Why Airlock Digital : Compliance

Support CMMC Compliance

Enforce application policies and produce evidence that supports CMMC assessments 
The Cybersecurity Maturity Model Certification (CMMC) is a critical framework for organizations working with the U.S. Department of Defense (DoD). For applicable contractors and subcontractors, it requires organizations to implement stringent cybersecurity controls to protect Controlled Unclassified Information (CUI) and Federal Contract Information (FCI). 

CMMC implementation is currently paused in Phase 1 while the Department reviews Phase 2 requirements. However, Phase 1 self-assessment requirements remain in place, and contractors must continue to meet applicable cybersecurity requirements for protecting CUI and FCI. 

Why Application Control Matters for CMMC

Prevent Unauthorized Execution
Allow approved software to run while blocking unauthorized applications, scripts, and processes. 
Reduce Security Risk
Limit opportunities for malware and other untrusted code to execute on protected systems. 
Strengthen Endpoint Integrity
Help keep endpoints in a trusted state by controlling which applications, scripts, and processes can run.
Improve Visibility and Accountability
Record application executions and execution attempts to support investigations, policy management, and compliance assessments.

How Airlock Digital Supports Key CMMC Level 2 Requirements

Application control does not establish CMMC compliance on its own. It can, however, help organizations implement relevant safeguards, enforce documented policies, and produce evidence showing that software execution controls are operating as intended. 

Configuration Management: Control Which Software Can Run

CMMC Level 2 Configuration Management requirements include limiting systems to essential functionality, restricting nonessential programs, enforcing an application execution policy, and controlling user-installed software. Airlock Digital Application Control helps organizations put those policies into practice by allowing approved applications, scripts, and other executable files to run while blocking unauthorized software. 

  • CM.L2-3.4.6: Configure systems to provide only essential capabilities.
  • CM.L2-3.4.7: Restrict, disable, or prevent the use of nonessential programs and other functionality.
  • CM.L2-3.4.8: Enforce a software-execution policy that either blocks identified unauthorized software or permits only explicitly authorized software to run.
  • CM.L2-3.4.9: Control and monitor user-installed software. 

System and Information Integrity: Block Malicious and Unauthorized Execution

Application control can also support CMMC System and Information Integrity requirements by preventing unauthorized code from executing and providing visibility into attempts to run software outside established policy. This capability complements other security controls by reducing opportunities for malicious or unapproved applications, scripts, and executable files to operate on protected systems. 

  • SI.L2-3.14.2: Provide protection from malicious code at designated locations within organizational systems. 
  • SI.L2-3.14.7: Identify unauthorized use of organizational systems. 

Audit and Accountability: Demonstrate Enforcement

CMMC Level 2 requires organizations to create and retain the audit records needed to monitor, analyze, investigate, and report unauthorized activity. Airlock Digital records application execution activity and policy decisions, providing evidence of what was allowed or blocked. Along with policy configuration and testing, these records can help demonstrate that software execution controls are operating as intended. 

  • AU.L2-3.3.1: Create and retain system audit logs and records needed to support the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity. 

Keep Exploring

CMMC Blog

Read Now

Airlock Digital Product Datasheet

Read Now

Talk to an Expert

Book a Meeting