The Cybersecurity Maturity Model Certification (CMMC) is the US Department of Defense’s framework for securing sensitive data across its supply chain—designed to ensure that any contractor handling Controlled Unclassified Information (CUI) meets strict cybersecurity standards. With the release of CMMC 2.0, the model has been significantly strengthened in response to increased cyber threats, making compliance a strategic business imperative for defense contractors and manufacturers.
The updated rule is expected to take effect in 2025, at which point CMMC compliance will be mandatory for companies looking to win or maintain DoD contracts. For manufacturers operating on just-in-time models—where speed, precision and minimal downtime are essential—there’s concern that added cybersecurity requirements could disrupt workflows by creating friction for frontline workers.
And that’s where things start to get complicated.
Most manufacturers have diverse OT and IT environments and run a complex mix of legacy applications, on-prem systems, standards-based tools and cloud platforms—a patchwork that’s grown over time to support specific operational needs. While this hybrid environment may be essential for productivity, it’s a nightmare to secure consistently.
Yet consistency is exactly what CMMC demands.
What CMMC 2.0 is really asking for
CMMC 2.0 simplifies the original five-tier model into three levels, but raises the bar for enforcement, primarily for contractors in the Defense Industrial Base (DIB). At Level 2 (Advanced), organizations must implement all 110 controls from NIST SP 800-171, which may include conducting third-party assessments.
Assessors and auditors are looking for evidence of real-world implementation. Level 2 requires manufacturers in the defense supply chain to prove that:
- Every user has the right access at the right time
- Access is limited based on job roles and responsibilities
- Authentication is secure and traceable to an individual
- Computing environments (cloud, hybrid, on-premises) abide by the same access control principles
This is no small feat when many manufacturing environments span SAML-based SaaS apps, thick-client and legacy tools and custom on-prem software.
The hidden compliance gap: Disconnected access models
Modern identity and access management solutions are optimized to secure modern, standards-based apps using standards like SAML and OIDC. But with legacy applications still deeply embedded in many manufacturing environments, many are lacking native support for these protocols.
This leaves IT teams piecing together exceptions, building manual workarounds and inconsistent enforcement policies that disrupt frontline worker productivity. This also creates friction and frustration, increasing the risk of human error.
From a compliance perspective, this is a problem. If legacy apps require different access workflows, how can organizations ensure:
- The same authentication strength across all systems,
- the same audit trail visibility,
- or the same automated deprovisioning on role changes?
A lack of unified access controls exposes soft spots that could lead to a failed CMMC audit—or worse, create real security vulnerabilities.
Adapting access processes for critical legacy apps
Smart Factories and Industry 4.0 might be top of mind for some manufacturers, but for many, critical legacy systems remain essential to daily operations, powering everything from production scheduling to supplier logistics. Yet, without support for modern authentication standards, it’s difficult to enforce consistent access policies.
Rather than replacing critical legacy tools, manufacturers need access strategies that bridge the gap, bringing legacy applications into a unified, policy-driven ecosystem. When users can access all devices, endpoints and applications—modern or legacy—through the same secure, streamlined workflows, it doesn’t just reduce friction and make their job easier. It also meets compliance requirements, improves visibility and lays the groundwork for a more secure and resilient digital infrastructure. Ultimately, it’s about making sure every access point is held to the same standards of both efficiency and security.
Productivity as a compliance standard
A common concern is that stronger security controls will slow people down—especially on the production floor, where just-in-time manufacturing depends on fast system access, minimal downtime and efficient shift turnover.
However, a well-integrated access solution can reduce login times, lower helpdesk burden and improve user experience, all while ensuring that only the right people are accessing the right tools.
By applying modern identity and access workflows (like shared workstation access, SSO, passwordless authentication, third party remote access and automated session logging) consistently across all systems, organizations not only meet CMMC requirements but also streamline operations, resulting in less context-switching, fewer passwords, better audit logs and heightened productivity.
A strategic opportunity in disguise
CMMC compliance might feel like yet another mandate, but it could also be viewed as a powerful catalyst for impactful change. It’s an opportunity to take control of user access across a fractured environment, gain full visibility into user behavior and close long-standing security gaps that have traditionally been overlooked.
For manufacturers juggling legacy and modern tech stacks, the priority isn’t perfection, but consistency and control. By investing in a unified access strategy that extends across your entire application landscape, you position your organization to pass CMMC audits and operate with more confidence, more agility and less risk.
To hear best practices about how to approach access management in complex manufacturing environments, check out this Imprivata webinar on Enhancing Access and Security in Manufacturing Environments.
