Defense and aerospace
Audit evidence and data controls for CMMC and NISPOM.
Security built for the defense industrial base
Technical information needs controlled access and a record of how it was used. Local monitoring and data protection help security teams support engineering collaboration while preparing evidence for customer and assessment reviews.
Requirements
| Requirement | Short form | Points | Security support |
|---|---|---|---|
| 3.3.1 | Create and retain audit logs. | 5 | Each source collected and retained. → |
| 3.3.5 | Correlate review and reporting. | 5 | Correlation across sources. → |
| 3.3.8 | Protect audit information. | 1 | Signed, chained logs. → |
| 3.6.1 | Incident handling capability. | 5 | SIEM cases with their MITRE tactic. → |
| 3.8.7 | Control removable media. | 5 | USB control by serial number. → |
| 3.1.3 | Control the flow of CUI. | Per method | DLP checks on web, FTP and email. → |
| 3.14.7 | Identify unauthorized use. | 3 | Detection baselines for each user and host. → |
32 CFR 170.19
CMMC scoping considers systems that handle CUI and systems providing security protection. Identify the tool’s role, data flows and dependencies in the assessment boundary, including any external services.
NIST SP 800-171 3.3
Audit and accountability work includes collecting, retaining, reviewing and protecting the relevant activity records. Signed exports from a SIEM support independent integrity checks, while source coverage and review records explain how the control operated.
NIST SP 800-171 3.8.7
SPRS and CMMC evidence should show how media controls operate. DLP device policies can limit removable media to approved users and devices. Content checks and documented exceptions help protect technical data while allowing necessary engineering and production transfers.
NISPOM 117.7
Sign-ins, file activity, device use and behavioral context contribute evidence to an insider threat program. The investigation should consider legitimate explanations and keep decisions about people with authorized reviewers.
By rule
3.3.1
Create and retain audit logs. A SIEM can retain the relevant sources for the required period and make the history available for review.
3.3.5
Correlate review and reporting. Correlation in a SIEM connects related events across sources while preserving the records behind the resulting finding.
3.3.8
Protect audit information. Signed records from a SIEM and verification material support an independent check of the evidence’s integrity.
3.6.1
Incident handling capability. A SOAR incident workflow retains ownership, evidence, approvals and actions so reviewers can follow the response.
3.8.7
Control removable media. DLP device policies restrict supported removable media, with approved exceptions and activity retained for review.
3.1.3
Control the flow of CUI. DLP policies inspect covered transfers and apply the organization’s blocking or approval rules.
3.14.7
Identify unauthorized use. UEBA baselines in AI Detection add historical context to account and host activity for analyst review.
Questions
Does it add a cloud provider to our scope?
Local deployment can keep the core service within the contractor’s environment. Scoping still examines the actual data flows, support arrangements and any external services enabled.
Can technical data leave?
DLP policies can inspect supported transfers and restrict unapproved sharing. Evaluate representative technical files, approved collaboration and exception handling on the channels the team uses.
Does it support our insider threat program?
Activity and transfer records can support the program’s investigations. Program ownership, staff responsibilities and decisions about people remain with the contractor.
What stays with the contractor?
The contractor owns its security program, assessment evidence and any classified-system authorization. The deployment supports the defined monitoring and data-handling functions.
Guide
What is CMMC Level 2?
CMMC Level 2 applies the 110 requirements of NIST SP 800-171 to contractors that handle controlled unclassified information (CUI).
What does DFARS 252.204-7012 require?
Adequate security under NIST SP 800-171, 90 days of preserved monitoring data and incident reports to DoD within 72 hours.
Do security tools count in CMMC scope?
They can. A tool’s security role and the information it handles determine how it fits the assessment scope; hosting it locally does not by itself settle that classification.
How ARRTECH takes care of defense and aerospace security
Connects security activity into a signed record, giving incident decisions and board reporting evidence that can be independently verified.
Protects intellectual property and customer trust, with content-aware controls that let organizations adopt AI on their own terms.
Expands response capacity through automation, with defined human authority and a record of who approved what.
Finds changes in behavior that predefined rules miss, connecting the signs of an attack so teams can understand what warrants action.
Investigates alerts, tests explanations and prepares the evidence, giving analysts more capacity while people retain authority over the response.
