Why AI Use Needs Governing Here
Engineers and program staff use AI on drawings, specifications and code that may carry CUI or export-controlled markings. CUI in a commercial AI service has left the assessed boundary, and a CMMC assessor will ask how that is prevented.
The Policy a New Client Starts With
A client created with the Defense Contractors industry starts with these policy packs:
- Confidential Documents. Warn when confidentiality-marked content is shared.
Every client also gets the baseline packs: Credentials & Secrets, CMMC — CUI & Export Control, Visibility Baseline, Prompt Injection & Jailbreaks.
Setting It Up
- Block CUI and export-control markings to every AI app, with no exceptions.
- Keep fail-closed mode on so a stopped agent blocks AI traffic rather than letting it through.
- Block removable media or make it read-only, with exceptions by serial number (Protect plan).
- Review MCP servers on engineering devices and block remote servers that aren't approved.
Start every client in observe-only mode for two weeks, so the decisions are made on what staff actually use. The shadow AI audit describes the steps.
AI Apps to Decide On First
- Claude CodeMedium
- CodexMedium
- GitHub CopilotMedium
- CursorMedium
- Windsurf / CodeiumMedium
- Replit AgentMedium
- LovableMedium
- bolt.newMedium
- Base44Medium
- EmergentMedium
- CreateMedium
- DatabuttonMedium
- RorkMedium
- TempoMedium
- JulesMedium
Compliance
CMMC: the controls ProctoredAI evidences, the packs and the checklist.
Questions
Can a defense contractor allow AI tools at all?
Yes, where CUI cannot reach them. Marked content is blocked to every AI app and every request is logged on the device.
Which CMMC practices does this support?
Controlling CUI flow, system auditing and removable media, with the evidence listed on the CMMC page.
What about AI coding tools?
Coding assistants and command-line tools are recognized by their client signatures, inspected like any other AI app, and their MCP servers are inventoried.
All industries · The MSP AI governance guide · AI policy template