CMMC software is a system that touches your data, so the first question about any tool is not what it generates but what you are allowed to put into it. If you upload a drawing marked controlled unclassified information (CUI) to a compliance tool that is not approved to hold CUI, you have created a new place where CUI lives, pulled a vendor into your assessment scope, and probably violated the vendor's own terms on day one. This post gives you four questions to ask before the first upload, the rules behind each one, and our own answers for CMMC Map, CMMC compliance software, so you can see what a complete answer looks like.
The questions work for any vendor. This is explanatory content, not legal advice, and the clause that drives most of it is DFARS 252.204-7012.
Why a compliance tool is in scope at all
Buyers often assume a compliance tool sits outside the system they are assessing, like a notebook on the desk. The rules do not see it that way. Under 32 CFR 170.19, any asset that processes, stores or transmits CUI is a CUI Asset and is assessed against every Level 2 requirement. A cloud service provider that handles CUI must meet the FedRAMP requirements in DFARS 252.204-7012. There is no category for "the tool we used to write the SSP."
The DFARS clause is specific. Paragraph (b)(2)(ii)(D) says that if you use an external cloud service provider to store, process or transmit covered defense information, you must ensure the provider meets security requirements equivalent to the FedRAMP Moderate baseline and complies with the clause's incident reporting and preservation paragraphs. Very few compliance tools make that claim.
So the practical line is simple. Evidence about your controls (a screenshot of your MFA policy, a policy document, a network diagram without CUI on it) is fine to upload to an ordinary tool. The data those controls protect (the drawing, the RFQ with the part specification, the manifest marked CUI) is not, unless the vendor has told you in writing that its system is approved for it. If you are unsure which files carry CUI, start with how to tell whether you handle CUI.
The four questions
| Question | Why it matters | A good answer looks like |
|---|---|---|
| 1. What may I upload? | Decides whether the tool becomes a CUI Asset and whether 7012's cloud clause applies | A written statement of what is permitted and prohibited, in the terms of service, not only in a sales email |
| 2. Where is it stored and how is access scoped? | Location, encryption and tenant separation are what an assessor asks about any external system (3.1.20) | Country of hosting, encryption in transit and at rest, per-organization access control at the database level |
| 3. Who can see it? | Vendor staff access and shared links are how evidence leaks | Role-based access inside your workspace, no public URLs for files, a stated vendor access policy |
| 4. Where does the AI send my content? | An AI feature is a second processor, often a third company, with its own training and retention terms | The named provider, exactly what is sent and when, a no-training commitment, and a switch to turn it off |
1. What may I upload?
Ask for the sentence in the terms. Many vendors say "do not upload CUI" somewhere, and that sentence is doing real work: it tells you the tool is for describing and scoring your controls, not for storing the files your controls protect. If a vendor says you may upload CUI, ask the follow-up the clause demands: is the service FedRAMP Moderate authorized or equivalent, and will they give you the documentation an assessor would want to see? A shrug is a no.
Then look at what the tool asks for. A tool that asks you to upload "all your contracts so the AI can find CUI" is asking you to put your most sensitive material into a system you have not yet vetted.
2. Where is it stored and how is access scoped?
NIST SP 800-171 Rev 2 requirement 3.1.20 asks you to verify and control or limit connections to and use of external systems. A compliance tool is an external system. You should be able to write down, from the vendor's own published material, where the data is hosted, whether it is encrypted in transit and at rest, and how one customer's data is kept away from another's.
Tenant separation deserves a specific question. "Each customer has their own workspace" describes the interface. "Access is enforced per organization at the database level" describes a control. The second one is what you want to hear.
3. Who can see it?
Inside your workspace, the tool should distinguish an owner or administrator from a member, and evidence should be readable only by people in that workspace. Files should be served through authenticated, expiring links, never a public URL that works for anyone who has it. Ask separately about vendor staff: when can a support engineer open your workspace, and is that access logged? If a consultant will work in your workspace, they should be a named user with a role, not a shared login, and removable when the engagement ends.
4. Where does the AI send my content?
Almost every compliance tool now has an AI feature, and almost every AI feature sends your content to a model provider that is a different company from the vendor. That provider's terms, not the vendor's marketing, govern whether your content is used to train models and how long it is kept.
