• Secureframe (defense contractor offering)

  Secureframe · Commercial · Compliance automation

  CMMC and CUI platform for the Defense Industrial Base. Secureframe Defense automates enclave, documentation and monitoring; the CMMC page names GCC High, Defense Navigator, FedRAMP Moderate MDM and a CyberAB RPO listing. Not an AI-model assurance tool.

  • Defense & national security
  • CMMC / NIST SP 800-171

• Vanta

  Vanta · Commercial · Compliance automation

  Compliance automation covering ISO 42001, NIST AI RMF and CMMC (mapped to NIST SP 800-171/172). The ISO 42001 product page also maps evidence to the EU AI Act. Not an AI-model assurance tool.

  • Cross-industry
  • Defense & national security
  • ISO/IEC 42001
  • NIST AI RMF
  • CMMC / NIST SP 800-171
  • EU AI Act

Official documents and working-group pages

These are the primary public pages we cite for CMMC / NIST SP 800-171. They are not directory listings and are not endorsements.

Sources last checked on 14 October 2026.

1. 32 CFR Part 170 - CMMC Program - eCFR
2. 48 CFR 252.204-7021 (DFARS) - eCFR
3. About CMMC - DoD CIO
4. Forging the Arsenal of Freedom: Department of War Suspends CMMC Phase II Requirements - Department of War
5. SP 800-171 Rev. 3 - NIST CSRC
6. 32 CFR 170.16 - CMMC Level 2 self-assessment and affirmation requirements - eCFR
7. 32 CFR 170.19 - CMMC scoping - eCFR
8. Implementing Suspension of CMMC Phase II (memo) - DoD CIO
9. FedRAMP Authorization and Equivalency - DoD CIO
10. NIST SP 800-171 Rev. 3 (PDF) - NIST
11. NIST SP 800-171A - Assessing Security Requirements for CUI - NIST

Related articles

• NIST SP 800-53 control overlays for securing AI systems (COSAiS): the five use cases and what is still draft
• CMMC and AI tools handling CUI
• NIST SP 800-218A SSDF for generative AI in defense software
• An AI assurance glossary for aerospace and defense
• An AI audit evidence checklist for regulated programs
• CMMC and AI with CUI - what the rules actually say
• CMMC Level 2 vs Level 3 for AI systems
• CMMC Program scoping for generative systems that handle CUI
• Data provenance and supply-chain security for ML models (SBOM/AIBOM)
• Supplier flow-down clauses for SI/AI in defense contracts
• FedRAMP and IL levels for AI SaaS in defense
• NIST AI 600-1 (Generative AI Profile) for defense contractors
• NIST AI 600-1 suggested actions for generative AI on a defense program
• Which NIST SP 800-171 controls matter most when AI tools handle CUI?

Questions

Why are there so few commercial tools tagged for CMMC / NIST SP 800-171?

We only tag a tool when the cited public page names this framework (or, for SAE G-34, EUROCAE WG-114, ED-324 or ARP6983). We do not infer support from a related aviation standard.

Where are the official CMMC / NIST SP 800-171 documents?

The official documents and working-group pages are listed on this page and on the CMMC / NIST SP 800-171 explainer.

← All tools · CMMC / NIST SP 800-171 explainer · Updates