Defense contractors are meeting Cybersecurity Maturity Model Certification (CMMC) 2.0 network requirements by segmenting their Controlled Unclassified Information (CUI) environments, enforcing strict access controls, and replacing aging perimeter-based infrastructure with software-defined networking that gives them real audit trails and enforceable policy. The contractors who are actually passing assessments in 2026 are not the ones with the biggest budgets. They are the ones who got serious about scoping, documentation, and network architecture early. This article breaks down the specific controls, the common failure points, and what you can do before your assessment date arrives.
What specific network controls does CMMC 2.0 actually require?
CMMC 2.0 network requirements are drawn directly from NIST SP 800-171, the National Institute of Standards and Technology’s framework for protecting CUI. At Level 2, contractors must enforce access control, audit and accountability, configuration management, identification and authentication, system and communications protection, and system and information integrity. The network-specific controls that assessors focus on most are traffic encryption in transit, network segmentation, and access logging.
In plain terms, you need to prove that CUI never travels over an unencrypted channel, that only authorized users and systems can reach the environments where CUI lives, and that you have logs showing who accessed what and when. These are not aspirational goals. They are pass/fail checkboxes during a Certified Third-Party Assessment Organization (C3PAO) assessment.
The controls that trip up contractors most often are SC-7 (boundary protection), AC-17 (remote access), and IA-3 (device identification). Boundary protection means you have defined and enforced a perimeter around your CUI environment. Remote access means every connection from outside that boundary is authenticated, encrypted, and logged. Device identification means your network knows exactly which devices are allowed in, and unknown devices cannot connect.
How do defense contractors scope their networks for CMMC assessment?
Scoping is the single most important decision a defense contractor makes before a CMMC assessment. Your scope defines which systems, people, and infrastructure are subject to the full set of CMMC controls. A smaller, well-defined scope means fewer controls to implement and fewer things that can fail during assessment. Most contractors who struggle with CMMC have scoped too broadly or not at all.
The goal is to isolate your CUI environment from the rest of your business operations. That means identifying every system that stores, processes, or transmits CUI, then drawing a hard boundary around it. Systems outside that boundary should have no path to CUI. If they do, they fall inside the scope whether you intended it or not.
Practical scoping steps include mapping your data flows first, before touching any infrastructure. Follow the CUI from the moment it enters your organization to every place it could travel or rest. Then ask whether each system in that path is strictly necessary. Every system you can remove from scope is one less system you need to harden, document, and defend during assessment.
What’s the difference between CMMC Level 1, Level 2, and Level 3 network requirements?
The three CMMC levels represent increasing security maturity, and the network requirements scale accordingly. Level 1 covers Federal Contract Information (FCI) and requires only basic cyber hygiene, roughly 17 practices drawn from FAR 52.204-21. Level 2 covers CUI and aligns to all 110 practices in NIST SP 800-171. Level 3 goes beyond that, adding practices from NIST SP 800-172 for contractors working on the most sensitive Department of Defense (DoD) programs.
Level 1 network requirements
At Level 1, the bar is low but not zero. You need basic access controls, password policies, and malware protection. Network-specific requirements are minimal. Most small contractors handling only FCI can meet Level 1 with standard IT hygiene and an annual self-assessment.
Level 2 network requirements
Level 2 is where most defense industrial base (DIB) contractors live, and where the real network work happens. You need encrypted communications, network segmentation, multi-factor authentication (MFA) for all remote access, and comprehensive audit logging. Third-party assessment is required for contractors on prioritized acquisitions. This is the level where legacy VPN (Virtual Private Network) infrastructure starts to crack under the weight of the requirements.
Level 3 network requirements
Level 3 applies to contractors supporting advanced persistent threat (APT) environments. It adds requirements around enhanced monitoring, supply chain risk management, and government-led assessments by the Defense Contract Management Agency (DCMA). The network architecture at this level needs to support near-real-time threat detection and response, not just access control and logging.
Why do traditional VPNs fall short for CMMC 2.0 compliance?
Traditional VPNs fall short for CMMC 2.0 compliance because they were built for a different era of network architecture. A conventional VPN creates an encrypted tunnel between a user and a central gateway, but it grants broad network access once that tunnel is established. That flat access model directly conflicts with CMMC’s requirements for least-privilege access, network segmentation, and granular audit logging.
The specific problems are well-documented in the defense industrial base. VPN concentrators become single points of failure and single points of attack. Lateral movement inside the network is easy once a credential is compromised. Logging is often incomplete, capturing connection events but not granular access activity. And scaling a VPN infrastructure to cover distributed manufacturing sites, remote engineers, and IoT devices on the shop floor is expensive and operationally painful.
