Using a derived key for CMAC
I see no reason why that would not be secure.  If you want to play it safe, though, you could always go with a standardized key derivation function, such as HKDF (RFC 5869) or one of the other KDFs listed in this draft standard.  (The draft itself seems to be expired, but it's the most convenient list of standardized key derivation functions I could find.)