What Unreviewed Cloud Infrastructure Costs You in a CMMC Assessment

CM-8: System Component Inventory and the Orphaned Resource Problem

NIST 800-171 Rev 2 requirement 3.4.1, the current assessment baseline, requires organizations to establish and maintain baseline configurations and inventories of system components. Rev 3 moves the inventory into requirement 03.04.10 (derived from CM-8) and adds an Organization-Defined Parameter for how often the inventory is reviewed and updated.

An unreviewed cloud environment contains resources with no active owner, no documented purpose, and no decommission decision on record. Unattached EBS volumes, idle load balancers, and orphaned static IP addresses are not just billing line items. They are system components that exist inside the authorization boundary with no SSP entry, no security controls actively applied to them, and no configuration baseline documentation.

A C3PAO assessor reviewing your environment will find these resources. They will ask for the inventory entry. If none exists, the finding goes in the assessment report. Understanding the read-only forensic audit methodology (opens in a new tab) used to identify and document these components, across EBS volumes, static IPs, and idle load balancers via platform-native APIs, is the foundation of a defensible inventory posture.

The Cloud Execution Ledger produced in a Phase 1 audit is CM-8 documentation. It is a timestamped inventory of every resource reviewed, every resource with no active operational purpose identified, and every remediation action taken. It demonstrates that the inventory review was conducted, when it was conducted, and what changed as a result.

AC-2 and AC-6: Access Control and the Principle of Least Privilege

NIST 800-171 Rev 2 requirements 3.1.1 (AC-2) and 3.1.5 (AC-6) require organizations to manage system accounts and enforce least privilege. In Rev 3 (03.01.05), Organization-Defined Parameters add the security functions that require explicit authorization and the frequency of privilege review.

IAM misconfigurations are the most common finding in GovCon cloud environments operating without a dedicated security review function. Wildcard IAM permissions ("Action": "" or "Resource": "") on non-root accounts violate AC-6 directly. IAM users with administrator-equivalent role bindings who are no longer active on the contract violate AC-2. Service accounts with Owner-level role assignments at the GCP project level are the same category of finding with different syntax.

Phase 1 does not remediate these findings, read-only access does not permit IAM policy changes. But Phase 1 documents them with specificity: which principal, which permission boundary violation, which control mapping applies. That documentation is the input the Phase 2 remediation sprint requires to execute IAM lockdown under CAB approval.

SC-28: Protection of Information at Rest

NIST 800-171 Rev 2 requirement 3.13.16 (SC-28) requires protection of CUI at rest, and 3.13.11 requires FIPS-validated cryptography when it is used to protect CUI, which in practice means server-side encryption enabled at the volume and bucket level for any storage resource inside the CUI authorization boundary.

Unencrypted EBS volumes, Azure managed disks without server-side encryption enabled, and GCP Persistent Disks without Customer-Managed Encryption Keys configured are SC-28 findings. These are identifiable under read-only access because encryption status is exposed in the resource metadata API, not just through write-level inspection.

Phase 1 surfaces these findings in the Infrastructure Health and Security Snapshot. SC-28 gaps are among the most common CMMC pre-assessment failures for GovCon cloud environments and among the fastest to remediate once identified.

AU-2 and AU-3: Audit Logging and Event Coverage

NIST 800-171 Rev 2 requirements 3.3.1 and 3.3.2 (AU-2 and AU-3) require organizations to create and retain audit records for events that are relevant to monitoring, analysis, investigation, and reporting. In Rev 3 (03.03.01), an Organization-Defined Parameter requires the organization to define the event types that are audited, with specific documentation of the rationale for each type.

GovCon cloud environments without centralized, immutable logging configurations are AU-2 and AU-3 gaps by definition. The cloud spend visibility gap in federal environments (opens in a new tab), where agencies consistently underreport spending because they lack consistent collection processes, is the same structural problem that produces absent audit logging: no one assigned to look means no record of what changed. Environments where CloudTrail is not enabled in all active regions, where Azure Monitor Diagnostic Settings are not configured at the subscription level, or where GCP Cloud Audit Logs have admin activity logging disabled have no audit record for configuration changes made to the environment.

Phase 1 identifies absent or incomplete logging configurations as a security finding. Phase 2 remediates them. The Compliance Baseline Report produced at Phase 2 close documents the before-state (logging absent or incomplete), the remediation executed, the NIST control satisfied, and the UTC timestamp of the configuration change. That document is what a C3PAO pre-assessment coordinator reviews to determine whether the environment is ready for formal assessment scheduling.

SC-7: Boundary Protection and Open Inbound Rules

NIST 800-171 Rev 2 requirement 3.13.1 (SC-7) requires organizations to monitor and control communications at the external boundary of the system. Rev 3 (03.13.01) carries the requirement forward and adds an Organization-Defined Parameter tying managed interfaces to the organization's defined security architecture.

EC2 security groups with inbound rules permitting 0.0.0.0/0 on port 22 (SSH) or port 3389 (RDP), Azure NSGs with equivalent unrestricted inbound rules, and GCP firewall rules with 0.0.0.0/0 source ranges on administrative ports are SC-7 findings. These are identifiable under Phase 1 read-only access. They are not theoretical risk. They are active, open paths into the production environment with no boundary control applied. For the financial structure of a corrective engagement, including the fee model and how savings are calculated against the remediation baseline, see the financial case for corrective cloud engagement (opens in a new tab) that frames this work for budget decision-makers.

The Documentation Posture Required Before a C3PAO Assessment

A C3PAO pre-assessment review does not evaluate your controls in isolation. It evaluates your documentation of those controls: what was the state before, what did you do, when did you do it, and how do you know it worked.

An organization that walks into a C3PAO pre-assessment with an unreviewed cloud environment has no answers to those questions. The findings will be documented in the assessment report, the remediation timeline will be set by the C3PAO's schedule, not yours, and the certification window will move out accordingly.

A Phase 1 GovCon Cloud Infrastructure Audit establishes the before-state documentation. A Phase 2 Cybersecurity Hardening Sprint produces the remediation evidence. Together, those two engagements produce the Compliance Baseline Report, a document with timestamped, control-mapped remediation evidence for every finding identified, that is what a C3PAO pre-assessment coordinator needs to confirm an organization is ready for formal assessment scheduling.

CMMC Phase 2, which would have made C3PAO assessments mandatory for Level 2 from November 2026, was suspended on July 13, 2026 (opens in a new tab). Level 2 self-assessment obligations still apply, and the documentation has to exist whenever the next assessment date is set. A Phase 1 audit completes in 5 business days. Phase 2 remediation runs 14 calendar days. If your environment has not been reviewed and the findings have not been documented, that clock is running.

The Compliance Baseline Report produced at the close of a Phase 2 Cybersecurity Hardening Sprint is the documentation that closes that gap. It is built from the findings the Phase 1 audit surfaces, and the Phase 1 GovCon Cloud Infrastructure Audit is where that chain of evidence starts.