--- title: "CMMC Remote Access: Setting Up a VPN for a Defense Contractor at Level 2" description: "CMMC remote access for Level 2 defense contractors: the NIST 800-171 controls a VPN must meet, FIPS crypto, MFA, and a self-hosted setup that holds up." image: https://blog.openvpn.net/hubfs/blog-headers/cmmc-remote-access-header.png --- - [Blog](https://blog.openvpn.net) - [Cybersecurity](https://blog.openvpn.net/tag/cybersecurity) # CMMC Remote Access: Setting Up a VPN for a Defense Contractor at Level 2 Nov 6, 2026 • 8 min read ![Illustration of a walled CUI enclave with server racks inside, reached by a laptop and phone through a single verified checkpoint](https://blog.openvpn.net/hubfs/blog-headers/cmmc-remote-access-header.png) Share - - - - By Adam Bullock ## DoD has paused required third-party assessments, but CUI still has to be protected under NIST SP 800-171, and Level 2 self-assessment scores are still required. This guide covers the remote access controls that apply and how to meet them with a self-hosted VPN running in FIPS mode. If your company handles Controlled Unclassified Information (CUI) for the Department of Defense, remote access is one of the first places an assessor looks. Engineers working from home, program managers on the road, and IT staff administering servers all reach CUI over networks you don't own. **CMMC remote access comes down to a short list of NIST SP 800-171 requirements, and a properly configured, self-hosted VPN covers most of them.** This guide explains where CMMC stands right now, which controls apply to remote access, what makes a CMMC compliant VPN, and how to set one up for a Level 2 environment with [OpenVPN Access Server](https://openvpn.net/access-server/). ## Where CMMC stands in November 2026 The CMMC program rule took effect in the DFARS on November 10, 2025, starting Phase 1. Since then, contracts can require a CMMC Level 1 or Level 2 self-assessment, with scores posted in SPRS. Phase 2, which would have made third-party (C3PAO) Level 2 assessments the default on November 10, 2026, was **suspended by DoD in July 2026** while a CMMC Reform Task Force reviews cost and assessor capacity. As of this writing, DoD has not announced a date for resuming it. The pause doesn't change the security work itself: - DFARS 252.204-7012 still requires you to protect CUI using the 110 requirements in NIST SP 800-171 Rev. 2. - Level 2 self-assessments and SPRS scores are still required where contracts call for them, and an affirming official still attests to them. - Primes are setting their own supplier timelines and continue to ask subcontractors for evidence. - The DOJ Civil Cyber-Fraud Initiative continues to pursue False Claims Act cases over inaccurate cybersecurity representations. In other words, a Level 2 self-assessment now carries more weight, not less. If your SPRS score says remote access is controlled, your environment has to back that up. ## The NIST 800-171 controls that govern remote access CMMC Level 2 maps one-to-one to NIST SP 800-171 Rev. 2. These are the requirements a VPN directly touches. The CMMC practice IDs are in parentheses. ### Remote access controls - **3.1.12 (AC.L2-3.1.12):** Monitor and control remote access sessions. - **3.1.13 (AC.L2-3.1.13):** Employ cryptographic mechanisms to protect the confidentiality of remote access sessions. - **3.1.14 (AC.L2-3.1.14):** Route remote access via managed access control points. - **3.1.15 (AC.L2-3.1.15):** Authorize remote execution of privileged commands and remote access to security-relevant information. ### Identity and authentication - **3.5.3 (IA.L2-3.5.3):** Use multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts. Every remote user needs MFA, not just admins. - **3.1.1 and 3.1.2:** Limit system access to authorized users and limit them to the transactions and functions they're permitted to execute. ### Cryptography and boundaries - **3.13.11 (SC.L2-3.13.11):** Employ FIPS-validated cryptography when used to protect the confidentiality of CUI. This is one of the most frequently failed requirements, and it applies directly to your VPN. - **3.13.1 and 3.13.5:** Monitor and protect communications at system boundaries, and use subnetworks to separate publicly accessible components from internal networks. - **3.13.7:** Prevent remote devices from split tunneling to resources outside the system while connected. - **3.1.10 and 3.1.11:** Use session lock and terminate user sessions after a defined condition, such as inactivity. ### Audit and accountability - **3.3.1 and 3.3.2:** Create and retain audit records, and make sure actions can be traced to individual users. ## What makes a CMMC compliant VPN No VPN is "CMMC certified." Organizations are assessed, not products. A VPN supports a passing assessment when it does these things, and you can show evidence that it does: 1. **Uses FIPS-validated cryptography** for the tunnel, running on a FIPS-validated cryptographic module. 2. **Enforces MFA** for every user, tied to an identity source you manage. 3. **Acts as a managed access control point,** meaning all remote access goes through it rather than around it. 4. **Limits each user to specific systems** instead of placing them on a flat network. 5. **Prevents split tunneling** for users who reach CUI. 6. **Logs every session** with user identity, source, and duration, and sends those logs somewhere they're retained and reviewed. 7. **Keeps CUI inside your authorization boundary.