CMMC Compliance Management Software: Proving a Control Actually Operated, Not That Someone Wrote It Down

Why a defense supplier fails on evidence, not on controls

A 240 person precision machining company holds subcontracts through two primes. They handle drawings marked as controlled unclassified information, they run a small engineering team, and they have thirty CNC machines on the floor. Eighteen months ago they paid a consultant who produced a system security plan in Word, a plan of action spreadsheet, and a self assessment score submitted to the supplier performance risk system. Everyone felt considerably better.

An assessor now asks a different kind of question. Not does your policy require multifactor authentication, but show me that multifactor was enforced for every remote session in the last ninety days, including the two contractors you onboarded in April. Not do you control removable media, but show me what happened when a memory stick went into the machine at station 14 last month. Not do you mark controlled information, but show me how a drawing that arrived from your prime in an email got to the operator at the machine, and what it touched on the way.

The company has answers to none of these, because the artefacts they produced describe intent while the assessment examines operation. The system security plan says what the company decided to do. The evidence has to show what the company actually did, continuously, in the period being assessed. Those are different objects, and the gap between them is where defense suppliers lose contracts they had already won.

Problem 1: the system security plan is a document and it needs to be a state

A Word document describing your implementation of the NIST SP 800-171 requirement set is accurate on the day it is signed. Then someone replaces the firewall, a new engineer joins, the backup provider changes, and a department starts using a file sharing tool nobody approved. The document does not know about any of it. Six months later it describes a company that no longer exists, and its inaccuracy is not a documentation problem, it is an assessment problem, because inaccurate description of implemented controls is worse than an honest gap.

What replaces it is a live register in which each requirement has an implementation description, a named owner who is a real person with a manager, the systems it depends on, the evidence that demonstrates it, and a last verified date. When the firewall is replaced, the requirements that depend on it are flagged for review automatically because they reference the asset, not a paragraph of prose.

Problem 2: scoping the enclave is the entire cost driver and it is an engineering decision

The single largest variable in what compliance costs your company is how much of your company is in scope. Every consultant will tell you to shrink the boundary. What that means in practice at a manufacturer is genuinely hard, and it is where generic tooling is useless.

Controlled information at a machine shop does not stay in an office. It arrives as a drawing in an email or through a prime's portal. It becomes a model in your engineering system. It becomes a toolpath in your programming software. It travels to a machine over a network share, a direct numerical control link, or a memory stick because the network share does not reach that cell. It appears on a printed traveller in a plastic wallet on the machine. It is referenced by an inspection report on a coordinate measuring machine running an operating system from a decade ago. And a photograph of it exists on somebody's phone because that was faster.

Deciding which of those paths are in scope, which are engineered out, and how the boundary is enforced and evidenced is the actual project. A compliance platform will hold your boundary description. It will not tell you that the coordinate measuring machine cannot be patched, that the direct numerical control transfer is unauthenticated, or that the memory stick is the real control point. Only someone who walks your floor with you determines that, and the software you build has to reflect the decisions that walk produces.

Problem 3: evidence is continuous, and screenshots do not survive contact with an assessor

The alternative is collection at the source, on a schedule, into an immutable store. Your identity provider can answer whether multifactor was enforced and which sessions bypassed it. Your endpoint management tool can answer which machines are encrypted and patched, and which fell out of compliance and for how long. Your log platform can answer whether audit records were retained and reviewed. Your access review process can produce dated, signed evidence rather than a manager saying yes verbally. Each of these is an integration, each writes evidence against specific requirements with a timestamp and a source, and the resulting record shows a period rather than a picture.

The gap that no tool covers, and the reason a build sometimes makes sense, is the shop floor. Evidence that removable media use on machine tools is controlled, that file transfers to numerically controlled equipment are authenticated and logged, and that legacy equipment sits behind a properly enforced boundary generally has to be produced from your own systems and your own instrumentation. That is custom work at every company because every shop floor is different.

Problem 4: the plan of action is a promise with a date on it

The build should treat each open item as a real project object: a named owner, a milestone plan, a cost, a dependency on other work, and escalation when a date is at risk rather than after it has passed. The score you have submitted should be derived from the register, so that when an item closes with evidence attached the score moves and the submission history shows the trajectory. A supplier who can show an assessor a downward curve of open items with dated evidence behind each closure is telling a completely different story from one who produces a spreadsheet last touched in March.

