Agentic trust and compliance automation platform for continuous evidence collection, control monitoring, policies, and security questionnaire responses.
CMMC (US Department of War / DoD)
The Cybersecurity Maturity Model Certification program verifies that defense contractors and subcontractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). As of 18 Oct 2026 the program is paused in Phase 1 (self-assessments).
Tag means the vendor's own pages document CMMC program support (framework library, requirement mapping, evidence, POA&M or affirmation workflows). It is not a CMMC certification of the tool or of your organisation.
Key facts (official sources)
Last checked 2026-10-18. Every sentence links to an official source in the dataset.
- On 13 Jul 2026 the Department of War (DoW) suspended CMMC Phase II requirements, which had been scheduled for 10 Nov 2026, and set up a CMMC reform task force. Phase I self-assessment requirements remain in place. Source
- Phase 1 began 10 Nov 2025; the program is paused in Phase 1. During this period DoW enforces NIST SP 800-171 Rev 2 compliance through self-assessments and select government-led assessments. Source
- CMMC protects FCI (FAR 4.1901) and CUI (32 CFR 2002.4(h)); DoW contractors and subcontractors handling FCI/CUI must achieve a specified CMMC level as a condition of contract award. Source
- Level 1 (Self): annual self-assessment and affirmation against the 15 requirements of FAR 52.204-21; results in SPRS; POA&Ms not permitted. Source
- Level 2 (Self): self-assessment every 3 years with annual affirmation against the 110 requirements of NIST SP 800-171 Rev 2 (DFARS 252.204-7012); results in SPRS; POA&Ms permitted per 32 CFR 170.21(a)(2) and must be closed within 180 days. Source
- The pause does not remove the obligation to protect information under DFARS 252.204-7012. Source
Official sources: dodcio.defense.gov/CMMC/About/ · dodcio.defense.gov/CMMC/
Related US government programs: FedRAMP · GovRAMP · TX-RAMP · US public-sector and FedRAMP comparison
Use-case comparisons with 2+ listings tagged CMMC: US public-sector and FedRAMP AI agents
Agents tagged for CMMC
10 listings. Tags indicate relevance for evaluation — not a certification that the vendor “implements” the law. CMMC tags show vendor-documented program support, not a CMMC certification of the product or of your organisation. If a vendor states it achieved CMMC for its own organisation, that is the vendor’s own posture, not a product feature.
Compliance and trust management platform with AI-assisted evidence collection, continuous control monitoring, and multi-framework programs.
Compliance automation platform with Comply AI features for policies, remediation, risk, questionnaires and TPRM, plus Trust Center and CMMC/Defense packages.
Sovereign GRC AI engine that maps controls, finds gaps, drafts assessment responses and creates risks, issues and tasks inside the 6clicks Hub & Spoke platform.
Cyber GRC platform whose AI agents build and run end-to-end compliance workflows from natural-language prompts, covering evidence collection, control testing, gap analysis and continuous control monitoring.
AI GRC platform whose agents collect and map evidence, test controls continuously, assess policies against frameworks, run natural-language 'TI Playbooks' and answer security questionnaires.
Continuous controls monitoring platform whose RegML AI agents monitor controls, collect evidence, draft control documentation and trigger remediation for FedRAMP, CMMC and NIST programmes; RegScale CCM is FedRAMP High authorized.
CMMC- and NIST 800-171-focused GRC platform whose AI agents auto-map evidence to assessment objectives (Evan) and run automated control gap assessments with remediation steps (Alfie); FedRAMP 20x Low authorized.
AI-native GRC platform whose agents monitor controls, collect evidence, map controls, flag gaps, draft security-questionnaire responses and remediate gaps across 40+ frameworks, with a dedicated compliance expert per customer.
Enterprise GRC platform with a fleet of task-specific AI agents for evidence review, control advice and remediation, policy drafting, risk treatment planning, vendor questionnaire review and risk scoring, and customer security questionnaires.
Vendor-claimed CMMC support (not tagged)
These listings mention CMMC on a vendor page as something the product helps customers “meet”, without documenting CMMC program support (framework library, requirement mapping, evidence, POA&M or affirmation workflows) at the level used for the tag. Clearly labelled as claimed-only.
- ReliaQuest GreyMatter Agentic Teammates (GreyMatter for Government) — Agentic AI security operations platform whose six persona-based Agentic Teammates investigate and triage alerts and execute approved containment actions; GreyMatter for Government is FedRAMP Authorized (Moderate).
Best CMMC AI agents (mechanical listing order, not a ranking) · All frameworks