For defense suppliers · CMMC and NIST SP 800-171
Interlok holds the actions that touch CUI for a named person, signs every decision with your key, and maps the record to all 110 NIST SP 800-171 requirements. A prime, an assessor or your own executive can check every signature offline, without an Interlok account.
Scopes are Interlok’s mapping, not an assessor’s opinion. Whether evidence satisfies an assessment objective is always the assessor’s call.
On July 13, 2026 the Department of War suspended the CMMC Phase 2 transition, including Level 2 third-party (C3PAO) certification, pending a reform task force review.
NIST SP 800-171 through DFARS 252.204-7012, Level 1 and Level 2 self-assessments, your SPRS score, and the annual affirmation a senior executive signs. Primes may keep their own deadlines.
In September 2026 Honeywell Aerospace paid $2.04 million to resolve False Claims Act allegations that one network fell short of 800-171. An affirmation is only as good as the evidence behind it.
Sources: Morgan Lewis, Jul 2026 · Nixon Peabody, Sep 2026. Status as of October 2026; check for updates before relying on it.
A determination names a person, verified by your identity provider, with their reason. Not a Slack thread someone screenshots eight months later. An agent can never approve an agent. (3.1.4, 3.1.7, 3.3.2)
Allowed actions are recorded too, so the absence of a gap is visible. Hourly public anchors mean the chain cannot be quietly rewritten, including by us. (3.3.1, 3.3.8)
CUI headed for an unregistered destination is held for a person, and ITAR data is denied outright. Both outcomes are signed. (3.1.3, 3.1.20)
Deploys, Terraform applies and privileged access grants wait for a named approver, and access grants record when they ended. (3.4.3, 3.4.5, 3.1.5, 3.1.15)
Every requirement with its status for the period: evidenced, supporting, no entries, or outside Interlok. Outside items name where their evidence lives (your IdP, MDM, SSP and so on), so nothing reads as missing when it simply lives elsewhere.
The full contiguous ledger range, the hourly anchors and your public keys in one file. Sensitive fields can be redacted and still verify.
Manifest signature, file digests, record signatures, chain continuity, anchor inclusion, public anchors and your published key file. Same open-source code in the browser and the command line.
Keep it. Evidence Connect signs what PolicyLayer, Runlayer or any gateway records and grades each record by what it proves. See pricing.
Counted from the CMMC pack Interlok ships. Families such as Media Protection and Physical Protection are entirely yours; we say so rather than pad the map.
| Family | Requirements | Direct | Supporting | Outside Interlok |
|---|---|---|---|---|
| 3.1 Access Control | 22 | 8 | 2 | 12 |
| 3.2 Awareness and Training | 3 | — | — | 3 |
| 3.3 Audit and Accountability | 9 | 4 | 3 | 2 |
| 3.4 Configuration Management | 9 | 3 | 6 | — |
| 3.5 Identification and Authentication | 11 | 2 | 2 | 7 |
| 3.6 Incident Response | 3 | — | 2 | 1 |
| 3.7 Maintenance | 6 | — | 4 | 2 |
| 3.8 Media Protection | 9 | — | — | 9 |
| 3.9 Personnel Security | 2 | — | 1 | 1 |
| 3.10 Physical Protection | 6 | — | — | 6 |
| 3.11 Risk Assessment | 3 | — | 3 | — |
| 3.12 Security Assessment | 4 | — | 2 | 2 |
| 3.13 System and Communications Protection | 16 | — | 3 | 13 |
| 3.14 System and Information Integrity | 7 | — | 3 | 4 |
Interlok does not certify you, write your SSP, or replace your GRC tool. Its ledger signatures prove integrity, not confidentiality, and it makes no FIPS 140 validation claim (3.13.11). SPRS scoring and flow-down decoding are Muster, a separate product. Evidence from either verifies with the same tool.
Not in defense? The same gate and ledger produce evidence for SOC 2 and ISO 42001. See Interlok for every team.