AI is a scoping decision inside your CMMC boundary.
For SBIR awardees and small defense contractors, the safest working assumption is this: any AI tool that can touch FCI or CUI is in scope for your CMMC program. FCI safeguarding under FAR 52.204-21 and CUI safeguarding under DFARS 252.204-7012 govern how contract data may be processed — the choice of interface, model, or vendor does not change that duty.
Every AI tool creates a compliance question in one of three buckets: where the data goes, who can access it, and how you prove control. DFARS 252.204-7012 still requires safeguarding CDI, rapid cyber-incident reporting within 72 hours, and cloud services that meet FedRAMP Moderate-equivalent requirements when they process, store, or transmit CUI. CMMC remains based on NIST SP 800-171 Rev. 2 unless a contract says otherwise.
The strongest pattern for small contractors is to treat AI as a scoped system-design decision, not a productivity preference. If a model or AI-connected workflow can process, store, transmit, summarize, ground on, or exfiltrate FCI/CUI, it belongs inside your CMMC boundary, your SSP, your vendor process, your logging plan, and your incident-response playbook.
Key takeaways
- FCI and CUI safeguarding, SSP quality, and 72-hour incident reporting apply to every AI workflow that touches contract data.
- AI decisions are scoping decisions. Keep CUI-facing AI in an approved government-cloud boundary or documented enclave.
- Encryption in transit is necessary, not sufficient. CSPs handling CUI must be FedRAMP Moderate-equivalent.
- Copilot in GCC High keeps prompts and outputs inside the customer's government tenant; commercial Copilot does not.
- Train by role, log by design, and rehearse at least one AI-disclosure tabletop inside 90 days.
The rules that govern AI in a CMMC environment.
CMMC is currently based on NIST SP 800-171 Rev. 2. Applicable contractors handling CUI perform a Level 2 self-assessment against that baseline, with SSP and POA&M evidence to match. Rev. 3 exists and future rulemaking is expected, so any AI adoption plan should be portable across control revisions rather than pinned to a single moment in time.
Recent Department memoranda and FAQs use Department of War (DoW) language, while DFARS clauses and long-standing acquisition materials still use Department of Defense (DoD). Your contract language and the current official clause text control, regardless of which shorthand appears in background materials.
FCI and CUI need different handling. FCI is contract information not intended for public release. CUI is unclassified information requiring safeguarding or dissemination controls. For defense contractors, DFARS 252.204-7012 ties safeguarding obligations to covered defense information, including controlled technical information and other CUI categories from the CUI Registry.
The cloud rule matters for AI procurement: if a CSP stores, processes, or transmits CUI in contract performance, it must meet FedRAMP Moderate-equivalent security requirements — even if the CUI is only stored in encrypted form.
What current rules mean for AI decisions
| Regulatory point | What the source says | Practical AI consequence |
|---|---|---|
| CMMC assessment scope | Applicable contractors handling CUI perform a Level 2 self-assessment against NIST SP 800-171 Rev. 2 today. | Every AI workflow that can touch CUI must be represented in your SSP and evidence set. |
| NIST baseline | CMMC is currently based on NIST SP 800-171 Rev. 2. | Map AI use to Rev. 2 controls and SSP evidence today. |
| FCI vs CUI | FCI is contract information not intended for public release. CUI requires formal safeguarding controls. | Use a stricter approval path for anything that touches CUI. |
| Cloud use for CUI | CSPs processing, storing, or transmitting CUI must meet FedRAMP Moderate-equivalent requirements. | Most public AI SaaS should be treated as prohibited for CUI unless vetted and documented. |
| Covered defense information | Includes controlled technical information and other CUI created or used in contract performance. | Source code, engineering notes, designs, test results, and some SBIR artifacts can fall in scope. |
| Incident handling | DFARS requires rapid reporting within 72 hours of discovery of a cyber incident affecting covered systems or data. | AI disclosure scenarios need a triage-and-escalation path, not just an HR reminder. |
AI is a data flow, not a browser plug-in.
In a compliant environment, the real question is not "Is this AI smart?" It is: what data sources, identity context, memory, connectors, logs, training paths, and downstream actions does this workflow create?
Prompt & data leakage
Prompts routinely carry CUI, source code, export-controlled details, subcontractor data, and research context. Provider terms shift, and FTC guidance flags reuse as a live legal exposure.
Training, retention & hidden state
"Not used to train" is not the whole picture. Abuse monitoring, threads, vector stores, stored completions, preview features, and Global/DataZone deployments each change where and how long data persists.
Code & repository exposure
SBIR engineering workflows leak fastest: autocomplete, refactors, generated tests. Sent snippets can pull an outside vendor into contract performance and expand scope.
Metadata & provenance
Filenames, senders, label names, paths, meeting titles, and citations reveal more than users expect. Some DLP rules inspect metadata only, not body content.
