�Ӱɴ�ý

Tl;dr: To support CMMC compliance, �Ӱɴ�ý released a new Sensitive Data Mode, which blocks SOC access to potential CUI files, without compromising analysts’ ability to effectively detect and remediate threats. Read on for a deeper understanding of CMMC compliance and how �Ӱɴ�ý helps.

Increasingly sophisticated cyber threats have placed greater demands on the security of organizations, particularly those in the supply chain for the Department of Defense (DoD). The Cybersecurity Maturity Model Certification (CMMC) was introduced to set a new bar for compliance and risk management.

But navigating CMMC compliance—particularly as it has gone through several updates—can feel daunting. It’s essential to understand how tools like �Ӱɴ�ý can fit into a compliant and secure framework.

A Look at CMMC History From CMMC 1.0 to the 2024 Final Rule

CMMC 1.0 and Initial Challenges��

Launched in 2020, CMMC 1.0 was built around five distinct maturity levels, each requiring external audits. Vendors supporting organizations subject to CMMC also had to demonstrate compliance, either through their own CMMC audit or by obtaining FedRAMP authorization. These high standards created substantial hurdles, particularly for smaller vendors, due to limited resources and high costs.

CMMC 2.0 Brings Simplification��

By 2021, the framework evolved into CMMC 2.0, reducing the number of levels to three. This shift streamlined the landscape while still maintaining robust compliance measures. Importantly, external audits became mandatory only for organizations at Level Three and select Level Two entities. However, vendors serving CMMC-applicable organizations were still held to strict compliance requirements within the 1.0 rules.

The 2024 Final Rule and Vendor-Specific Changes��

The 2024 CMMC Final Rule introduced noteworthy changes, especially in vendor requirements. Vendors storing, processing, or modifying Controlled Unclassified Information (CUI) remain obligated to meet full CMMC compliance or FedRAMP authorization. However, vendors that act solely as Security Protection Assets—tools that provide security without directly storing, processing, or transmitting CUI—are no longer required to undergo the same external assessments. Instead, the compliance responsibility shifts to the organizations using these tools to ensure that the security capabilities their vendors provide are adequate to meet the CMMC objectives.

What CMMC Means for �Ӱɴ�ý as a Security Protection Asset

The CMMC framework identifies Security Protection Assets as third-party solutions that provide security functions or capabilities to the contractor’s CMMC Assessment Scope.

�Ӱɴ�ý is classified as a Security Protection Asset, as we can help CMMC-bound organizations remain secure through our offerings:

• Endpoint Detection and Response (EDR) to protect endpoints
• Identity Threat Detection and Response (ITDR) to secure identities
• Security Information and Event Management (SIEM) to enhance defenses
• Security Awareness Training (SAT) to arm employees

Security Protection Assets—like �Ӱɴ�ý—are to be evaluated based on their security capabilities, and aren’t subject to separate compliance audits themselves.

How �Ӱɴ�ý Supports CMMC Compliance

When managing cybersecurity in a CMMC-compliant environment, certain capabilities are required for handling files containing CUI during threat detections. For example, retrieving files for malware investigations could unwittingly expose sensitive information.

Recognizing this challenge, �Ӱɴ�ý built our new Sensitive Data Mode—a configuration designed to strike the perfect balance between effective threat investigation and compliance requirements.

�Ӱɴ�ý' Sensitive Data Mode Explained

Here's what the new mode delivers to help you support CMMC compliance:

1. Blocking SOC Access to Potential CUI Files��

�Ӱɴ�ý now enables organizations to block our Security Operations Center (SOC) from accessing files likely to contain CUI during investigations. �Ӱɴ�ý blocks high-risk file types (e.g. documents, spreadsheets) from being retrieved during investigations. This measure reduces risk and protects compliance.

2. Effective Threat Detection for Analysts��

�Ӱɴ�ý analysts can still retrieve and analyze executable files, scripts, or other non-sensitive file types often associated with malicious activity. This means we can continue to deliver critical incident reports at 99% accuracy—without compromising compliance.

Need to Remain CMMC Compliant? Let Us Know.

Sensitive Data Mode is available now and can be configured upon request by .

Want to see how �Ӱɴ�ý can strengthen your security in a CMMC-compliant environment? Download our CMMC Security Framework Checklist.��

And be sure to book your demo with �Ӱɴ�ý today.