Problem 5: you are also responsible for who you send the drawing to

Requirements flow down. If you subcontract heat treating, plating, or specialist machining and send controlled information to do it, that supplier's posture is part of your exposure. Most suppliers handle this with a clause in a purchase order and no monitoring whatsoever.

What a build can do that a filing cabinet cannot is connect flow down to actual data movement. Which subcontractors have received controlled information in the last twelve months, from which transfers, and what is their current attested status. Which have a self assessment score on file and when was it refreshed. Which received a drawing last week and have no attestation at all. That last query is the one that produces uncomfortable answers, and it is exactly the question an assessor may ask about your supply chain.

Where Exostar, Ignyte and Telos Xacta actually stop

Exostar has deep roots in aerospace and defense supply chain identity and collaboration, and if your primes already work through it, that relationship has real value. Its compliance offering is centred on self assessment management and supplier attestation, which is genuinely useful for the flow down problem and thinner as a continuous evidence system for your own environment.

Ignyte Assurance Platform is a credible governance and compliance product built with this requirement set in mind, and for many suppliers it is the right purchase. The limitation is common to the whole governance category: these platforms are excellent at holding a control register, mapping frameworks to one another, and structuring an assessment, and they depend on somebody feeding them evidence. Integrations exist for common enterprise tooling. Integrations do not exist for the direct numerical control server in your machine shop, and that is the part of your scope with the most risk.

Telos Xacta is serious federal grade tooling, built around authorisation packages and continuous monitoring at agency scale. If you are operating systems on behalf of a federal customer, it makes sense. Deploying it at a 240 person machine shop is like buying a locomotive to move a pallet.

Our honest position, stated plainly: most defense suppliers should buy, not build. Buy a governance platform, engage a provider who has been through assessments, and spend your budget on the remediation the assessment will require anyway. Build only when your controlled information touches operational technology that no product understands, when you maintain multiple separated enclaves for different programmes, or when you are large enough that monitoring a subcontractor base is itself a system.

What this costs and how long it takes

Across the 2,000 plus projects Digital Heroes has delivered, this is the honest shape when a build is warranted. A first release covering a live control register with owners and asset references, automated evidence collection from identity, endpoint and logging tooling, plan of action tracking with escalation, and documented scope boundary with data flow mapping runs $60,000 to $130,000 and ships in 10 to 16 weeks. A full platform adding shop floor evidence for removable media and machine file transfer, subcontractor flow down monitoring tied to actual data movement, multi enclave separation, and assessment package assembly runs $150,000 to $350,000 phased over 6 to 12 months.

What drives cost up specifically here: the number of enclaves, since programmes that must be separated multiply everything. Shop floor instrumentation, because logging file transfers to machine tools running old operating systems is real engineering rather than configuration. Cloud service posture, since any external service holding controlled information brings its own authorisation questions that need answering before you design around it. And incident response readiness, since the reporting obligation under the defense acquisition regulation runs on a short clock and your process has to be exercised rather than written.

Build versus buy, and when buying is the right call

Buy if you are an office based supplier where controlled information stays in email, a document system and an engineering tool, all from mainstream vendors with integration support. A governance platform plus a competent managed provider will get you further, faster, for less. Buy if you are pursuing the lower assessment level with a small requirement set. Buy if you have no internal system owner, because a custom system with no owner decays into another artefact nobody maintains.

Build when two or more of these are true. Controlled information reaches machine tools, inspection equipment or other operational technology. You maintain separate enclaves for different programmes or customers. You flow controlled information to a subcontractor base large enough that monitoring is a process rather than a conversation. You already run an internal platform that holds your quality and manufacturing data, and compliance evidence belongs alongside it. Or you have been through an assessment, know precisely where your evidence gaps are, and want them closed by instrumentation rather than by an annual screenshot exercise.

How to choose a developer for compliance evidence software

Ask them to walk your floor before they quote. A developer who understands this problem will want to see how a drawing gets from a prime's portal to an operator at a machine, and will ask about memory sticks, printed travellers, and the inspection machine nobody wants to touch. A developer who proposes a control register and a dashboard has built a governance tool and has left your highest risk path untouched.

Ask what they will not build. A credible partner will tell you to buy your identity, endpoint and logging capability from established vendors and to build only the layer that joins them to your requirements and your shop floor. Anyone offering to build you a security stack is selling you a liability.

Ask who owns the code and get it in writing before kickoff. You should own the repository, the infrastructure accounts, and the right to hire anyone else. At Digital Heroes the code is yours from the first commit. A system that holds your assessment evidence is not something to have locked behind another company's renewal.