BY NEURABYTE
FRAMEWORKS/GOVERNMENT/CMMC 2.0
CMMC
GOVERNMENT · US Dept. of Defense

CMMC 2.0

Cybersecurity maturity for defense contractors handling CUI.

The Cybersecurity Maturity Model Certification 2.0 has three levels. Level 1 covers federal contract information with 17 practices; Level 2 covers controlled unclassified information with the 110 practices of NIST SP 800-171; Level 3 adds 800-172 enhanced practices. The final rule took effect in December 2024, with phased inclusion in contracts through 2028.

AT A GLANCE
ISSUERUS Dept. of Defense REGIONUS defense industrial base CATEGORYGovernment CROSSWALKVersioned mapping onto the 15-control registry
EVIDENCE, NOT CERTIFICATION
01. WHO IT APPLIES TO

Is this one yours?

01DoD prime and subcontractors handling FCI or CUI
02Their cloud and managed service providers
03Any agent operating on systems that store or process CUI
02. KEY REQUIREMENTS

The parts of CMMC 2.0 that touch what agents do.

AC.L2-3.1.1 Authorized access
Limit system access to authorized users, processes, and devices.
AC.L2-3.1.5 Least privilege
Employ least privilege, including for specific security functions and privileged accounts.
AU.L2-3.3.1 System auditing
Create and retain audit logs to enable monitoring, analysis, investigation, and reporting.
AU.L2-3.3.8 Audit protection
Protect audit information and logging tools from unauthorized access, modification, and deletion.
03. HOW LORE MAPS TO IT

Enforcement controls, read against the requirement.

These controls exist because the platform needs them to run safely. The crosswalk reads their signed evidence against CMMC 2.0. Where there is no evidence, the report says gap.

LORE CONTROL CMMC 2.0 REFERENCE
Blocking authorization gateAC.L2-3.1.1, 3.1.5
Maker–checker approvalAC.L2-3.1.4 separation of duties
Signed, hash-chained receiptsAU.L2-3.3.1, 3.3.8
Context disclosure recordAC.L2-3.1.3 CUI flow
Illustrative references. The shipped crosswalk carries exact clause citations, its version, and the review date.
04. OUT OF SCOPE

What Lore will not claim.

Physical protection, awareness training, and the system security plan are organizational.
Assessment by a C3PAO (Level 2) or DIBCAC (Level 3) is your program.
05. QUESTIONS
Which level does Lore support?
The crosswalk targets Level 2 (800-171), which is where most contractors land.
Can agents handle CUI?
With the same controls as any process: authorized access, least privilege, and protected audit logs. Self-hosted deployment keeps CUI in your enclave.
When?
Planned, on request.
← PREVIOUSFedRAMP ALL FRAMEWORKS NEXT →21 CFR Part 11
CMMC 2.0 · EARLY ACCESSEVIDENCE COLLECTED ONCE

Start building the record your auditor will read.

Every receipt Lore signs today is evidence for CMMC 2.0 tomorrow. Turn the crosswalk on when you are ready; nothing needs re-collecting.

Also from Neurabyte: Cupel
Lore's core mechanisms are patent-pending. Product names are trademarks of their respective owners; listing an integration doesn't imply a partnership.
© 2026 NEURABYTE INC.