CMMC Level 2 Identity & Access Hardening: Executable Implementation Plan
By Blue Heron Defense Compliance Team
Executive Summary
Identity and access hardening is evergreen security engineering: multi-factor authentication (MFA) for all users, blocked legacy authentication protocols, and privileged access controls protect CUI regardless of where the CMMC assessment schedule stands. With the DoD CIO's July 13, 2026 suspension of CMMC Phase II, Level 2 currently operates on self-assessment — and under a self-assessment regime, demonstrable identity controls are among the highest-value evidence a contractor can hold, anchoring a defensible SPRS score and affirmation. NIST SP 800-171 Rev. 2 remains the contractual anchor under DFARS 252.204-7012, and affirming officials remain personally accountable for what they attest. This briefing provides an executable mission plan with step-by-step implementation tasks, verification procedures, and evidence artifacts built to withstand government-led assessments, DIBCAC review, and prime-contractor scrutiny. Based on NIST SP 800-171 Rev. 2 control AC.L2-3.1.2, it addresses the most common gap identified in Readiness Review Tool (RRT) assessments: inadequate MFA enforcement and legacy authentication exposure.
Mission Objective
Milestone: Identity & Access Hardening
Objective: Enforce strong authentication and privileged access controls aligned to CMMC Level 2.
Exit Criteria:
- MFA enforced for all in-scope users
- Admin roles protected with phishing-resistant authentication
- Access reviews scheduled and documented
- Legacy authentication protocols blocked
Target Date: Within 28 days of engagement initiation
Priority: P0 (Critical path for a defensible CMMC Level 2 posture)
Control Coverage: AC.L2-3.1.2
NIST SP 800-171 Requirement: "Employ multi-factor authentication for local and network access to privileged accounts and for network access to non-privileged accounts."
Current Gap Rationale: Based on typical Readiness Review Tool (RRT) findings, the following gaps are prevalent across Defense Industrial Base (DIB) contractors:
- MFA not enforced for all users in scope
- Legacy authentication protocols still permitted (SMTP, POP3, IMAP)
- Break-glass accounts lack documented procedures
- Privileged access lacks phishing-resistant MFA
Support Type: Configurable (tenant-wide policy enforcement via Microsoft Entra ID Conditional Access)
Assessment Method Alignment: MFA enforcement is verified through exported configuration (examine) and test sign-in attempts (test). This dual-method validation produces defensible evidence for a Level 2 self-assessment — and holds up if a government-led assessment, DIBCAC review, or prime-contractor review examines the same control.
Program Status Context: On July 13, 2026, the DoD CIO suspended CMMC Phase II — including the planned expansion of Level 2 C3PAO assessments — while a CMMC Reform Task Force reviews the program. During the suspension, acquisition organizations use only Level 1 or Level 2 self-assessment, and DoD conducts selected government-led assessments. NIST SP 800-171 Rev. 2, DFARS 252.204-7012, and SPRS scores and affirmations remain fully binding, so nothing in this control's requirement has changed. For the full regulatory picture, see [The CMMC Suspension: What Changed and What Didn't](/cmmc-shift).
Implementation Tasks
STEP-001: Enforce MFA and Block Legacy Authentication
- Enable Security Defaults or Conditional Access MFA Policy: Configure tenant-wide MFA requirement for all users in scope. For Microsoft 365 Commercial tenants, implement Conditional Access policy 'CES-CA-MFA-AllUsers' with requireMfa=true and blockLegacyAuth=true.
- Disable Legacy Authentication Protocols: Block SMTP AUTH, POP3, IMAP, and other legacy protocols where possible. Export authentication logs to confirm no legacy auth sign-ins succeed post-implementation.
- Create Break-Glass Accounts: Establish two emergency access accounts ('BreakGlass1', 'BreakGlass2') with strong protections: phishing-resistant MFA, documented usage procedures, and conditional exclusion from MFA policies. Store credentials in physically secured location with audit trail.
- Configure Privileged Role Protection: Ensure all admin roles (Global Administrator, Security Administrator, Compliance Administrator) require phishing-resistant MFA (FIDO2/WebAuthn or PIV/CAC). SMS and voice-call MFA do not satisfy this requirement.
