition.

In practice: Single sign-on sessions expire after a set time or condition, applications end their own sessions under the same policy, and privileged vault sessions close automatically when idle.

Monitor and control remote access sessions.

In practice: Remote workers sign in through policies that check the user and device, and remote administrator sessions run through a privileged access vault that records what happens during the session.

Authorize remote execution of privileged commands and remote access to security-relevant information.

In practice: A vendor engineer who needs a remote administrator session requests it, a designated approver signs off, and the privileged access vault opens the session for that task only.

Authorize wireless access prior to allowing such connections.

In practice: The network team runs the wireless infrastructure. Identity supplies the directory-backed check, often certificate-based, that decides whether a device or person may join the wireless network.

Protect wireless access using authentication and encryption.

In practice: Wireless networks use enterprise sign-in rather than a shared password. Identity issues the certificates or directory credentials each person or device presents, and the network team configures encryption.

Control connection of mobile devices.

In practice: Mobile device management owns the device rules. Identity sign-in policies check whether a phone or tablet is registered and meets those rules before it can open email or files containing CUI.

Verify and control/limit connections to and use of external systems.

In practice: Security policy sets the terms for outside systems. Identity settings give partner and contractor staff on unmanaged devices limited guest access and decide what those connections may reach.

Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.

In practice: The security team runs logging and retention. Sign-in, privileged access and access governance logs are onboarded to the central log platform so investigators can see who accessed what.

Correlate audit record review, analysis, and reporting processes for investigation and response to indications of unlawful, unauthorized, suspicious, or unusual activity.

In practice: The security operations team does the analysis. Identity adds context to alerts, such as the account owner, their role and privilege level, so analysts understand an event faster.

Protect audit information and audit logging tools from unauthorized access, modification, and deletion.

In practice: The security team protects the log platform itself. Identity helps by assigning access to log stores and the log platform through roles, limiting who can read or change records.

Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.

In practice: IT owns the asset inventory; identity contributes named owners for systems and service accounts and device identity records that the inventory can draw on.

Define, document, approve, and enforce physical and logical access restrictions associated with changes to organizational systems.

In practice: Change management owns the approval process. Identity can tie elevated access to an approved change ticket and switch it on for the change window only.

Control and monitor user-installed software.

In practice: Endpoint teams control what software people may install. Identity helps by removing everyday local administrator rights and granting elevated rights only on request for a defined purpose.

Obscure feedback of authentication information.

In practice: When someone types a password, the sign-in screen shows dots or hides the entry so a person standing nearby cannot read it.

Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.

In practice: The security team runs the incident process. Identity supplies ready steps for containment, such as disabling an account or ending its active sessions, and logs show which accounts were involved.

Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.

In practice: IT operations governs maintenance work. Identity gives outside maintenance staff named accounts with an end date instead of a shared login, so actions trace to a person and access lapses.

Supervise the maintenance activities of maintenance personnel without required access authorization.

In practice: IT operations supervises maintenance staff who lack standing access. An employee escorts them, and privileged session recording keeps a record of the work for later review.

Limit access to CUI on system media to authorized users.

In practice: Data owners decide who may reach CUI on storage and media. Identity grants that access through named groups and runs periodic owner reviews of group membership.

Screen individuals prior to authorizing access to organizational systems containing CUI.

In practice: HR owns the screening. The identity process can hold account creation until HR marks the background screening complete, so access to CUI systems is not granted too early.

Limit physical access to organizational systems, equipment, and the respective operating environments to authorized individuals.

In practice: The facilities team controls the building and server rooms. Where a badge system connects to the identity process, new hires get door access and leavers lose it along with their accounts.

Control and manage physical access devices.

In practice: The facilities team manages badges and keys. Where a badge system connects to the identity process, issuing, changing and deactivating a badge follows the same joiner, mover and leaver events as accounts.

Periodically assess the risk to organizational operations (including mission, functions, image, or reputation), organizational assets, and individuals, resulting from the operation of organizational systems and the associated processing, storage, or transmission of CUI.

In practice: The risk assessment team owns the assessment; identity hands over its account and entitlement inventory and recent review results for the access-related sections.

Periodically assess the security controls in organizational systems to determine if the controls are effective in their application.

In practice: A periodic assessment of identity controls, such as MFA coverage and admin accounts, produces a list of gaps rated against each requirement for the security team to act on.

Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.

In practice: Each identity gap found in an assessment becomes a plan-of-action item with a named owner and a target date, and the list is tracked until the gap is closed.

Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls.

In practice: Identity controls are checked on a recurring schedule between formal assessments, so drift such as new unreviewed admin accounts shows up sooner.

Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems.

