Question · CMMC
What evidence does a C3PAO expect for AI under CMMC Level 2?
CMMC verifies that defense contractors meet existing safeguarding requirements for FCI (FAR 52.204-21) and CUI (NIST SP 800-171), with three levels and either self-assessment or third-party or government assessment.
01 / The answer
The short answer
A C3PAO treats an AI tool like any other asset in the assessment scope: it checks that the 110 NIST SP 800-171 Rev. 2 requirements are met wherever the tool processes, stores or transmits CUI. Expect to show the system security plan covering the AI service and its data flows, access control and authentication settings, audit logs (3.3), configuration baselines (3.4), integrity monitoring (3.14), and FedRAMP Moderate or equivalent evidence for any external cloud AI service. While Phase 2 is suspended, C3PAO certification is optional for most contracts.
02 / The rule
What CMMC requires
CMMC verifies that defense contractors meet existing safeguarding requirements for FCI (FAR 52.204-21) and CUI (NIST SP 800-171), with three levels and either self-assessment or third-party or government assessment. Phase 1 (self-assessments as a condition of award) took effect November 10, 2025; on July 13, 2026 the Department of War suspended Phase 2, which would have required C3PAO certification from November 10, 2026, pending a CMMC Reform Task Force review.
- 01Level 1: annually self-assess against the 15 FAR 52.204-21 safeguarding requirements and affirm in SPRS.
- 02Level 2: meet the 110 NIST SP 800-171 Rev. 2 requirements, by self-assessment or C3PAO assessment every three years.
- 03Level 3: hold Level 2 certification plus a government (DIBCAC) assessment of 24 NIST SP 800-172 requirements.
- 04Post results in SPRS and have a senior official affirm compliance annually.
03 / Records
Records to keep
- 01System security plan covering the assessment boundary
- 02SPRS score and annual affirmation records
- 03Plan of action and milestones with closeout dates
- 04CMMC certificate or self-assessment results and UID
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
Holland & Knight
RELATED
Related: CMMC: the full guide · Is CMMC required now, or is it still being phased in? · When does CMMC Level 2 certification become mandatory in contracts? · How do I show AI model behavior evidence for NIST SP 800-171 controls?