There is also the technical debt problem. Many defense contractors are running VPN infrastructure that is five to ten years old. Patching it, auditing it, and proving to a C3PAO that it meets current cryptographic standards is a significant burden. NIST and the NSA (National Security Agency) have both signaled that post-quantum cryptography readiness is coming into scope for defense networks. Legacy VPN stacks are not built for that transition. This is where the defense industrial base quantum security challenge becomes concrete: the infrastructure that got you through the last decade will not carry you through the next one.
How can software-defined networking simplify CMMC 2.0 compliance?
Software-defined networking (SDN) simplifies CMMC 2.0 compliance by giving you a centrally managed, policy-enforced overlay network that maps directly to what assessors want to see. Instead of a flat network with a perimeter you hope holds, you get a network where every connection is authenticated, encrypted, and logged by design. Segmentation is a configuration choice, not a hardware project.
An encrypted overlay network (a private network built on top of the public internet) lets you define exactly which devices can communicate with which other devices, enforce that policy from a single control plane, and produce audit logs that satisfy AC-17 and SC-7 requirements without manual log aggregation. You can scope your CUI environment precisely, because the overlay network is the boundary. Devices outside the overlay simply cannot reach CUI systems.
For defense contractors managing distributed environments, this matters enormously. A manufacturer with facilities in three states and remote engineers working from home cannot practically segment those environments with hardware appliances at every site. Software-defined networking defense approaches let you extend the same policy and the same audit trail across every location without a truck roll or a capital expenditure request.
The cryptographic foundation also matters for forward compliance. Modern software-defined networking platforms built to FIPS-140 (Federal Information Processing Standard 140) and NIST standards give you a documented, auditable cryptographic posture. That is exactly what assessors ask for, and it is what positions you for the post-quantum requirements that are already appearing in advanced defense contracts.
What should defense contractors do before their CMMC assessment?
Before your CMMC assessment, you need to complete four things: a current-state gap analysis, a scoping decision, a System Security Plan (SSP), and a Plan of Action and Milestones (POA&M) for anything not yet remediated. Assessors will ask for all of these on day one. Showing up without them signals that you are not ready.
Start with the gap analysis. Map every NIST SP 800-171 control against your current environment and document what is in place, what is partial, and what is missing. Be honest. Assessors are experienced, and a gap analysis that claims full compliance when the evidence does not support it will damage your credibility during the assessment.
Next, finalize your scope. As discussed above, a tighter scope is a stronger scope. If you have not yet segmented your CUI environment from your general business network, that is the highest-priority infrastructure work to complete before assessment. Every day that CUI can reach systems outside your intended scope is a day you are accumulating findings.
Document your network architecture in detail. Draw the boundary. Label every system inside it. Show the data flows. Assessors need to see that you understand your own environment. If you cannot explain your network architecture clearly, that is a red flag regardless of what the controls say.
Finally, test your logging. Run a simulated remote access session and verify that the logs capture what they need to capture. Check that your MFA is enforced on every remote access path, not just the primary one. Gaps in logging and authentication are the most common findings in CMMC Level 2 assessments.
How ZeroTier helps defense contractors meet CMMC 2.0 network requirements
ZeroTier’s encrypted overlay networking platform is built for exactly the environment CMMC 2.0 describes: distributed, multi-site, mixed-device networks that need strong access control, encryption in transit, and clean audit trails without the operational overhead of legacy hardware.
- Scoped segmentation: ZeroTier networks are defined by policy. Only authorized devices join the overlay, which means your CUI boundary is enforced at the network layer, not just at the firewall.
- Encryption by default: Every connection on a ZeroTier network is encrypted end-to-end, satisfying SC-8 (transmission confidentiality) and supporting your AC-17 documentation.
- FIPS-140 and NIST compliance: ZeroTier supports defense-grade cryptography, and ZeroTier Quantum extends that to post-quantum cryptographic standards aligned with NIST and NSA CNSA 2.0, positioning contractors for the next wave of defense industrial base quantum security requirements.
- Self-hosted deployment: For air-gapped or sovereign environments, ZeroTier can be fully self-hosted, keeping your control plane inside your own infrastructure.
- No hardware, no site visits: Software-defined networking defense means you can extend your compliant network to new sites and devices without capital expenditure or on-site configuration.
If your CMMC assessment is on the calendar and your network architecture is not ready, the time to act is now. Talk to the ZeroTier team about how the platform fits your compliance environment.
Related Articles
- Is network segmentation enough — or are you still leaving the door open?
- What does Salt Typhoon tell us about the limits of perimeter-based security?
- Why are government IT teams moving away from hardware-dependent networking?
- Why is harvest-now-decrypt-later a procurement decision, not just a security one?
- Are your legacy remote access tools creating compliance exposure you can't see?