Defense & Federal Compliance (CMMC · FedRAMP · 800-171)
Gets you through a DoD or federal assessment.
Overview
A distinct market with its own rules. Defence contractors handling CUI must implement NIST SP 800-171, self-attest a SPRS score, and — as CMMC phases in through 2026 — pass a C3PAO assessment for many CUI contracts. Cloud providers selling to federal agencies need FedRAMP authorization against NIST 800-53, with monthly continuous monitoring and hard POA&M windows. Generic compliance automation does not survive contact with this: assessors expect specific artifacts, specific formats, and increasingly OSCAL. The stack is usually a documentation platform, an enclave or environment, and a consultancy.
Situational but binding: if you hold CUI or sell to federal agencies, nothing else in this domain substitutes.
Advantages
- Purpose-built artifacts — SSP, SPRS score, POA&M, CRM — in the exact forms assessors accept
- OSCAL-native tooling is becoming the expectation rather than a differentiator
- Enclave products shrink the assessment boundary dramatically, which is the cheapest control there is
- Continuous monitoring automation is mandatory post-ATO, not optional
- A defensible SPRS score is a contract prerequisite, so the spend has a direct revenue link
Trade-offs
- Expensive and specialised; assessment fees sit on top of tooling
- Rigid formats punish approximations that would pass elsewhere
- Scope creep into the assessment boundary is the classic cost explosion
- Vendor claims of "CMMC compliant" are frequently overstated — only a C3PAO certifies
- Requirements have moved repeatedly; tooling and consultants have had to move with them
Open-source option
OpenSCAP and SCAP content cover host-level 800-171 and STIG checking well, and OSCAL plus compliance-trestle can author the package artifacts. What no open-source project provides is the assessment workflow, the enclave, or the assessor relationship — and the parts you can do free are the parts a C3PAO spends the least time on.
Vendors & tools in this area
CMMC L2/L3, 800-171, SPRS and STIG tracking with the official exports.
Visit site →