---
title: "Why ADCS Cannot Prove Device Trust Under CMMC Level 2"
url: https://daily.dev/posts/why-adcs-cannot-prove-device-trust-under-cmmc-level-2-fzf3ehrps
source_url: https://smallstep.com/blog/adcs-cmmc-level-2-device-trust
type: article
source: "Smallstep"
published: 2026-04-06T17:02:22.011Z
updated: 2026-04-06T17:02:53.233Z
tags: ["pki"]
reading_time: 14
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Why ADCS Cannot Prove Device Trust Under CMMC Level 2

**[Smallstep](https://daily.dev/sources/smallstep)** · 14 min read · 0 upvotes · 0 comments

## Summary

ADCS (Active Directory Certificate Services) is commonly assumed to satisfy CMMC Level 2 device authentication requirements, but it fundamentally cannot. CMMC Level 2 (NIST SP 800-171 control 3.5.2) demands verifiable evidence that device trust decisions were enforced at access time — not just that certificates were issued. Standard ADCS/SCEP deployments fail on four fronts: no proof of trust origin, no lifecycle evidence between issuance and expiration, credential portability risks from non-hardware-bound keys, and MDM compliance state that is decoupled from actual access events. Template hardening and TPM configuration improve hygiene but don't create the trust decision layer CMMC requires. A compliant architecture needs four layers: hardware attestation at issuance, hardware-bound identity, policy enforcement at access time, and auditable evidence generated as a byproduct of operation. A migration path is outlined moving from ADCS to a hardware-attested system (using ACME Device Attestation and mTLS), emphasizing that evidence history must be built before assessment — it cannot be retroactively created.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://smallstep.com/blog/adcs-cmmc-level-2-device-trust>

## Similar posts on daily.dev

- [Your organization cannot meet the new NSA Zero Trust Implementation Guidelines. Here's how to do it.](https://daily.dev/posts/your-organization-cannot-meet-the-new-nsa-zero-trust-implementation-guidelines-here-s-how-to-do-it--n7swcrljn) · Smallstep · 0 upvotes · 0 comments
- [You’re only as secure as your last evaluation](https://daily.dev/posts/you-re-only-as-secure-as-your-last-evaluation-buzedayg0) · CSO Online · 0 upvotes · 0 comments
- [Device Identity and NCSC Zero Trust Guidance \| Smallstep](https://daily.dev/posts/device-identity-and-ncsc-zero-trust-guidance-smallstep-6qv5zbkwt) · Smallstep · 0 upvotes · 0 comments

---

Tags: [#pki](https://daily.dev/tags/pki)

[View this post on daily.dev](https://daily.dev/posts/why-adcs-cannot-prove-device-trust-under-cmmc-level-2-fzf3ehrps)