Prompt injection & untrusted grounding
Assistants summarize email, parse uploads, retrieve the web, and call tools. Indirect prompt injection can hijack agents, extract data, or trigger connector actions.
Third-party & subcontractor propagation
AI resellers, managed Copilot, RAG platforms, and MSP-embedded assistants each become a third-party AI system that needs allowlist, contract clauses, and monitoring.
AI tool types & minimum controls
| AI tool type | Default posture for FCI/CUI | Minimum control set |
|---|---|---|
| Public LLM / web chatbot | Prohibit for CUI. For FCI, only if policy explicitly permits sanitized use. | AUP, browser controls, DLP, no file uploads, no source code, user attestation |
| Private enterprise LLM (commercial cloud) | Acceptable for public/internal/non-CUI use unless contract fit, region, retention, and safeguards are proven. | Vendor review, SSO, MFA, audit, retention rules, shadow-IT discovery |
| Self-hosted / on-prem model | Potentially acceptable for CUI if inside scope and fully documented. | SSP inclusion, baseline config, logging, segmentation, patching, model lifecycle governance |
| Azure Government / GCC High AI workflow | Preferred cloud option for CUI when service, region, logging, and contract are documented. | Government tenant, CA, managed devices, labels, DLP, audit, human review |
| Microsoft 365 Copilot in GCC High | Appropriate for scoped use with labeling, DLP, permissions, and grounding controls configured. | Permission hygiene, sensitivity labels, Copilot DLP, external-email grounding controls, audit |
| Agentic / connector-based AI | High-risk; requires explicit approval before use with FCI/CUI. | Connector inventory, least privilege, injection mitigations, action allowlists, kill switch |
Why AI belongs in your SSP.
If you adopt AI and don't account for it in your boundary, inventory, external-system controls, logging, and policies, your self-assessment quality drops and your SPRS posture weakens. A fully implemented 800-171 Rev. 2 environment reports 110; unimplemented requirements reduce the score.
A second scoping point is easy to miss. Under 32 CFR Part 170, CUI Assets are in scope, Security Protection Assets are in scope to the extent relevant to the protections they provide, and Contractor Risk Managed Assets still require asset inventory and SSP treatment. An AI broker, DLP engine, CASB, email security layer, or monitored VDI that protects CUI can become relevant evidence even if it doesn't itself hold CUI.
The CMMC / NIST controls most affected by AI use
| AI issue | Most relevant control areas | Why it matters for evidence |
|---|---|---|
| Unapproved AI tools & plugins | 3.1.1, 3.1.2, 3.1.20, 3.4.1, 3.4.8 | You must control access, permitted functions, external systems, software inventory, and unauthorized software. |
| Prompting with CUI or controlled code | 3.1.3, 3.13.8, 3.13.16 | You must control CUI flow and protect confidentiality in transit and at rest. |
| AI summaries over overshared files/mail | 3.1.1, 3.1.2, 3.3.1, 3.3.2 | Permissions plus your ability to audit what was accessed, and by whom. |
| Public or third-party grounding sources | 3.1.20, 3.4.1, 3.12.1, 3.12.2 | External-system use must be governed and documented in the SSP/POA&M. |
| Malware inside AI-connected workflows | 3.14.1, 3.14.2, 3.14.3 | AI ingestion paths and generated artifacts must still fall under flaw, malware, and alert monitoring. |
| AI disclosure or exfiltration incident | 3.6.1, 3.3.1, 3.3.2, DFARS reporting | You need operational incident handling, evidence retention, and a path to contractual reporting. |
Tenant, boundary, labels, DLP — in that order.
For most small defense contractors, the central Microsoft decision is not "Do we want Copilot?" It is "Which tenant and data boundary are we willing to trust for contract data?" Microsoft 365 Government is tailored for agencies and contractors sponsored to hold controlled information, and GCC High carries commitments including FedRAMP High, ITAR, DFARS, and DISA SRG L4. Microsoft states that Microsoft 365 Copilot is available in GCC, GCC High, and DoD and that in those environments prompts, responses, and generated content remain in the customer's U.S. government cloud tenant.
