Any user that accesses CUI on system media should be authorized and have a lawful business purpose. While assessing a contractor’s implementation of…

The most critical vulnerability identified is a terminated employee's continued remote access to Controlled Unclassified Information (CUI). This is a direct and severe failure to implement MP.L2-3.8.2, which requires controlling access to media containing CUI. An individual whose employment has been terminated is, by definition, no longer authorized. This situation represents an active, ongoing security breach. Therefore, the highest priority is to establish and enforce a process that ensures access is immediately revoked upon an employee's termination. This action directly mitigates the most significant risk and addresses the root cause of the access control failure.

A. Training is a corrective action for the physical CUI handling issue but does not resolve the critical systemic failure of not revoking a terminated employee's access.

C. The scenario indicates that "CUI access logs" were examined, implying a logging and monitoring system already exists; the failure was in the process, not the technology.

D. The problem is a breakdown in the off-boarding process, not a deficiency in the access control technology itself. New technology will not fix a flawed human process.

1. NIST SP 800-171 Rev. 2, Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations:

Section 3.8.2 (Corresponds to MP.L2-3.8.2): "Control access to media containing CUI." The discussion emphasizes restricting access to authorized users. A terminated employee is not an authorized user.

Section 3.1.2 (Corresponds to AC.L2-3.1.2): "Disable user accounts after [Assignment: organization-defined time period]." The discussion for this control explicitly states, "User accounts are disabled or removed when... employment is terminated... Timely disabling of user accounts is critical to prevent opportunities for malicious and non-malicious unauthorized activity." This directly supports that revoking access upon termination is a critical, high-priority action.

2. CMMC Model Version 2.0, CMMC Practices:

Practice MP.L2-3.8.2: "Control access to media containing CUI." The description clarifies this involves limiting access to authorized individuals. The scenario presents a clear case of an unauthorized individual (the terminated employee) retaining access, making the implementation of this practice deficient. The highest priority is to correct the process that allowed this deficiency.

3. CMMC Level 2 Assessment Guide, NIST SP 800-171 Rev 2 Assessment Objectives:

For Control 3.1.2: Assessment Objective [a] states, "A process to manage user accounts is defined and implemented." Objective [d] is "User accounts are disabled within an organization-defined time period." The failure to disable the terminated employee's account is a direct failure of these objectives, which are foundational to controlling access as required by MP.L2-3.8.2.