Defense contractors that handle Controlled Unclassified Information (CUI) meet the Cybersecurity Maturity Model Certification (CMMC) program through NIST SP 800-171. Its identification and authentication family, section 3.5, decides who gets into a CUI system and how they prove it at sign-in.
This post covers where CMMC 2.0 stands in October 2026, what section 3.5 requires, what it leaves out, and where attended NIST IAL3 identity proofing fits for the people who hold privileged access.
CMMC 2.0 identity requirements, in brief:
- The requirements: CMMC Level 2 is identical to the 110 requirements of NIST SP 800-171 Rev 2, including 3.5.1 to 3.5.11 for identification and authentication.
- The status: since July 13, 2026, CMMC has been paused in Phase 1, so contracts can call only for Level 1 or Level 2 self-assessments. The requirements still apply.
- The gap: SP 800-171 never says how to establish who a new hire is. Identity proofing gives screening (3.9.1) and authentication (3.5.2) a verified person to rest on.
Where CMMC 2.0 stands in October 2026
The CMMC program rule, 32 CFR part 170, took effect on December 16, 2024. The DFARS acquisition rule that puts CMMC into contracts took effect on November 10, 2025, which started Phase 1.
Phase 2 was due on November 10, 2026, when a CMMC Level 2 assessment by a CMMC Third-Party Assessment Organization (C3PAO) would have become a condition of award. On July 13, 2026, the Department of War (the regulations still say Department of Defense) suspended that step and held later milestones in abeyance. Until further notice, contracts may designate only CMMC Level 1 (Self) or Level 2 (Self) assessments.
The department says it will enforce NIST SP 800-171 Rev 2 through self-assessments and select government-led assessments in the meantime, and that the pause does not remove the duty to protect CUI under DFARS clause 252.204-7012. The requirements themselves have not changed.
The three CMMC levels
| Level | Requirements | Assessment |
|---|---|---|
| Level 1 | The 15 basic safeguarding requirements of FAR 52.204-21, for Federal Contract Information (FCI) | Annual self-assessment and affirmation |
| Level 2 | The 110 requirements of NIST SP 800-171 Rev 2, for CUI | Self-assessment, or a C3PAO assessment every three years (C3PAO designations are paused) |
| Level 3 | 24 selected requirements from NIST SP 800-172, on top of Level 2 | Assessment by DCMA's DIBCAC every three years (paused) |
The level definitions are in 32 CFR 170.14.
What NIST SP 800-171 section 3.5 requires
CMMC Level 2 uses NIST SP 800-171 Rev 2, although NIST has since published Revision 3. Its identification and authentication family has two basic and nine derived requirements:
| Requirement | Text |
|---|---|
| 3.5.1 | Identify system users, processes acting on behalf of users, and devices. |
| 3.5.2 | Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems. |
| 3.5.3 | Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. |
| 3.5.4 | Employ replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts. |
| 3.5.5 | Prevent reuse of identifiers for a defined period. |
| 3.5.6 | Disable identifiers after a defined period of inactivity. |
| 3.5.7 | Enforce a minimum password complexity and change of characters when new passwords are created. |
| 3.5.8 | Prohibit password reuse for a specified number of generations. |
| 3.5.9 | Allow temporary password use for system logons with an immediate change to a permanent password. |
| 3.5.10 | Store and transmit only cryptographically-protected passwords. |
| 3.5.11 | Obscure feedback of authentication information. |
Source: NIST SP 800-171 Rev 2, section 3.5. A phishing-resistant hardware security key used with a PIN is one way to meet 3.5.3 and 3.5.4 for privileged accounts.
What section 3.5 leaves out: proving who the person is
Requirement 3.5.2 checks that the person signing in holds the right authenticator. Nothing in SP 800-171 says how to establish who that person was when the account was created. SP 800-53 covers that in IA-12, Identity Proofing, but SP 800-171 leaves it out: Revision 3 marks IA-12 and its enhancements FED, "primarily the responsibility of the Federal Government," and Revision 2 was built from SP 800-53 Revision 4, which had no IA-12.
The nearest requirements sit elsewhere:
- 3.9.1 (Rev 2): "Screen individuals prior to authorizing access to organizational systems containing CUI."
- 03.05.12.a (Rev 3): "Verify the identity of the individual, group, role, service, or device receiving the authenticator as part of the initial authenticator distribution." CMMC still assesses Revision 2, so this is not a CMMC requirement today.
CMMC therefore does not require IAL2 or IAL3. A contractor that proofs identities anyway does it so that screening and authentication rest on a person whose identity was verified, which is what the FBI recommends to employers.
Why defense contractors should verify identities now
The FBI's October 13, 2026 public service announcement says North Korean IT workers "target positions with cleared defense contractors and other companies involved in U.S. government contracts." In June 2025, the Justice Department reported that IT workers in one of these schemes gained access to ITAR-controlled data from a California-based defense contractor.
A one-time document check doesn't settle it. In a case the Justice Department announced in December 2025, a man who verified his identity with a Maryland driver's license and U.S. passport, and was approved for a PIV card on an FAA contract, let co-conspirators reach government systems from China. The FBI's answer is "identity in depth": layered detections, access controls and continuous identity verification throughout employment. Our report on North Korean IT workers and laptop farms covers how these schemes work.
An identity plan for CUI environments
- All users with CUI access: unique identifiers and multifactor authentication under 3.5.1 to 3.5.4, with phishing-resistant keys for privileged accounts.
- Every new hire and contractor: verify identity at the offer stage, then run the 3.9.1 screening against that verified identity.
- Privileged and remote administrators: on-site attended NIST IAL3 on a controlled IAL3 Kit at an approved office or home, or at an Office Kiosk, with the hardware key enrolled during the session.
- Through employment: re-verify at role changes, account recovery and risk signals.
Candidate and new-hire identity verification shows how these steps fit together, and our guide to binding verified identities to hardware keys covers the key enrollment.