Access Control (AC)

CMMC Access Control (AC) Requirements

Access Control is the largest control family in CMMC Level 2, containing 22 of the 110 total requirements. These controls determine who can access your systems, what they can do once inside, and how information flows through your environment.

Access Control means limiting system and data access to authorized users and restricting what actions those users can perform.

Getting Access Control right is critical. Most data breaches involve unauthorized access—either attackers breaking in or authorized users accessing information they should not see.

Why Access Control Matters for CMMC

The Department of Defense requires Access Control because Controlled Unclassified Information (CUI) must only be seen by people who need it for their jobs. If everyone in your company can access all files, you cannot protect sensitive defense information.

CUI stands for Controlled Unclassified Information—sensitive government data requiring protection but not classified as secret.

Access Control also creates accountability. When you limit and track access, you know who viewed or modified sensitive information if a security incident occurs.

The 22 Access Control Requirements

CMMC Level 2 Access Control requirements fall into several categories:

Account Management (AC.L2-3.1.1 through 3.1.4)

These controls require you to manage user accounts throughout their lifecycle:

• Limit system access to authorized users only
• Limit access to the types of transactions each user needs
• Control connections to external systems
• Control information posted to publicly accessible systems

In practice, this means creating accounts only when needed, assigning appropriate permissions, reviewing accounts regularly, and removing access when employees leave or change roles.

Access Enforcement (AC.L2-3.1.5 through 3.1.7)

These controls ensure your systems actually enforce access restrictions:

• Use the principle of least privilege (give minimum necessary access)
• Use non-privileged accounts for regular work
• Prevent non-privileged users from executing privileged functions

Least privilege means users only get access to what they need for their specific job—nothing more.

For example, a machinist reading technical drawings does not need administrator access to your file server. Regular employees should not use admin accounts for daily work.

Unsuccessful Login Attempts (AC.L2-3.1.8)

This control requires limiting failed login attempts. After a set number of wrong passwords, the system should lock the account or delay further attempts. This prevents attackers from guessing passwords through repeated attempts.

Session Controls (AC.L2-3.1.10 through 3.1.11)

These controls manage active user sessions:

• Lock sessions after inactivity (screen locks)
• Terminate sessions after defined conditions

If someone walks away from their computer, the screen should lock automatically. Sessions should not remain active indefinitely.

Remote Access (AC.L2-3.1.12 through 3.1.15)

These controls govern access from outside your facility:

• Monitor and control remote access sessions
• Use cryptographic mechanisms (encryption) for remote access
• Route remote access through managed access control points
• Authorize remote execution of privileged commands

Remote access means connecting to your systems from outside your office—working from home, traveling, or accessing systems over the internet.

Remote access requires VPN connections with encryption, not direct internet exposure of internal systems.

Wireless Access (AC.L2-3.1.16 through 3.1.17)

These controls protect wireless networks:

• Authorize wireless access before allowing connections
• Protect wireless access using authentication and encryption

Your WiFi network needs strong passwords, encryption (WPA3 or WPA2), and should not allow unknown devices to connect.

Mobile Devices (AC.L2-3.1.18 through 3.1.19)

These controls address smartphones, tablets, and laptops:

• Control the connection of mobile devices
• Encrypt CUI on mobile devices

If employees access CUI from phones or tablets, those devices need management and encryption.

External Systems (AC.L2-3.1.20 through 3.1.21)

These controls limit use of external systems:

• Verify external systems meet security requirements
• Limit the use of portable storage devices on external systems

Connecting your work laptop to home networks or public WiFi creates risks that these controls address.

Publicly Accessible Content (AC.L2-3.1.22)

This control requires designating individuals to post information publicly and reviewing content before posting to ensure CUI is not accidentally disclosed.

Implementing Access Control for Small Businesses

Small businesses can implement Access Control without enterprise-grade tools:

User Account Management

• Create individual accounts for each person (no shared accounts)
• Document who has access to what systems
• Review access quarterly and when roles change
• Disable accounts immediately when employees leave

Permissions

• Create user groups based on job functions
• Assign permissions to groups, not individuals
• Give users access only to folders and systems they need
• Separate administrator accounts from daily-use accounts

Remote Access

• Use VPN for all remote connections
• Require multi-factor authentication for remote access
• Do not expose internal systems directly to the internet

Physical Considerations

• Lock workstations when unattended
• Configure automatic screen lock after 15 minutes or less
• Position screens to prevent shoulder surfing

Common Access Control Mistakes

Mistake 1: Shared Accounts

Using one login for multiple people prevents accountability and violates multiple AC requirements. Every user needs their own account.

Mistake 2: Excessive Permissions

Giving everyone administrator access or full file access is convenient, but violates least privilege. Take time to set up proper permissions.

Mistake 3: No Remote Access Controls

Allowing direct RDP or file share access over the internet without VPN creates serious vulnerabilities.

Mistake 4: Ignoring Departed Employees

Failing to disable accounts when employees leave creates ongoing unauthorized access.

Key Takeaways

Access Control contains the most CMMC Level 2 requirements (22 of 110). These controls ensure only authorized people access CUI and that access is limited, monitored, and controlled.

Focus on individual accounts, least privilege permissions, secure remote access, and regular access reviews. Small businesses can meet these requirements with proper configuration of existing systems and documented procedures.

---

Related Articles:

• NIST SP 800-171 Rev 2 – Access Control Family
• 32 CFR Part 170 – CMMC Program Rule
• CMMC Level 2 Assessment Guide

Official Sources: This article is based on NIST SP 800-171 Revision 2 “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations,” specifically the Access Control family (Section 3.1), and the DoD CMMC Level 2 Assessment Guide.

---

Need help implementing Access Control for CMMC compliance? Contact Greypike for expert guidance on Level 1 and Level 2 certification, or get started with Obolix to streamline your compliance journey.