TAC and CMMC 2.0
How TAC delivers the access control, authentication, and audit requirements at the heart of CMMC 2.0 Level 2 — the NIST SP 800-171 control families that gate Defense Industrial Base contracts.
Note: CMMC 2.0 Level 2 maps one-to-one to the 110 security requirements of NIST SP 800-171, organized into 14 control families. This guide describes how TAC delivers the technical controls in the families concerned with electronic access to Controlled Unclassified Information (CUI) — Access Control, Identification & Authentication, and Audit & Accountability — with supporting coverage for System & Communications Protection. Achieving CMMC Level 2 requires implementing all 14 control families and passing a C3PAO assessment (or authorized self-assessment). TAC is one technical component of that effort; it does not, by itself, make an organization CMMC certified, nor does it address the administrative, physical, personnel, training, or program-governance families.
CMMC 2.0 is NIST 800-171 — with verification
The Cybersecurity Maturity Model Certification (CMMC) 2.0 exists to verify that the Defense Industrial Base protects Controlled Unclassified Information. Its three levels build on a single foundation: Level 1 covers basic safeguarding of Federal Contract Information; Level 2 maps directly to the 110 security requirements of NIST SP 800-171 across 14 control families; Level 3 adds enhanced controls from NIST SP 800-172.
The relationship is simple: NIST 800-171 provides the “what” — the requirements for protecting CUI — and CMMC provides the “how” — the verification, through self-assessment or third-party (C3PAO) certification, depending on the contract. With the DFARS CMMC final rule now in effect, CMMC language is appearing in new DoD contracts, and certification is increasingly a prerequisite to bid or retain defense work.
Several of the most heavily weighted control families — Access Control (the largest technical domain), Identification & Authentication, and Audit & Accountability — are fundamentally access control problems. This is exactly where TAC delivers. If your organization already aligns to NIST 800-171 or 800-53, the same TAC capabilities carry directly into CMMC.
Where TAC Delivers Primary Coverage
TAC delivers the technical controls behind the CMMC 2.0 Level 2 families governing electronic access to CUI (NIST 800-171 references shown).
The remaining control families — and the certification itself
CMMC 2.0 Level 2 requires all 14 NIST 800-171 control families. TAC does not address Awareness & Training, Configuration Management (beyond access-related boundary configuration), Incident Response, Maintenance, Media Protection, Personnel Security, Physical Protection, Risk Assessment, or Security Assessment — these are administrative, physical, personnel, and program activities outside the scope of an access control platform. TAC also does not produce the System Security Plan (SSP) or Plan of Action & Milestones (POA&M), and it cannot make an organization “CMMC certified” — Level 2 certification is granted only through a C3PAO assessment or an authorized self-assessment of the complete program. TAC produces the technical access, authentication, and audit evidence assessors expect for the AC, IA, and AU families, of which it is one component.
One platform across CMMC, NIST, and FedRAMP
Because CMMC 2.0 Level 2 is a direct adoption of NIST SP 800-171 — itself a refined subset of NIST 800-53 — the access controls that satisfy CMMC are the same ones that satisfy NIST and FedRAMP. The MFA enforcement that meets CMMC IA controls meets NIST IA controls. The audit logging that meets CMMC AU controls meets NIST AU controls. The boundary protection that meets CMMC SC controls meets FedRAMP boundary requirements.
For a defense contractor, this means the access-control evidence is built once and reused across every framework a contract may require. You are not standing up a separate CMMC access program — you are applying one platform to all of them, then pointing your C3PAO assessor at the same logs, the same authentication records, and the same enforcement policies.
See the companion TAC and NIST Alignment Guide and TAC and FedRAMP Guide for the underlying control mappings.
Preparing for CMMC 2.0 Level 2?
Our team can map your CUI access architecture against the CMMC Level 2 control families and show how TAC delivers the access control, authentication, and audit evidence your C3PAO assessor will expect.
Talk to a SpecialistBack to Resources