For years, the Cybersecurity Maturity Model Certification (CMMC) felt like a future requirement for many defense contractors and federal suppliers. That window is closing quickly. On November 10, 2026, Phase 2 of the Department of Defense’s CMMC rollout takes effect, introducing mandatory third-party CMMC Level 2 assessments for prioritized contracts. For organizations handling Controlled Unclassified Information (CUI), that changes the compliance conversation significantly.
The issue is no longer whether organizations understand the requirements on paper. Increasingly, they will need to demonstrate to Certified Third-Party Assessment Organizations (C3PAOs) that security controls are implemented consistently, enforced operationally, and supported with evidence. That shift is creating new urgency around access security, identity verification, segmentation, monitoring, and auditability across the Defense Industrial Base (DIB).
Phase 2 Moves CMMC Into Operational Enforcement
CMMC 2.0 was designed to strengthen cybersecurity protections across the DIB and better safeguard Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The framework aligns closely with NIST SP 800-171 requirements and introduces a streamlined three-level maturity model.
Phase 2 marks an important transition point because Level 2 compliance increasingly becomes tied to third-party validation for prioritized contracts.
For many defense contractors, that means the focus shifts from preparing for compliance to proving that controls work consistently across real operational environments.
That distinction matters.
Third-party assessments are not simply checking whether organizations own security technologies or have policies documented somewhere internally. Assessors will evaluate whether organizations can demonstrate effective implementation of controls tied to areas including:
- Access control
- Identity verification
- Authentication
- Remote access
- Audit logging and monitoring
- Boundary protection
- Segmentation and lateral movement reduction
For organizations operating across remote workforces, subcontractor ecosystems, hybrid infrastructure, cloud services, and legacy environments, those requirements can quickly become operationally complex. That complexity is one reason access security is becoming a much larger part of CMMC readiness discussions ahead of Phase 2.
Access Control Will Receive Greater Scrutiny During Assessments
CMMC Level 2 aligns directly with the 110 security requirements outlined in NIST SP 800-171. Many of those requirements tie directly or indirectly to how organizations manage identity, authentication, remote connectivity, and access enforcement.
Organizations increasingly need the ability to:
- Restrict access based on identity, device posture, and context
- Continuously validate users and devices
- Limit lateral movement across sensitive environments
- Monitor and audit access activity in real time
- Secure remote access without broadly exposing infrastructure
As assessments become more formalized under Phase 2, organizations may face greater pressure to demonstrate not only that these controls exist, but that they are enforced consistently across users, devices, applications, and third-party access scenarios.
This is where many legacy access approaches begin creating friction.
Legacy VPN Architectures Can Create Operational and Assessment Challenges
Many organizations pursuing CMMC readiness still rely heavily on traditional VPN architectures and broad network-level access models.
The challenge is that these environments were often designed around implicit trust. Once users authenticate, they may receive broad visibility into networks and systems beyond what they actually need to access.
In environments handling sensitive government information, that can create unnecessary exposure while also complicating efforts to demonstrate least-privilege access and segmentation during assessments.
CMMC places significant emphasis on access control, authentication, external connection management, auditability, and limiting unauthorized lateral movement.
For organizations preparing for third-party assessments, broad network access models can create several operational difficulties, including:
- Inconsistent enforcement of least-privilege access
- Limited visibility into user and device activity
- Difficulty segmenting sensitive environments
- Expanded attack surface exposure
- Greater complexity around third-party and subcontractor access
-
Challenges demonstrating granular access control policies during assessments
As a result, many organizations are reassessing how remote access and identity-based security fit into long-term CMMC readiness strategies.
Zero Trust Access Models Align Naturally with Phase 2 Requirements
As organizations prepare for third-party assessments, Zero Trust Network Access (ZTNA) is increasingly becoming part of the discussion because it aligns naturally with several core CMMC principles.
ZTNA shifts access decisions away from broad network trust and toward identity-centric, least-privilege access. Instead of placing users directly onto the network, access is granted only to explicitly authorized resources.
This approach supports several operational objectives that become increasingly important during Phase 2 readiness efforts, including:
- Granular access control
- Continuous authentication and authorization
- Segmentation and containment of sensitive resources
- Improved visibility and auditability
-
Reduced attack surface exposure
The CMMC 2.0 mapping guide details how Appgate ZTNA supports controls tied to access management, authentication, secure communications, external connection management, and system integrity monitoring.
AppGate ZTNA Supports Phase 2 Readiness
AppGate ZTNA was designed around the principle of “never trust, always verify,” helping organizations move away from broad network-level trust toward identity-centric access control. Instead of exposing infrastructure to authenticated users by default, AppGate ZTNA grants access only to explicitly authorized resources based on identity, device posture, contextual signals, and policy enforcement.
This approach helps organizations support several operational and compliance objectives tied to Phase 2 readiness, including:
- Enforcing least-privilege access across distributed environments
- Continuously authenticating users and devices throughout sessions
- Reducing lateral movement through segmentation and segment-of-one access
- Improving visibility into user and device activity
- Securing remote access without exposing critical infrastructure to discovery
AppGate ZTNA also leverages technologies including mutual TLS (mTLS) and Single Packet Authorization (SPA) to help protect communications and cloak infrastructure from unauthorized visibility.
For defense contractors managing remote workforces, subcontractor access, third-party connectivity, and hybrid infrastructure, these capabilities can help reduce operational complexity while supporting stronger alignment with CMMC access control requirements.
Importantly, AppGate’s direct-routed architecture allows organizations to maintain greater control over how traffic traverses the environment without relying on cloud proxies or centralized broker architectures that can introduce latency, operational dependencies, or additional exposure points.
Preparing for November 2026 Takes Longer Than Many Organizations Expect
November 10, 2026 may sound far enough away to plan around, but Phase 2 readiness is not a quick-turn compliance exercise.
Preparing for Level 2 assessments can require months of remediation, documentation, internal coordination, policy enforcement, and operational alignment across teams, subcontractors, and external providers. For many organizations, preparation efforts may include:
- Gap assessments against NIST SP 800-171
- Security architecture modernization
- Access control redesign
- Documentation and policy development
- Logging, monitoring, and audit readiness
- Vendor and subcontractor coordination
- Internal testing and remediation
Those efforts take time, particularly in distributed environments with legacy infrastructure and complex third-party access requirements.
As the November 2026 deadline approaches, organizations may also face increased pressure around assessor availability, remediation timelines, and procurement requirements tied to prioritized contracts. Organizations that begin modernizing access controls and operational processes earlier will likely have more flexibility to address gaps strategically rather than reactively.
Phase 2 Is Turning Access Security into a Business Requirement
Phase 2 goes beyond checking a compliance box.
Organizations must now demonstrate through third-party validation that security controls are implemented and operating effectively across their environments. That is one reason access security decisions are receiving renewed attention across the defense supply chain.
Organizations that modernize identity-centric access controls, strengthen visibility, reduce implicit trust, and improve segmentation now will likely be better positioned not only for upcoming assessments, but for long-term operational resilience as CMMC enforcement continues expanding.
Preparing for Phase 2 assessments? Download the CMMC 2.0 mapping guide to see how AppGate ZTNA supports Level 2 access control and authentication requirements.