The CMMC Automation Playbook

CMMC Level 2 certification requires implementation of 110 security controls derived from NIST SP 800-171. The conventional approach—hiring compliance staff, engaging consultants, purchasing point solutions—costs the average 50–500 employee defense contractor between $280,000 and $480,000 annually. The median sits around $380,000.

This is not inevitable. It is the product of an industry that sells labor when it should sell systems.

Industry analysis of defense contractor compliance programs reveals a consistent pattern: 87 of 110 CMMC Level 2 controls (79%) can be fully or substantially automated, reducing total annual compliance expenditure to approximately $56,000—an 87% cost reduction based on industry estimates. The remaining 23 controls require human judgment, but even these benefit from automated evidence collection and monitoring.

This guide is a technical roadmap. No buzzwords. No vague promises. A concrete methodology for systematically automating CMMC compliance, control family by control family.

The Automation Classification Framework

Not every control can be automated, and pretending otherwise is how automation projects fail. The first step is honest classification. Every CMMC Level 2 control falls into one of three categories:

Fully Automatable (61 controls): Technical controls that can be implemented, monitored, and evidenced entirely through configuration and tooling. No recurring human decision-making required.

Hybrid—Automated with Human Oversight (26 controls): Controls where the technical implementation is automated, but periodic human review, decision-making, or attestation is required. Automation handles 80–90% of the work; humans provide judgment.

Human-Dependent (23 controls): Controls that are fundamentally about organizational decisions, policy, training, or physical security. These cannot be automated away, but evidence collection and compliance monitoring can be.

Control Family Breakdown

Below is the automation classification across all 14 NIST 800-171 control families. This is the strategic view—where to invest automation effort for maximum return.

Control Family	Controls	Auto	Hybrid	Manual
Access Control (AC)	22	14	5	3
Awareness & Training (AT)	3	1	1	1
Audit & Accountability (AU)	9	8	1	0
Configuration Mgmt (CM)	9	6	2	1
Identification & Auth (IA)	11	9	2	0
Incident Response (IR)	3	1	1	1
Maintenance (MA)	6	3	1	2
Media Protection (MP)	9	4	2	3
Personnel Security (PS)	2	0	1	1
Physical Protection (PE)	6	2	1	3
Risk Assessment (RA)	3	1	1	1
Security Assessment (CA)	4	2	1	1
System & Comms (SC)	16	12	3	1
System & Info Integrity (SI)	7	5	1	1

The pattern is clear: technical control families automate well; organizational and physical control families do not. This is intuitive but frequently ignored. Compliance vendors sell "complete automation" without acknowledging that Personnel Security and Physical Protection require humans. That misrepresentation creates audit failures.

The High-Return Automation Targets

Not all automation delivers equal value. The following five control families represent 72% of the total automation opportunity while consuming approximately 45% of implementation effort. Start here.

1. Audit & Accountability (AU): 89% Automatable

This is the single highest-return automation target. Traditional approaches assign a part-time analyst to log review, SIEM management, and audit trail maintenance—typically $45,000–$65,000 annually in loaded labor cost.

The automated approach: centralized log aggregation with pre-configured compliance correlation rules, automated retention management, and continuous integrity monitoring. Implementation cost: $8,000–$12,000 one-time, $3,000–$5,000 annual tooling.

Specific controls and their automation approach:

• AU.2.041–042 (System audit logging): Centralized SIEM with pre-built NIST 800-171 correlation rules. Configure once, validate quarterly.
• AU.2.043–044 (Audit review and reporting): Automated anomaly detection with threshold-based alerting. Weekly automated reports, monthly human review.
• AU.3.045–049 (Audit reduction, protection, retention): Infrastructure-as-code templates for log pipeline configuration, automated retention policies, cryptographic integrity verification.

2. Access Control (AC): 64% Automatable

Access Control is the largest control family at 22 controls, and also the most nuanced. Fourteen controls are fully automatable through identity provider configuration, role-based access policies, and network segmentation. Five require hybrid approaches—automated enforcement with periodic human access reviews. Three are genuinely manual, involving policy decisions about information sharing and remote access authorization.

The key automation mechanisms:

• Conditional access policies in Azure AD/Entra ID or equivalent, mapping directly to AC.1.001–004
• Automated user provisioning/deprovisioning via SCIM integration, addressing AC.2.007–009
• Network microsegmentation through software-defined networking, covering AC.2.013–016
• Session management automation for AC.2.011 (session lock) and AC.3.017–018 (privileged session controls)

3. System & Communications Protection (SC): 75% Automatable

SC controls map almost directly to network and infrastructure configuration—making them ideal automation candidates. Encryption in transit, encryption at rest, network boundary protection, and session authenticity are all configuration states, not ongoing human activities.

The implementation approach centers on infrastructure-as-code templates that enforce SC controls at deployment time:

• TLS/encryption enforcement via policy engines (SC.3.177, SC.3.185)
• Network segmentation through firewall-as-code (SC.3.180–182)
• DNS filtering and boundary protection through managed DNS and proxy services (SC.3.183, SC.3.192)
• FIPS 140-2 validated cryptography enforced at the platform level (SC.3.187)

4. Identification & Authentication (IA): 82% Automatable

IA controls are among the most straightforward to automate because they map directly to identity provider configuration. Multi-factor authentication, password policies, authenticator management, and identifier lifecycle management are all features of modern identity platforms—not separate compliance activities.

