Why AI Use Matters Under CMMC
CUI pasted into a commercial AI service leaves the assessed boundary. Removable media and uncontrolled transmission are among the first things an assessor looks at.
Controls ProctoredAI Evidences
| Control | Evidence in the Monthly Report |
|---|---|
| AC.L2-3.1.3 Control CUI flow | CUI-marked content blocked from AI services. |
| AU.L2-3.3.1 System auditing | Endpoint AI activity is logged and retained. |
| MP.L2-3.8.7 Control use of removable media | Removable media blocked, read-only or audited per client policy. |
Each client's report lists these controls with a status. Evidenced means the mechanism produced records in the period; Active means it is enforced with nothing to record; Not configured means the feature is off for that client.
Policy Packs Applied
Selecting CMMC for a client applies these packs in one step:
- CMMC — CUI & Export Control. Block CUI, ITAR and export-controlled markings to every AI app.
- Confidential Documents. Warn when confidentiality-marked content is shared.
- Endpoint DLP. Secrets never leave on USB or the clipboard; everything sensitive on removable media, the clipboard and at rest is logged.
The Setup Checklist
Some steps live outside the policy rules. The console hands the provider this list:
- Confirm fail-closed mode in Client Settings
- Turn on removable-media control under Data Protection
What the Auditor Receives
- A monthly AI Governance Report for the client, stored with a SHA-256 digest so the copy an auditor holds can be matched to the console.
- An evidence bundle with every non-usage event in the period, the client's audit-log entries and the head hash of the audit chain.
- The AI Use Policy generated from the client's real configuration, with each employee's acknowledgment and version.
AI Apps to Decide On First
- Claude CodeMedium
- CodexMedium
- GitHub CopilotMedium
- CursorMedium
- Windsurf / CodeiumMedium
- Replit AgentMedium
- LovableMedium
- bolt.newMedium
- Base44Medium
- EmergentMedium
- CreateMedium
- DatabuttonMedium
Questions
Can a defense contractor let staff use AI tools?
Only where CUI cannot reach them. ProctoredAI blocks content carrying CUI and export-control markings to every AI app, and logs every AI request on the device.
What happens if the agent stops?
In fail-closed mode, a stopped agent or a failed inspection blocks AI traffic instead of letting it through. The CMMC checklist asks the provider to confirm that mode.
Does it cover removable media?
Yes, on the Protect plan: removable media can be blocked, made read-only or audited, with serial-number exceptions, as evidence for MP.L2-3.8.7.
ProctoredAI supports a client's compliance program; it does not by itself make a client compliant, and it is not legal advice. All frameworks · The MSP AI governance guide