CMMC · NIST SP 800-171 · DFARS 7012 · CUI · On-Prem
CMMC software that turns NIST SP 800-171 controls into system evidence, not a Word SSP.
CMMC 2.0 Level 2 assessment prep collapses when access control, audit, configuration management, incident response and system integrity are enforced by the platform — not documented in a System Security Plan nobody re-reads.
Access Control (AC) family
Audit & Accountability (AU)
Configuration Management (CM)
Incident Response (IR)
Full product detailCommon problems, what's included, why teams choose it, and where commercial meets regulated.
Common problems
SSP and POA&M live in Word and Excel, not the systems being described
Audit log evidence is stitched together from six tools at assessment time
CUI-tagged objects have no system enforcement — just a policy PDF
Access reviews are a spreadsheet dance, not an automated report
Incident response tabletops don't produce evidence a C3PAO will accept
Configuration baselines drift and nobody notices until assessment
CMMC controls that are live, not documented.
Access Control (AC) family
AC-1 through AC-22 evidenced live.
Audit & Accountability (AU)
Signed, hash-chained audit trail on every controlled object. Non-repudiation, event review reports, and audit storage capacity monitoring — all AU-family practices mapped.
Configuration Management (CM)
Baseline configurations, change control workflow with impact analysis, least-functionality enforcement and software-inventory tracking — CM-1 through CM-11 native.
Incident Response (IR)
Incident workflow with 72-hour reporting clock, evidence preservation, tabletop exercise records and post-incident review — IR-1 through IR-6 evidenced end-to-end.
System & Information Integrity (SI)
Flaw remediation tracking, malicious code protection integration, security alerts monitoring and information handling — SI-family practices produce live evidence.
CUI Object Tagging
Every controlled object carries a CUI category tag (Basic, Specified, or none).
What changes when CMMC is a system, not an SSP.
- C3PAO assessment prep drops from 6+ months to weeks
- SSP becomes a report extract, not a hand-maintained Word file
- POA&M items close when the control does — not when someone updates a spreadsheet
- Prime contractor supplier questionnaires answer themselves
- Configuration drift surfaces at commit, not at assessment
- Access reviews run on schedule and produce their own evidence
Every CMMC assessor's checklist.
CMMC 2.0 Level 2
All 110 NIST SP 800-171 rev 2 practices across 14 families mapped to platform controls with live evidence. Level 1 (15 requirements) supported by the same controls.
NIST SP 800-171 Rev 2
AC, AT, AU, CM, IA, IR, MA, MP, PS, PE, RA, CA, SC, SI families — evidenced through platform behaviour, not through documentation.
DFARS 252.204-7012
Adequate security expectations met natively; 72-hour cyber incident reporting workflow, media protection, encryption at rest and in transit.
NIST SP 800-172 (Level 3 aware)
Enhanced-security practices for APT-resistant environments — advanced audit correlation, threat hunting hooks, deception controls.
21 CFR Part 11 (dual-use suppliers)
Defence-medical suppliers get bound e-signatures and hash-chained records on top of the CMMC control layer.
CMMC software, answered.
What is CMMC software?
CMMC software is a platform that enforces and evidences the 110 NIST SP 800-171 rev 2 practices required for CMMC 2.0 Level 2 as live system behaviour — access control, audit trails, configuration baselines, incident response, media protection, system integrity — rather than documenting them in a System Security Plan (SSP) that has to be manually re-verified at every assessment.
Does V5 cover all 110 practices?
Yes. Every NIST SP 800-171 rev 2 practice has a mapped V5 control with live evidence generation. The platform is not an assessor. DoD suspended CMMC Phase II (the phase that would have added C3PAO certification requirements) on July 13, 2026 while Phase I self-assessment requirements remain in place — check which CMMC level and assessment your contract requires. V5 produces the evidence either way.
Cloud or on-premises?
Both. V5 Ultimate Cloud runs in FedRAMP-adjacent posture for most Level 2 scenarios. V5 Ultimate On-Premises is containerised, air-gap capable and CUI-boundary friendly for cases where CUI cannot leave your facility.
How does CUI tagging work?
Every object (drawing, routing, batch record, measurement data, procedure) carries an explicit CUI category tag.
Is V5 also DFARS 7012 compliant?
V5 supports the DFARS 252.204-7012 adequate-security expectations natively — the 110 practices, 72-hour incident reporting workflow, cyber incident information preservation and self-assessment evidence. Full DFARS compliance always requires a customer-owned SSP; V5 provides the platform controls and evidence that populate it.
Capabilities vary by plan and setup. Confirm specifics with our team before relying on them.
Turn CMMC assessment prep into a report extract — not another year of Word-file archaeology.
Free trial (cloud) or on-prem evaluation.