GCC High vs. commercial Microsoft 365
| Dimension | Commercial M365 | GCC High |
|---|---|---|
| Intended audience | General enterprise | U.S. government entities and eligible contractors handling controlled information |
| Isolation commitments | No government-only boundary commitments | Exclusive government/contractor community, screened personnel, U.S.-based storage commitments |
| Defense alignment | May fit some internal business functions | Purpose-built path for DFARS/ITAR/SRG L4-aligned needs when configured appropriately |
| Cross-tenant sharing | Broad enterprise collaboration | GCC High-to-GCC High sharing constraints reduce accidental boundary crossing |
| Copilot fit | Good for non-defense workloads | Better fit for scoped government-cloud AI adoption |
Recommended licensing paths
Exact licensing is tenant-specific and should be confirmed with Microsoft or your licensing partner. The mix depends on seat count, device management needs, audit retention, and whether Copilot is broad or scoped.
| Goal | Suggested path | Notes |
|---|---|---|
| Cost-controlled baseline for CUI collaboration | Microsoft 365 G3 in GCC High + targeted add-ons | Managed identity, device management, labeling, DLP, selective AI rollout |
| Stronger all-in-one security/compliance posture | Microsoft 365 G5 in GCC High | Deeper Purview and advanced audit without piecemeal add-ons |
| Copilot pilot in government cloud | Eligible GCC High base plan + Copilot add-on | Copilot is available as an add-on to eligible government plans including G3/G5 |
| Advanced investigations / longer audit retention | Add Audit Premium and eDiscovery-capable licensing | Purview Audit Premium benefits are tied to appropriately licensed users |
Secure configuration patterns
Start with tenant separation and scope discipline. Keep commercial and GCC High tenants logically separate, or build a clearly described CUI enclave model with labeled sites, restricted sharing, device requirements, and approved AI entry points.
Implement Conditional Access as the Zero Trust policy engine: require MFA, require managed/compliant devices for scoped apps, and use Conditional Access App Control where appropriate to monitor and restrict risky session behaviors.
Publish a strict label taxonomy before wide AI enablement. A useful starting model is Public, Internal, FCI, CUI, CUI Restricted. The last label creates an explicit technical option to exclude especially sensitive content from AI processing.
Use Purview DLP aggressively for AI. Copilot DLP policies can block sensitive prompts, block external web-search grounding when prompts contain sensitive information, exclude sensitivity-labeled files and emails from Copilot processing, and exclude external emails from grounding to reduce prompt-injection risk. Note: DLP cannot scan the contents of files uploaded directly into prompts — only the typed prompt text.
Execute-AzureAdLabelSyncSearch-UnifiedAuditLog \
-StartDate "2026-07-01 00:00:00" \
-EndDate "2026-07-17 23:59:59" \
-SessionCommand ReturnLargeSetSet-Label -Identity "CUI Restricted" \
-AdvancedSettings @{BlockContentAnalysisServices="True"}Microsoft implementation checklist
- Separate the defense/CUI tenant or enclave from commercial collaboration workflows
- Require MFA and managed-device access for scoped users and scoped apps
- Publish labels for Public, Internal, FCI, CUI, and CUI Restricted
- Enable label support for SharePoint and OneDrive files
- Configure Copilot DLP for prompts, web-search blocking, labeled-file exclusion, and external-email exclusion
- Onboard all in-scope endpoints to Defender for Endpoint
- Turn on Defender for Cloud Apps shadow-IT discovery and create session policies
- Enable Audit and validate search permissions
- Create retention policies for high-value collaboration locations
- Document all AI services, connectors, and model endpoints in the SSP and vendor inventory
- Prohibit preview AI features for CUI unless explicitly approved after testing
- Decide whether any label needs BlockContentAnalysisServices=True
Technology alone will not keep AI use compliant.
Your AI governance package should include acceptable use, procurement, prompt handling, human review, and incident response documents from the start. The AI procurement policy should treat AI services like scoped external systems — approved-provider lists, third-party inventory, procurement due diligence, and IR planning for third-party AI technologies.
