CMMC Access Control: Who Really Has Access to Your CUI?

Bottom Line Up Front: For small defense contractors preparing for CMMC, access control can appear relatively straightforward on the surface. Employees have usernames and passwords, multifactor authentication is enabled, file permissions are configured, and Microsoft 365 or another platform manages identity and access. With those capabilities in place, it can be easy to conclude that access control is covered. The more important question, however, is whether you can prove who actually has access to your Controlled Unclassified Information (CUI) — from where, using what device, with what level of privilege.

Before you can effectively restrict access to CUI, you need to understand where it exists and how it moves through your organization. Where is it received and stored? Who uses it? Can employees download or email it? Can users access it remotely? Do subcontractors, service providers, or other third parties have access?

These questions help define the CUI environment and directly influence CMMC scope. This is also why saying, "Our CUI is in Microsoft 365," does not fully answer the question. The technology platform is only one part of the environment. Organizations must also understand the users, identities, devices, applications, permissions, administrative privileges, and business processes surrounding the information.

If you cannot clearly identify where CUI resides, how it moves, and who can reach it, effectively controlling access becomes difficult.

Access should be based on legitimate business need rather than convenience, yet permissions naturally accumulate over time if they are not actively managed.

An employee may join a project and receive access to a repository, then retain that access long after the project ends. Someone may change roles but keep permissions associated with a previous position. An administrator may receive elevated privileges to resolve an issue and never have those privileges removed. A subcontractor may complete an engagement but remain in an access group.

None of these situations necessarily involve malicious activity. They represent a common operational problem: the gradual accumulation of permissions. Over time, the difference between who can access CUI and who actually needs access to CUI can become substantial — increasing both cybersecurity and compliance risk.

Not all accounts create equal risk. Administrators who can create users, modify security settings, change permissions, disable protections, or access large amounts of information represent significantly greater risk than standard users.

Small contractors can be particularly vulnerable because IT responsibilities are often concentrated among relatively few employees or outsourced to managed service providers. Leadership should understand:

• Who has administrative privileges and why those privileges are required
• Which systems those individuals can administer
• How privileged access is authenticated and monitored
• How quickly it can be removed when circumstances change

The same scrutiny should apply to MSP access. A capable MSP can be critical to a small organization's success, but outsourcing IT operations does not outsource organizational responsibility. Contractors should understand which provider personnel can access systems containing CUI, whether they maintain persistent administrative privileges, whether individual or shared accounts are used, how activity is logged, and how access changes when provider personnel leave or change responsibilities.

Third-party administrative access is still access — and it needs to be understood, controlled, and documented.

Remote and hybrid work have changed the access-control conversation because employees may access company information from homes, customer sites, hotels, and other locations outside the traditional network perimeter.

The question is no longer simply whether an employee can log in. Organizations need to determine whether that individual should be permitted to access CUI from a particular device, location, connection, and set of circumstances.

For contractors handling CUI, remote access should be intentionally designed rather than simply enabled. Identity, device security, authentication, remote connectivity, and authorization all become part of the access-control equation — and convenience should not unintentionally redefine the organization's security boundary.

One of the most useful ways to prepare for CMMC is to stop asking whether a control exists and start asking whether the organization can demonstrate that it works.

If you tell an assessor that only authorized personnel can access CUI, be prepared to show it.

Show where the CUI resides and who currently has access to it. Show how that access is approved, how privileged users are controlled, what happens when an employee changes roles or leaves the company, how remote access is restricted, and how administrative activity is monitored.

This exercise changes the conversation because a policy stating that access is restricted is important — but that policy must correspond to what is actually occurring within the environment. CMMC readiness requires alignment between policy, process, technology, implementation, and evidence. When those elements tell different stories, the organization has work to do before the assessment.

One of the biggest mistakes a small contractor can make is assuming every CMMC gap requires another cybersecurity product. Some gaps may require new technology, but many involve configuration, documentation, governance, implementation, evidence, or simply a lack of understanding of the current environment.

Before spending additional money, determine what is in scope, what is already implemented, where the actual gaps exist, and what you can demonstrate. Once those questions have been answered, technology investments and remediation decisions can be made with much greater precision.

CMMC can feel overwhelming for a small defense contractor, but the problem becomes much more manageable when it is broken into practical components. For access control, start with the CUI and trace where it enters the organization, where it resides, where it travels, and who interacts with it. From there, examine the identities, permissions, devices, administrators, service providers, and processes surrounding that information.

This is the purpose behind Preemptive Cyber's CMMC readiness advisory approach. We help small and mid-sized defense contractors understand their current CMMC posture, identify gaps between documented and implemented controls, evaluate available evidence, and prioritize remediation before entering the formal assessment process.

The objective is not to make CMMC more complicated — it is to make the path forward clearer and help organizations invest their time and resources where they will have the greatest impact.

Preemptive Cyber, LLC is a Service-Disabled Veteran-Owned Small Business providing cybersecurity advisory services to small and mid-sized defense contractors and healthcare organizations. Our CMMC Readiness Advisory helps contractors understand their current posture and close gaps before the formal assessment process begins.