CMMC Policy Template: Sample Access Control Policy
The whole Access Control family, all 22 requirements of NIST SP 800-171 Rev 2 section 3.1, worked end to end for a fictional Mac-managed contractor. Every field is filled, so you can see what a finished answer looks like rather than a bracket waiting for one. 17 pages, watermarked SPECIMEN.
Download the PDF, 288 KBPurpose and scope
This policy records the access control decisions Northgate Composites, Inc. has made for the systems, people and locations that handle Controlled Unclassified Information. It states management intent; the steps that carry it out live in the procedures named against each requirement.
This policy applies to the Northgate CUI Enclave, the 31 people listed in the scoped personnel register, and the Cedar Street facility. Assets outside that boundary are governed by the general information security policy.
Access control decisions
Requirement, NIST SP 800-171 R2
Limit information system access to authorized users, processes acting on behalf of authorized users, or devices including other information systems.
Our decision
Only individuals with a current business need and an approved access request hold accounts in the Northgate CUI Enclave. Automated processes hold their own named accounts and are never run under a person's credentials. Devices reach the enclave only after they are recorded in the asset inventory and enrolled under managed configuration.
Requirement, NIST SP 800-171 R2
Employ the principle of least privilege, including for specific security functions and privileged accounts.
Our decision
Daily work on all Macs is performed with non-privileged accounts. Administrator rights are granted per task, expire after eight hours, and require approval from the system owner recorded in the access request. Two named individuals hold standing administrative rights; both hold signed privileged access agreements reviewed quarterly.
Requirement, NIST SP 800-171 R2
Monitor and control remote access sessions.
Our decision
Remote access is permitted only through the managed tunnel. Session monitoring is not yet continuous: sessions are logged but reviewed monthly rather than on a rolling basis. Continuous review is committed under POAM-2026-014, due 2026-11-30.
Requirement, NIST SP 800-171 R2
Authorize wireless access prior to allowing such connections.
Our decision
No wireless network reaches the Northgate CUI Enclave. Enclave devices connect over wired ethernet at the Cedar Street facility and over the managed tunnel elsewhere. Wireless interfaces on enclave devices are disabled by managed configuration, and the justification is recorded in the SSP.
Requirement, NIST SP 800-171 R2
Limit use of portable storage devices on external systems.
Our decision
Portable storage is not authorized for CUI under any circumstance, which is narrower than the requirement contemplates. The alternative is enforced technically by blocking removable media at the device rather than administratively by policy alone. Recorded under RISK-2026-003 and accepted by the President.
Blocks for the remaining seventeen Access Control requirements follow the same pattern and are omitted from this specimen.
Exceptions and enforcement
A decision in this policy that cannot be met is recorded as an exception before the gap exists. Exceptions are logged in CMO-WBK-EXC-001 with the identifier format EXC-YYYY-NNN, carry a compensating control, an expiry date, and the signature of the President. An exception without an expiry date is not an exception; it is an undisclosed gap. Failure to follow this policy is handled under the employee handbook disciplinary process.
Related artifacts
| ID | Title | Why it is related |
|---|---|---|
| CMO-SSP-001 | System Security Plan | Carries the objective-level coverage and evidence pointers this policy summarises. |
| CMO-PRO-ONB-001 | Personnel Onboarding Procedure | Executes the provisioning and least-privilege decisions. |
| CMO-FRM-AR-001 | Access Request Form | The record that proves authorization. |
| CMO-WBK-POAM-001 | POA&M Operational Plan | Holds POAM-2026-014. |
| CMO-WBK-EXC-001 | Policy Exception Tracker | Holds RISK-2026-003. |
What this CMMC policy template does and does not do
A CMMC policy template is a starting structure, not assessment evidence. This sample shows how a small defense contractor can express management decisions about authorized access, least privilege, remote access, external connections, mobile devices, and controlled information flow.
Do not copy it wholesale. Replace every placeholder and example with the people, systems, boundaries, review cycles, and enforcement mechanisms you actually operate. The useful test is simple: can the SSP point to the policy, can staff explain the procedure, can the technical settings enforce it, and can you produce a dated record? If not, the policy is still prose.
The structure can support your program, but it does not satisfy all 22 Access Control requirements on its own. Each applicable requirement still needs an implementation that meets its assessment objectives and produces evidence.
Build an assessment chain, not a policy binder
| Layer | What belongs there | Access-control example |
|---|---|---|
| Policy | The approved management decision: what is required, prohibited, or authorized. | Only approved users, devices, and processes may access the CUI environment. |
| Procedure | The repeatable steps, roles, approvals, exceptions, and review cadence. | A manager requests access, the system owner approves it, IT provisions it, and Security reviews it quarterly. |
| Technical enforcement | The configuration that makes the decision real. | Identity groups, conditional access, MDM enrollment, standard-user accounts, and time-bound privilege. |
| Evidence | The dated record showing the process and control operated. | Approved tickets, group exports, MDM inventory, privilege logs, quarterly review records, and termination samples. |
| SSP | The implementation narrative connecting scope, mechanism, owner, and evidence. | The SSP names the identity provider, device boundary, provisioning workflow, evidence repository, and review frequency. |
Trace the chain in both directions. Each policy statement should lead to an operating procedure, enforcement point, and record. Each technical setting or evidence artifact should lead back to an approved requirement and an SSP statement.
How to adapt the sample
- Replace every fictional organization, owner, approver, system, date, and artifact ID.
- Remove examples that do not match your architecture; do not preserve controls you cannot demonstrate.
- Align the boundary and asset terminology with the SSP, asset inventory, data-flow diagram, and service-provider responsibilities.
- Link each policy decision to an owned procedure, technical enforcement point, evidence source, and review cadence.
- Confirm the actual MDM, identity, remote-access, endpoint, and logging settings before describing them.
- Approve and version the policy, then retain the dated review and change records.
- Test the full chain with an ordinary user, a privileged user, and a terminated user before relying on it in an assessment.
Use the CMMC Level 2 controls list to confirm coverage, the CMMC SSP guide to connect the narrative, and the complete CMMC policy and procedure templates when you need the full cross-referenced system.
Source basis: 32 CFR Part 170 and the DoD CMMC Level 2 Assessment Guide. Confirm the clauses and requirements in your own contract. Last verified: August 2026.
The public Suite R2026.3 manifest lists all 44 Core documents, 54 Complete documents, seven workbooks, and the training deck by artifact ID and title.
View the Suite R2026.3 manifestThen compare Core and Complete before checkout.