** If a cloud service stores, processes, or transmits CUI, DFARS 7012 expects it to meet FedRAMP Moderate or equivalent requirements, which narrows your choices quickly. That last point is why many defense contractors prefer a self-hosted VPN. When you run the VPN server inside your own CUI enclave, on-premises or in a government cloud tenant you control, the remote access path stays inside the boundary you are documenting. You don't have to evaluate a third-party service's FedRAMP status for the VPN itself. ## Setting up Access Server for a CMMC Level 2 environment ### 1. Deploy in FIPS mode Access Server doesn't ship its own crypto library. It relies on the operating system's NIST-validated OpenSSL module. OpenVPN has tested [FIPS mode](https://openvpn.net/as-docs/v3/fips-compliance.html) on Red Hat Enterprise Linux and on Ubuntu with Ubuntu Pro FIPS. Enable FIPS mode on the OS first, then install Access Server. In FIPS mode, only FIPS-approved ciphers are allowed, such as AES-256-GCM, and non-approved options such as ChaCha20-Poly1305 are unavailable. Record the OS, its cryptographic module, and the module's CMVP certificate in your System Security Plan (SSP). ### 2. Place it at the edge of the CUI enclave Many small and mid-sized contractors reduce their assessment scope by building a CUI enclave: a segmented set of systems that are the only places CUI lives. Put Access Server at the boundary of that enclave, in its own subnet, so it becomes the single managed access control point required by 3.1.14. Users who never touch CUI can stay outside the enclave entirely. ### 3. Connect identity and enforce MFA Authenticate users against your directory with SAML, LDAP, or RADIUS, and enforce TOTP-based MFA in Access Server or through your identity provider. Make sure the MFA solution you rely on is in scope for your assessment, and that no account, including service and break-glass accounts, can bypass it without a documented exception. ### 4. Write least-privilege access rules Use groups to scope access. For example, engineering reaches the PLM and file servers that hold technical data, finance reaches the ERP system, and IT administrators reach management interfaces. Restrict privileged access (3.1.15) to a separate admin group with its own rules, and ideally its own accounts. ### 5. Disable split tunneling for CUI users Configure full-tunnel routing for groups that reach CUI so all traffic from the endpoint passes through the enclave while connected. This addresses 3.13.7 and keeps endpoints from bridging the enclave to the open internet. ### 6. Set session timeouts Configure idle timeouts and maximum session lengths that match the values in your access control policy for 3.1.10 and 3.1.11. ### 7. Centralize and keep the logs Send Access Server logs to your SIEM or syslog collector with remote logging. The log reports show user identity, source IP, and session duration, which is exactly what you need to trace remote activity to an individual under 3.3.2. ### 8. Keep it current Patch the OS and Access Server on a defined schedule. Vulnerable VPN appliances have been one of the most exploited initial access vectors of the past several years, and assessors will check your flaw remediation process (3.14.1). ## Evidence to collect for your SSP and assessment Whether you're doing a self-assessment now or preparing for a C3PAO later, gather these artifacts: - A network diagram showing the CUI enclave, the VPN as the remote access point, and the subnets it can reach. - The OS FIPS mode configuration and the CMVP certificate number of the cryptographic module. - Screenshots or exports of MFA enforcement settings and identity provider integration. - Group and access rule exports showing least-privilege scoping. - Routing configuration showing split tunneling is disabled for CUI users. - Timeout settings that match your written policy. - Sample log records and evidence of regular log review. - Patch records for the VPN server. Keep this evidence current. Under DFARS 252.204-7021, CMMC status has to be maintained for the life of the contract, with annual affirmations. ## Frequently asked questions ### What is a CMMC compliant VPN? A VPN that helps you meet the NIST SP 800-171 requirements for remote access: FIPS-validated encryption, MFA, managed access control points, least privilege, no split tunneling, session controls, and audit logging. CMMC assesses your organization, not the product, so configuration and evidence matter as much as features. ### Does CMMC Level 2 require FIPS-validated encryption for remote access? Yes. Requirement 3.13.11 calls for FIPS-validated cryptography when cryptography protects the confidentiality of CUI, and 3.1.13 requires cryptography for remote access sessions. Encryption that isn't FIPS-validated is a common reason contractors lose points. ### Is CMMC still happening if Phase 2 is suspended? Yes. Phase 1 self-assessments, SPRS scores, DFARS 7012, and NIST SP 800-171 remain in force. Only the move to required third-party assessments is paused. ### Can a cloud VPN service be used for CUI? If a cloud service stores, processes, or transmits CUI, DFARS 7012 expects FedRAMP Moderate or equivalent. Running a self-hosted VPN inside your own enclave avoids putting a third-party service in that path. ## Build CMMC-ready remote access you control OpenVPN Access Server runs inside your CUI enclave, on RHEL or Ubuntu Pro in FIPS mode, with MFA, least-privilege access rules, full tunneling, and centralized logs. [Try Access Server Free](https://openvpn.net/access-server/) ![Adam Bullock](https://blog.openvpn.net/hs-fs/hubfs/adamheadshot.jpg?width=300&height=300&name=adamheadshot.jpg) [Adam Bullock](https://blog.openvpn.net/author/adam-bullock) Adam has loved tech since the days of the dial-up modem. Read his perspective on the OpenVPN blog. ## Related posts from OpenVPN ### Subscribe for Blog Updates ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Adam Bullock", "url" : "https://blog.openvpn.net/author/adam-bullock" }, "dateModified" : "2026-11-06T00:36:11.082Z", "datePublished" : "2026-11-06T00:36:11.000Z", "headline" : "CMMC Remote Access: Setting Up a VPN for a Defense Contractor at Level 2", "image" : [ "https://blog.openvpn.net/hubfs/blog-headers/cmmc-remote-access-header.png" ], "mainEntityOfPage" : { "@id" : "https://blog.openvpn.net/cmmc-remote-access", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://blog.openvpn.net/hubfs/Dark=True%20Medium.png" }, "name" : "OpenVPN" } } ```