CMMC and AI Tools: What Defense Contractors Need to Know

CMMC does not have a separate rulebook for AI. It applies to AI tools the same way it applies to any system: if an AI tool stores, processes or transmits Federal Contract Information or Controlled Unclassified Information, it sits inside your assessment boundary and must meet the controls for your CMMC level. The practical work is finding every place AI touches that data and choosing deployments that keep it under control.

This is general guidance, not legal advice. Requirements and phase-in dates change, so confirm current status with the DoD CIO's CMMC pages and your contracting officer.

CMMC in brief

The Cybersecurity Maturity Model Certification program checks that contractors in the defense industrial base protect sensitive unclassified information. The program rule is codified at 32 CFR Part 170, and DoD began phasing CMMC requirements into contracts in late 2025. There are three levels:

• Level 1 covers Federal Contract Information and the basic safeguarding requirements of FAR 52.204-21, with an annual self-assessment.
• Level 2 covers Controlled Unclassified Information and the 110 security requirements of NIST SP 800-171, assessed by an authorized third-party assessor or, for some contracts, by self-assessment.
• Level 3 adds selected enhanced requirements from NIST SP 800-172 for the most sensitive programs, assessed by the government.

Separately, DFARS 252.204-7012 already requires adequate security for covered defense information and incident reporting, and it carries rules about cloud services that matter directly for AI.

Where AI tools touch FCI and CUI

Most exposure is not in the model itself but in the data flowing around it. Map each of these:

• Prompts. An engineer pastes a drawing note, a contract clause or a test result into a chat assistant. That text is now in the vendor's system.
• Files and connectors. Assistants that read your drive, email or repositories inherit everything those sources contain.
• Logs and history. Conversation history, telemetry and abuse-monitoring logs may be retained outside your boundary.
• Fine-tuning and retrieval data. Documents used to customize a model, and the vector index built from them, are CUI if the source documents are.
• Outputs. Generated text derived from CUI should be handled as CUI.
• Agents with credentials. An agent that can open tickets, run code or move files is a privileged user and needs the same access control, audit and least-privilege treatment.

Deployment options and how they map

• Public consumer AI services. Generally unsuitable for CUI. Block or restrict them by policy and technical control, and train staff on why.
• Enterprise cloud AI services. If CUI will be processed, DFARS 7012 expects the cloud service to meet security requirements equivalent to the FedRAMP Moderate baseline. Check the specific service and region, not just the vendor's brand, and get the authorization evidence for your files.
• On-premises or in your own cloud enclave. Open-weight models served inside your existing CMMC boundary. Control inheritance is simpler because the system lives where your other controls already apply.
• Air-gapped. For the most sensitive programs, models and data run with no outside connectivity, and updates cross under a documented process.

Controls that do most of the work

NIST SP 800-171 is organized in requirement families. For AI systems, a handful carry most of the weight:

• Access control. Who can use the tool, which data sources it can reach, and what agents may do. Least privilege applies to software agents as much as to people.
• Audit and accountability. Log prompts, retrieved sources, outputs and actions so you can reconstruct what happened.
• Configuration management. Pin model versions and settings, and treat prompt templates and tool permissions as configuration under change control.
• System and communications protection. Keep CUI flows inside approved boundaries and encrypt them in transit and at rest.
• Risk assessment and system integrity. Include AI-specific threats such as prompt injection and data leakage through outputs.

Document each AI system in your System Security Plan, with a data flow diagram that shows exactly where CUI goes.

A vendor checklist

1. Where are prompts, files, logs and outputs stored, in which region, and for how long?
2. Is any customer data used to train or improve the vendor's models, and can that be contractually excluded?
3. What FedRAMP authorization does the specific service hold, at what baseline?
4. Can the system run inside our boundary: on-premises, in our cloud, or air-gapped?
5. What audit logs can we export, and can they feed our SIEM?
6. Can we provide a software bill of materials and evidence of secure development practice for the components we deploy?
7. How are agent permissions scoped, and what requires human approval?

A practical starting plan

If your organization has not yet looked at AI through a CMMC lens, start small. In the first weeks, inventory every AI tool in use, sanctioned or not, by asking teams and checking network and expense records. Classify each by whether it could touch FCI or CUI. Block or restrict the tools that cannot meet your requirements, and publish a short acceptable-use rule that tells staff what they may paste where. Then pick one approved path for AI on CUI, whether an authorized enterprise service or an on-premises deployment, document it in your System Security Plan, and train people on it. Giving staff a compliant option is the most effective way to stop them using a noncompliant one.

Where an SDVOSB partner fits

The AI Cowboys is a Service-Disabled Veteran-Owned Small Business in San Antonio. We deploy AI on-premises, air-gapped or in the customer's own cloud, follow secure development practice under Executive Order 14028 with an SBOM, and align our work to NIST, CMMC and FedRAMP. We can also independently test an AI tool you are considering against a written protocol.

Read more on government and defense AI, edge, on-prem and air-gapped AI, the air-gapped LLM deployment guide, cybersecurity and AI trust, the autonomous SOC and synthetic data for federal AI programs.