Speed with control
Automate intake, assessment, and monitoring with guardrails that keep your policies in force.
ReportThe 2026 State of TPRMThe 2026 State of TPRM: where programs break and what risk leaders want insteadDownload
CMMC flows security requirements down your subcontractor chain. Coverbase helps you manage it.
The DoD's Cybersecurity Maturity Model Certification requires defense contractors handling federal contract information (FCI) and controlled unclassified information (CUI) to meet NIST SP 800-171-based requirements, and to flow them down to subcontractors. Coverbase keeps that supply-chain side organized and verifiable.
CoverbaseCMMC | information flow
CMMC | information flow
Before the subcontract award
CUI flow
Contract level
Supplier status
Agent work
01Map the systems
02Review evidence
03Route the gap
Status check prepared
The prime checks the applicable requirement.
Who CMMC applies to
CMMC applies to Department of Defense contractors and subcontractors (the Defense Industrial Base) that handle FCI or CUI. It has three levels, with Level 2 aligned to NIST SP 800-171 and verified by self-assessment or an accredited CMMC Third-Party Assessment Organization (C3PAO). Phase 1 of the rollout in DoD contracts began on November 10, 2025.
What CMMC involves
- 01
Three levels
From Level 1 safeguarding of FCI to Level 3, which adds NIST SP 800-172 requirements and a government-led assessment. - 02
NIST SP 800-171 alignment
Level 2 maps to the 110 requirements of NIST SP 800-171. - 03
Flow-down to subcontractors
Prime contractors must ensure subcontractors handling FCI or CUI meet the right level. - 04
Independent verification
Many contracts require assessment by an accredited C3PAO, not only a self-attestation.
Keep your subcontractor chain in view
CMMC is a supply-chain assurance regime. Coverbase gives primes a standing view of the subs they have to flow requirements down to.
Subcontractor inventory
Track the subs and suppliers in scope and the information they handle.Evidence gathered for you
Collect and review subcontractor security documentation automatically.Requirements tracked
Flag whether each sub carries the level and terms its scope requires.Continuous monitoring
Watch the chain for changes, not only at award.
One platform for third-party risk and security
Explain with confidence
AI shows its reasoning for each recommendation, so you can explain your ratings and findings.
Automate with assurance
Adapt controls and workflows as your program and its regulations change.
How we protect your data
These are the practices behind the supplier records and evidence you keep in Coverbase. Read our security and privacy program.
To request our SOC 2 report or report a vulnerability, email security@coverbase.ai.
Independent review
A SOC 2 Type II audit against the AICPA Trust Services Criteria for security, availability, and confidentiality.Testing and remediation
External penetration tests every year, plus vulnerability scans and static and dynamic application security tests, with findings tracked through remediation.Identity and production access
SSO and SAML with Okta, Microsoft Entra, Google, and other identity providers. Multi-factor authentication is required for production access.Data protection
Data encrypted at rest with AES-256 and in transit with TLS 1.2 or higher.Internal accountability
Access logging, quarterly least-privilege reviews, and required employee security and privacy training.
CMMC subcontractor questions
The required status comes from the contract and the information handled.
Does every DoD subcontractor need the same level?
No. Check the clause and the FCI or CUI that its systems will handle.
Does Level 2 always require a C3PAO?
No. The applicable contract specifies when Level 2 uses self-assessment or third-party assessment.
Does Coverbase issue CMMC status?
We assemble subcontractor scope and evidence for your review. Required status comes through DoD's assessment and affirmation processes, not through us.