CMMC & AI Security Blog
Expert guides on CMMC Level 2, protecting CUI from AI tools, HIPAA compliance, and everything a defense contractor's IT security manager needs to know in 2026.
Featured
Microsoft's answer to CMMC-safe AI is Copilot inside GCC High — 'free' with your E5/G5 licensing, after a $149K–$200K/yr tenant migration. For contractors under 200 employees, that math rarely closes. Here is the honest cost comparison, including when GCC High genuinely wins.
All Articles
No bar has banned generative AI — but every major opinion holds lawyers to their existing duties, and opposing counsel is already probing whether AI use waived privilege. What the 2024–2025 opinions require, where the waiver risk sits, and the architecture that ends the argument.
Someone on your team pasted contract data into ChatGPT. You may be inside DFARS 7012's 72-hour reporting window. This playbook walks the first hour, day, and week — containment, scoping, DIBNet reporting, evidence preservation, and the corrective action assessors respect.
Which of the 110 NIST 800-171 Rev 2 requirements does AI prompt monitoring actually satisfy? This is the full control-by-control mapping — 3.1.3 flow control, 3.13.1 boundary protection, 3.3.1 audit records, 3.6.x incident handling — with the evidence a C3PAO assessor accepts for each.
Every contractor needs a written AI use policy before a C3PAO assessment — and most online templates are generic IT policies with 'AI' pasted in. This one is built for CUI environments: scope, prohibitions, enforcement, logging, and incident response, each mapped to its NIST 800-171 requirement.
AI usage is the newest line of questioning in CMMC Level 2 assessments: unmonitored ChatGPT prompts are an unmonitored egress path, and assessors know it. The 12 questions to expect, the evidence that answers each, and how to walk in with answers instead of a deficiency.
Your employees are using AI. Some of them are pasting contract details, technical specs, and project names into ChatGPT. Every one of those sessions is a potential CMMC violation — and your auditor will ask about it.
If you're evaluating DLP solutions for CMMC compliance, you need to ask one question first: does the vendor's product send your data to their cloud? If yes, it's non-compliant for CUI. Here's how the major options stack up.
You can't just ban ChatGPT. Employees will use it anyway — on personal devices, at home, through browser extensions. The only solution that actually works is a local AI proxy that catches CUI before it leaves your network.