The entire IA family can be addressed through a properly configured identity provider (Azure AD, Okta, or equivalent) with:

• MFA enforcement for all CUI-accessing accounts
• Automated password policy enforcement (complexity, rotation, history)
• Automated account lifecycle management tied to HR systems
• Certificate-based authentication for service accounts

5. Configuration Management (CM): 67% Automatable

Configuration Management automation delivers disproportionate value because it prevents the configuration drift that causes failures across multiple other control families. A well-automated CM practice has cascading benefits.

Core automation mechanisms:

• Baseline configuration enforcement through device management platforms (CM.2.061–064)
• Change detection and alerting via file integrity monitoring and configuration drift detection (CM.2.065)
• Software whitelisting through application control policies (CM.3.068)
• Automated vulnerability scanning with prioritized remediation workflows (CM.2.066)

The Implementation Methodology

Automation projects fail not from technical complexity but from poor sequencing. The correct approach is a three-phase methodology that builds foundational capabilities before addressing dependent controls.

Phase 1: Identity & Access Foundation (Weeks 1–4)

Every other automation capability depends on a well-configured identity infrastructure. Begin here regardless of which controls you believe are highest priority.

• Deploy or configure identity provider with MFA enforcement
• Implement automated provisioning/deprovisioning
• Establish role-based access model aligned to CUI scope
• Configure conditional access policies for all CUI-accessing applications

Controls addressed: IA (9 controls), AC (8 controls) = 17 controls in 4 weeks

Phase 2: Monitoring & Configuration (Weeks 5–10)

With identity infrastructure in place, deploy monitoring and configuration management capabilities that depend on centralized identity.

• Deploy centralized log aggregation with compliance correlation rules
• Implement endpoint configuration baselines and drift detection
• Configure network segmentation and boundary monitoring
• Establish automated vulnerability scanning and patch management

Controls addressed: AU (8 controls), CM (6 controls), SC (10 controls), SI (4 controls) = 28 controls in 6 weeks

Phase 3: Evidence & Optimization (Weeks 11–16)

With technical controls automated, build the evidence collection and reporting infrastructure that sustains compliance and simplifies assessment.

• Automated evidence collection from all control implementations
• Continuous compliance dashboard with control-level status
• Automated POA&M tracking for non-automated controls
• Assessment preparation documentation generation

Controls addressed: CA (2 controls), RA (1 control), plus evidence automation for all 87 automated controls

The 23 Controls You Cannot Automate

Intellectual honesty requires acknowledging what automation cannot do. These 23 controls require genuine human judgment, organizational decision-making, or physical-world action:

• Personnel Security (PS.2.127–128): Screening personnel and ensuring CUI protection during termination require HR processes and human judgment.
• Physical Protection (PE.1.131–133, PE.3.136): Physical access controls, escort procedures, and environmental protections are physical-world activities.
• Awareness & Training (AT.2.056): While training delivery can be automated, ensuring personnel actually understand their security responsibilities requires human assessment.
• Incident Response (IR.2.093): Incident response testing and exercises require human participation and judgment.
• Policy and procedural controls across multiple families: Organizational policies require executive decisions about risk tolerance, acceptable use, and security governance.

For these 23 controls, the correct approach is not automation but automation-assisted compliance: automated reminders for periodic reviews, automated evidence collection of manual activities, and automated tracking of human attestations. This reduces the burden without creating false claims of automation.

The Economics: Why This Math Works

The traditional compliance cost structure for a 200-person defense contractor looks like this:

• Compliance manager (0.5–1.0 FTE): $75,000–$140,000
• Security analyst (0.5 FTE): $45,000–$65,000
• External consulting (annual): $60,000–$120,000
• Point solution licensing: $40,000–$80,000
• Assessment preparation: $30,000–$50,000
• Total: $250,000–$455,000 (median $380,000)

The automated cost structure:

• Integrated platform licensing: $24,000–$36,000
• Quarterly compliance review (outsourced, 2 days): $12,000–$16,000
• Annual assessment preparation (automated): $8,000–$12,000
• Human-dependent control management: $8,000–$12,000
• Total: $52,000–$76,000 (median $56,000)

The delta—$324,000 annually at median—is not a rounding error. It is the difference between compliance as a cost center and compliance as an operational capability. Over a three-year CMMC certification cycle, the cumulative savings exceed $970,000.

The defense industrial base does not have a security problem. It has an efficiency problem disguised as a security problem. The controls are well-defined, the implementations are well-understood, and the monitoring is well-established. What remains is the engineering discipline to automate what should never have been manual.

Getting Started

The path from $380,000 to $56,000 in annual compliance cost is not theoretical. It is a 16-week implementation project with well-defined phases, predictable costs, and measurable outcomes.

The question is not whether automation works—the technical evidence is overwhelming. The question is whether your organization will implement it systematically or continue paying the compliance tax that your competitors are already eliminating.