In practice: The compliance team owns the system security plan; identity contributes the sections on sign-in, MFA and access reviews. These plans are often marked CUI, so they stay in the organization's CUI environment.

Separate user functionality from system management functionality.

In practice: The platform team separates management functions from user functions. Identity supplies separate admin identities, often used from a dedicated workstation, for management tasks.

Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity.

In practice: Network connections close after a period of inactivity set by the organization, and the identity session timeout is aligned with that period.

Establish and manage cryptographic keys for cryptography employed in organizational systems.

In practice: The security team sets key management rules. Identity contributes by keeping SSH keys and service account credentials in a privileged access vault and rotating them on a schedule.

Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.

In practice: The security team confirms that each identity product handling CUI uses encryption modules on the government's validated list, checking each product and version.

Protect the authenticity of communications sessions.

In practice: The network team protects sessions in transit. Identity contributes signed sign-in tokens between systems and tracks the signing certificates so they are renewed before they expire.

Monitor organizational systems, including inbound and outbound communications traffic, to detect attacks and indicators of potential attacks.

In practice: The security team monitors the environment. Identity adds signals such as sign-in risk events and sudden privilege changes so unusual activity surfaces as alerts for review.

Identify unauthorized use of organizational systems.

In practice: Reports flag unusual sign-ins, accounts that have gone dormant and accounts with no owner, giving the security team leads on use nobody authorized.

Control the flow of CUI in accordance with approved authorizations.

Provide privacy and security notices consistent with applicable CUI rules.

Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.

Employ cryptographic mechanisms to protect the confidentiality of remote access sessions.

Route remote access via managed access control points.

Encrypt CUI on mobile devices and mobile computing platforms.

Limit use of portable storage devices on external systems.

Control CUI posted or processed on publicly accessible systems.

Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.

Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.

Provide security awareness training on recognizing and reporting potential indicators of insider threat.

Review and update logged events.

Alert in the event of an audit logging process failure.

Provide audit record reduction and report generation to support on-demand analysis and reporting.

Provide a system capability that compares and synchronizes internal system clocks with an authoritative source to generate time stamps for audit records.

Establish and enforce security configuration settings for information technology products employed in organizational systems.

Track, review, approve or disapprove, and log changes to organizational systems.

Analyze the security impact of changes prior to implementation.

Employ the principle of least functionality by configuring organizational systems to provide only essential capabilities.

Restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.

Apply deny-by-exception (blacklisting) policy to prevent the use of unauthorized software or deny-all, permit-by-exception (whitelisting) policy to allow the execution of authorized software.

Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.

Test the organizational incident response capability.

Perform maintenance on organizational systems.

Ensure equipment removed for off-site maintenance is sanitized of any CUI.

Check media containing diagnostic and test programs for malicious code before the media are used in organizational systems.

Protect (i.e., physically control and securely store) system media containing CUI, both paper and digital.

Sanitize or destroy system media containing CUI before disposal or release for reuse.

Mark media with necessary CUI markings and distribution limitations.

Control access to media containing CUI and maintain accountability for media during transport outside of controlled areas.

Implement cryptographic mechanisms to protect the confidentiality of CUI stored on digital media during transport unless otherwise protected by alternative physical safeguards.

Control the use of removable media on system components.

Prohibit the use of portable storage devices when such devices have no identifiable owner.

Protect the confidentiality of backup CUI at storage locations.

Protect and monitor the physical facility and support infrastructure for organizational systems.

Escort visitors and monitor visitor activity.

Maintain audit logs of physical access.

Enforce safeguarding measures for CUI at alternate work sites.

Scan for vulnerabilities in organizational systems and applications periodically and when new vulnerabilities affecting those systems and applications are identified.

Remediate vulnerabilities in accordance with risk assessments.

Monitor, control, and protect communications (i.e., information transmitted or received by organizational systems) at the external boundaries and key internal boundaries of organizational systems.

Employ architectural designs, software development techniques, and systems engineering principles that promote effective information security within organizational systems.

Prevent unauthorized and unintended information transfer via shared system resources.

Implement subnetworks for publicly accessible system components that are physically or logically separated from internal networks.

Deny network communications traffic by default and allow network communications traffic by exception (i.e., deny all, permit by exception).

Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).

Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI during transmission unless otherwise protected by alternative physical safeguards.

Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device.

Control and monitor the use of mobile code.

Control and monitor the use of Voice over Internet Protocol (VoIP) technologies.

Protect the confidentiality of CUI at rest.

Identify, report, and correct system flaws in a timely manner.

Provide protection from malicious code at designated locations within organizational systems.

Monitor system security alerts and advisories and take action in response.

Update malicious code protection mechanisms when new releases are available.

Perform periodic scans of organizational systems and real-time scans of files from external sources as files are downloaded, opened, or executed.