Verification Procedures
How to Verify Implementation:
- Export Conditional Access Policies: Use Microsoft Graph API or PowerShell to export CA policy configuration. Verify MFA requirement is present and legacy auth block is enabled. Retain export with SHA-256 hash for evidence retention.
- Attempt Legacy Auth Sign-In: Conduct controlled test using legacy authentication protocol (e.g., SMTP AUTH with valid credentials). Confirm connection is rejected with appropriate error message.
- Review Sign-In Logs: Export Azure AD/Entra ID sign-in logs for 72-hour period post-implementation. Verify all authentication events include MFA challenge and outcome. Document any exclusions (break-glass accounts) with justification.
- Test Break-Glass Procedure: Simulate emergency access scenario using documented break-glass procedure. Verify account can authenticate and access is logged with tamper-evident audit trail.
Expected Evidence Artifacts
The following artifacts should be collected and retained to substantiate a Level 2 self-assessment and SPRS affirmation — and to withstand a government-led assessment or prime-contractor review if one comes:
EV-CA-POLICY-EXPORT-001:
- Type: Configuration Export
- Description: Conditional Access policy export demonstrating MFA enforcement and legacy auth blocks
- Collector: PowerShell (Get-MgIdentityConditionalAccessPolicy)
- Retention: 365 days minimum
- Storage: SharePoint Evidence Library with version control
- Hash: SHA-256 checksum for tamper detection
EV-AUTH-TEST-LOG-001:
- Type: Log Export
- Description: Authentication test log showing MFA challenge and legacy auth block results
- Collector: PowerShell (Get-MgAuditLogSignIn)
- Retention: 365 days minimum
- Storage: SharePoint Evidence Library with version control
- Hash: SHA-256 checksum for tamper detection
Prechecks & Postchecks
PRE-001: Confirm Conditional Access Capability
Method: Examine
Expected: Conditional Access is available for the tenant (Microsoft 365 E3/E5 or standalone license), or a documented alternative MFA enforcement mechanism is selected.
On Fail: Stop and escalate. Choose supported MFA enforcement mechanism for current licensing state. Do not proceed with implementation until capability is confirmed.
POST-001: Confirm MFA Enforcement Active
Method: Test
Expected: All tested users receive MFA challenge during authentication. Legacy auth attempts fail with appropriate error code.
On Fail: Rollback or adjust policy exclusions. Re-run verification task. Do not proceed to next milestone until postcheck passes.
Rollback Strategy
Strategy: Reverse Task
Procedure:
1. Disable or delete the CES baseline CA policy via Microsoft Entra ID portal or PowerShell
2. Verify users can authenticate without MFA (test with pilot account)
3. Document rollback reason and timestamp in change log
4. Notify stakeholders of rollback and revised timeline
Idempotency: Best effort. Policy re-application is safe but may cause brief authentication disruption.
Risk Mitigation: Always test policy changes in pilot group before broad deployment. Maintain break-glass account access throughout implementation.
Technical Execution Details
Execution Engine: PowerShell with Microsoft Graph API
Command: Set-ConditionalAccessBaseline
Arguments:
```json
{
"policyName": "CES-CA-MFA-AllUsers",
"requireMfa": true,
"blockLegacyAuth": true,
"includeGroups": ["AllUsersInScope"],
"excludeAccounts": ["BreakGlass1", "BreakGlass2"]
}
```
Inputs:
- SI Baseline (target level, scope definition)
- Tenant current state (existing CA policies, group memberships)
Outputs:
- Evidence: CA policy export (EV-CA-POLICY-EXPORT-001)
- State: Tenant CA policy applied (configuration change logged)
Dependencies: None (priority P0, no upstream tasks required)
Implementation Considerations
Key Dependencies:
- List of in-scope users and admin accounts
- Scheduled maintenance windows for policy deployment
- Administrative access to configure identity policies
Implementation Deliverables:
- Conditional Access policy set and export evidence
- Authentication verification logs
- Runbook for break-glass accounts and MFA rollout
- User communication templates and training materials
Success Criteria:
- MFA required for all in-scope users
- Legacy authentication blocked
- Evidence artifacts stored and indexed to support the self-assessment and affirmation
[Pricing and engagement details available upon request]