AC - Access Control (Level 2)

The AC-Access Control Level 2 domain in CMMC 2.0 requires organizations to establish and maintain documented access-control policies, enforce role-based and least-privilege permissions, and implement multi-factor authentication for privileged accounts, while regularly reviewing and revoking unnecessary access.