FutureFeed CMMC Education Series · Access Control
Access Control (AC): 3.1.2
The short version
If you’re responsible for CMMC compliance, here’s what this requirement comes down to. You need to:
- Give each person only the access their job actually needs, and nothing extra
- Limit powerful or sensitive functions to the people whose jobs require them
- Review permissions regularly and remove access the current job no longer needs
- Keep dated records of what access each role or person has, and why
If you already have those things and can prove them, you’re well on your way. Now let’s talk about what each one actually looks like.
In plain English
The last control decided who you trust to come in. This one decides how much you trust them once they’re inside. If the first control is the front door, this one is the set of interior doors: being allowed in the building doesn’t mean you can open every room.
In plain terms, each person should be able to do only the tasks their job requires, and no more. Someone who enters invoices doesn’t need to change payroll settings or install software. This is the idea people call “least privilege”: give the smallest amount of access that still lets someone do their job.
Give what the job needs, and nothing extra. That one line is the whole control.
Your accounting clerk needs to enter invoices, but never needs to change payroll settings or install programs, so their account can do exactly that and nothing more. An IT administrator who manages accounts gets those powerful rights, but uses a normal account for everyday email and browsing. When the clerk moves into a new role, their old permissions come off and new ones that match the new job go on. That’s what this requirement is asking you to do.
What you need to have in place
To be compliant, each of those boxes needs to be real and repeatable:
- Access scoped to the job, so each person can run only the transactions and functions their role requires.
- A consistent way to assign it. Many organizations find that grouping permissions by role makes this easier to manage, but CMMC doesn’t require any specific method: the requirement is the limit itself.
- Extra care with powerful functions, so sensitive actions like installing software, changing security settings, or administering accounts are limited to the people whose jobs require them.
- Regular reviews to catch access that has grown beyond what the job needs, and remove it.
- Dated records of what access each role or person has, and why.
The through-line is least privilege: access should match responsibility. Getting through the door doesn’t mean you can do everything once you’re inside.
A new stop every Tuesday and Thursday.
Our twice-weekly series breaking CMMC down one step at a time. Opt in and we’ll send each one to your inbox.
What you need to prove it
Think in three buckets. An assessor will want all three, so it helps to build them at the same time.
People
- Someone who owns permission decisions (usually your IT or security lead)
- Managers who confirm what their people actually need to do their jobs
- Whoever runs the periodic permission reviews
Tools
- Your identity system and its groups or roles (for many contractors, Microsoft Entra ID or Active Directory)
- The applications themselves, where per-function permissions actually live
- Somewhere permissions are recorded and reviewed
Documents
- An access control policy describing how permissions map to roles and jobs
- A record of your roles and the permissions each one carries
- Permission review records with dates
- A note in your System Security Plan (SSP) describing the process
You don’t need heavy tooling. You need to show that access matches the job, and that you check it.
When should I work on this
Build this right after 3.1.1. Once you’ve decided who and what is allowed in, the natural next question is what they’re allowed to do once inside. These two are the basic requirements of the Access Control family, and they’re usually set up together. Getting least privilege right here also makes the more detailed access controls later in this family (things like separating duties and limiting admin functions) far easier, because you’ve already started from “only what the job needs.”
Common challenges
Everyone gets more access than they need.
Why it happens: It’s faster to grant broad access or copy a coworker’s permissions than to work out the minimum.
Recommendation: Start from what the job needs and add only that. Grouping permissions by role keeps it consistent.
Powerful functions are handed out too widely.
Why it happens: Sensitive rights get granted for convenience during setup and never pulled back.
Recommendation: Limit powerful functions to the people who need them, and have those people use a normal account for everyday work.
Old permissions never get cleaned up.
Why it happens: Permissions accumulate over time. People change roles but keep their old access, so accounts quietly collect rights the current job no longer needs.
Recommendation: Review permissions on a schedule and remove anything the current role doesn’t require.
What good looks like
A compliant contractor can usually answer yes to all of these:
- Can each person do only what their job requires, and no more?
- Are powerful or sensitive functions limited to the people who truly need them?
- Do you review permissions regularly and remove the extras?
- Can you show, with records, what access each role or person has and why?
If any answer is no, that’s your next place to start.
This control is not the same as 3.1.1. That one controls who gets in; this one controls what they can do once inside. Also, the requirement is to limit users to the transactions and functions they’re permitted to execute. It does not mandate a specific tool or a formal role-based access system. Role-based groups are a common, practical way to get there, but the requirement is the limit itself, however you achieve it.
How this connects to other controls
This control doesn’t stand alone. A few close relationships:
- Access Control 3.1.1: that control is the front door (who and what gets in); this one is the interior doors (what they can do). They’re the two basic access requirements and are built together.
- Least privilege and privileged accounts (3.1.5, 3.1.6): later controls in this family go deeper on this same idea. This one is the foundation they build on.
- Personnel Security: when someone changes roles, their permissions should change with them, which ties transfers directly to this control.
The requirement, word for word
For your reference, here’s the exact language so you’re working from the source and not a paraphrase:
Limit system access to the types of transactions and functions that authorized users are permitted to execute.
Every organization implements these controls a little differently. If you’re not sure whether your approach would satisfy an assessor, join one of our upcoming webinars or schedule a 15 Minutes with FutureFeed session. We’d rather answer your questions now than have you discover them during an assessment.
CMMC: Everything You Need to Know to Get Started (6th Edition)
Want the full compliance framework and the funding resources available to defense contractors? Our guide has it.
Sources
- NIST SP 800-171 Rev 2, Access Control (3.1)
- Related standards: NIST SP 800-53 Rev 5 (AC-3 Access Enforcement; the Access Control basic requirements also map to AC-2 and AC-17) · DFARS 252.204-7012