Get four specifics in writing: the name of the model provider, exactly which actions send data and what each one sends, a statement that your content is not used for training, and a switch that lets an administrator turn the AI off for the whole workspace. Then ask the question that exposes a thin answer: if we turn the AI off, what stops working? If the answer is "the documents," the documents are being written by a model rather than from your recorded answers, and you should know that before you sign anything. We cover the related problem of staff pasting CUI into consumer chatbots in Shadow AI and CUI.
Our answers, for comparison
Here is how CMMC Map answers the four questions, taken from our published AI and data page and privacy policy. We include it so you can judge what a complete answer looks like, not because we are the only acceptable one.
- What may you upload. Evidence about your controls. CMMC Map is not an approved CUI system, and our terms prohibit uploading CUI, classified material or export-controlled data. You agree to that at signup and it applies whether AI is on or off. The assessment itself needs no uploads at all: all 110 requirements are scored from your answers.
- Where it is stored. A managed PostgreSQL database and private file storage hosted in the United States. Data is encrypted in transit, access is scoped to your organization at the database level with row-level security, and files are served through signed, expiring links after a membership check.
- Who can see it. Members of your workspace, by role. Consultants get their own client workspaces and are named users. Uploaded evidence is readable only by workspace members, and you can delete any file at any time.
- Where the AI sends content. To the Anthropic Claude API through our managed connection, under commercial terms that do not permit training on submitted data. Nothing is sent unless a person clicks a control labeled AI. An uploaded file is stored and nothing else until someone clicks Analyze on that specific file, and then only the extracted text of that one file goes out. A workspace owner can switch AI off for everyone in Settings, and the switch is enforced on our servers on every request. Your SSP, POA&M and 14 policies are built from templates and your recorded answers, with no model call anywhere in that path, so they keep working with AI off.
- Connectors. The Microsoft 365 and Google Workspace connectors are read-only and read configuration and metadata: accounts, MFA enforcement, device and audit settings, sharing state and labels. They never read the contents of documents or mail.
A fair test of any vendor: ask for the page where these answers live. If the answers exist only in a conversation with a salesperson, they are not something you can hand to an assessor or your prime.
The mistakes we see most often
- Uploading the evidence and the CUI together. A screenshot of your file share permissions is evidence. The same screenshot with a drawing visible in the preview pane is CUI. Crop before you upload.
- Treating a vendor's "secure" claim as a FedRAMP claim. Encryption and SOC 2 are good. They are not FedRAMP Moderate equivalency, which is the standard 7012 names for cloud providers that hold covered defense information.
- Forgetting the tool in the asset inventory. If you upload evidence to it, it is an external system your SSP should mention under 3.1.20, with what it holds and why that is acceptable.
- Letting the AI run before anyone read the data page. Decide the AI question as a company, record the decision, and set the switch to match. If your policy requires you to list the AI tools that process company data, a compliance tool with AI on belongs on that list.
How this fits the rest of your scope
Your compliance tool is one of several external services an assessor will ask about. Your email and file platform decides where CUI actually lives, and your managed service provider may be a security protection asset or a CUI asset depending on what it touches; see does my MSP need to be CMMC compliant. The compliance tool is the easiest of the three to keep out of CUI scope, because you control what goes into it. If you are still choosing software, pair these questions with the output test in the one-control vendor demo.
What to do this week
- Write down which of your files are CUI and which are evidence about controls. One list, two columns.
- For any compliance tool you already use, find the published answers to the four questions. If one is missing, email the vendor and keep the reply.
- Check whether anyone has already uploaded CUI to the tool. If so, delete it, note the date, and decide whether it counts as an incident under your own plan.
- Decide as a company whether the tool's AI features stay on, and set the switch to match the decision.
- Add the tool to your external systems list in the SSP, with one sentence on what it holds.
Describe your controls without uploading the data they protect
The free CMMC Map assessment scores all 110 NIST SP 800-171 requirements from your answers alone. Nothing is uploaded unless you choose to attach evidence later.
Start free in CMMC Map