Vendor assessment checklist
| Question | Why it matters |
|---|---|
| Does the service process, store, transmit, or ground on FCI/CUI? | Determines scope and whether CSP rules apply |
| Is the service in a government cloud or other approved boundary? | Region and sovereignty affect contract fit |
| Are prompts, completions, uploads, and embeddings used for training? | Training restrictions are not the same as zero retention |
| What retention exists for prompts, completions, threads, vectors, stored completions, and logs? | Stateful features can silently expand exposure |
| Is abuse monitoring enabled, and can logging/retention be modified? | Some enterprise services still keep flagged samples for review |
| Are preview features in use? | Preview features may not match full compliance commitments |
| What connectors or plugins can the service access? | Agents and connectors expand attack and disclosure surface |
| Can the vendor support audit, incident response, and legal hold? | You need evidence after a disclosure or investigation |
| Do terms prohibit unilateral reuse of customer data for training? | FTC guidance makes this a material diligence issue |
| Will the vendor contractually notify you of serious incidents or material feature changes? | NIST recommends third-party incident and change controls |
Prompt-handling rules
- Never enter CUI, controlled technical information, source code, export-controlled data, proposal pricing, or customer-confidential material into an unapproved AI tool
- Use only approved AI entry points for contract work
- Summarize the problem, not the document, unless the document is in an approved boundary and labeled appropriately
- Replace organization, program, platform, and person names with generic placeholders unless the workflow is approved
- Do not upload files directly into prompts unless the approved workflow explicitly covers direct file uploads
- Treat any AI output as draft assistance — not evidence, policy, engineering truth, or legal interpretation
- For code, never merge generated output without human review, dependency review, and repository controls
Role-based training curriculum
| Audience | Core module | Practical outcomes |
|---|---|---|
| Executives & founders | AI governance in CUI environments | Approve risk appetite, budget, vendor gates, and escalation rules |
| Program managers & contracts staff | FCI/CUI recognition and AI approval paths | Know when a workflow is automatically out of bounds |
| Researchers & engineers | Coding, prompt injection, file handling, citation review | Stop data leakage and reduce trust in unchecked AI output |
| IT & security admins | Tenant architecture, DLP, labels, CA, audit, IR | Build controls and evidence, not just policies |
| Help desk & operations | User support, blocked workflows, escalation triggers | Route potential AI incidents quickly |
| Subcontractor-facing staff | Flow-down expectations and data-sharing limits | Prevent third-party leakage and boundary confusion |
Incident-response playbook for AI disclosures
An AI disclosure should be treated as a security incident candidate, not a training violation. NIST SP 800-171 requires an operational incident-handling capability, and DFARS 252.204-7012 requires rapid reporting within 72 hours, plus preservation of affected system images and monitoring data for at least 90 days.
- 01
Detect & preserve
Capture the prompt, output, user, timestamp, tool, connector path, device, and any affected files or URLs. Pull relevant Purview and endpoint logs immediately.
- 02
Classify the data
Determine whether the incident involved Public, Internal, FCI, CUI, controlled technical information, export-controlled information, or proprietary subcontractor/customer data.
- 03
Contain
Disable the user's access, revoke sessions, disable the connector, quarantine the file/location, and block the app if it is unmanaged or unsanctioned.
- 04
Assess contractual reporting
If covered defense information or a covered contractor system may have been compromised, evaluate DFARS 72-hour reporting obligations with leadership and counsel.
- 05
Remediate
Update DLP, labels, approved-tool lists, or browser controls. Retrain the user group. Record the control failure in your POA&M if warranted.
Policy first. Controls second. Rollout third.
The Department's own preparation guidance emphasizes self-assessment and corrective action, and Microsoft's DLP guidance warns against rushed deployments that reduce adoption. The roadmap below is deliberately staged.
Boundary & interim policy
- Publish a one-page interim acceptable-use memo
- Stand up an approved-tool register
- Block unmanaged AI access where feasible
- Inventory current AI use by role and browser telemetry
- Classify working data into Public, Internal, FCI, CUI, restricted-from-AI
- Publish initial label taxonomy and first Copilot DLP/CA policies
Enforceable controls & evidence
- Onboard scoped endpoints to Defender for Endpoint
- Enable audit and retention where necessary
- Apply labels to high-value repositories
- Exclude external email and restricted labels from Copilot grounding
- Configure browser/session controls for unmanaged AI apps
- Update SSP, asset inventory, and vendor inventory
Role-based training & validation
- Deliver role-based training (not department-based)
- Tabletop: AI disclosure incident
- Tabletop: prompt injection via external email or retrieved content
- Tabletop: source-code exposure through unapproved assistant
- Revalidate self-assessment and SPRS assumptions
- Readiness review of tenant, labels, DLP, audit, and IR playbooks
AI-safe SOP for researchers & engineers
This SOP explains how to use AI assistance without exposing FCI, CUI, controlled technical information, source code, or other contract-sensitive data.
Applies to all research, engineering, software, analysis, and proposal-support personnel working on government or defense-related work.
Use only organization-approved AI tools and only through approved accounts, devices, and workflows. AI is fine for brainstorming, public-source summarization, formatting help, and low-risk drafting when content is public or demonstrably sanitized.
Do not paste, upload, sync, ground on, or summarize the following in an unapproved AI tool: CUI, FCI, controlled technical information, source code, architecture diagrams, vulnerability details, export-controlled information, customer data, subcontractor data, proposal pricing, or contents from labeled repositories — unless the workflow is explicitly approved.
Ask four questions: Is this defense-related? Does it contain contract-sensitive data? Is the AI tool approved for this data class? Will the output need human technical review before use?
Use placeholders instead of names. Remove program identifiers. Reduce the task to an abstract pattern. If a file is needed, confirm the approved workflow explicitly permits file upload.
Treat all AI output as draft material. Verify citations, calculations, code, and design suggestions before use. Never merge code or publish technical conclusions directly from AI output.
Stop work, do not delete evidence, save the prompt/output context, and report immediately through the organization's incident channel.
Prioritized implementation checklist
- Freeze unmanaged AI for defense work until the approved-tool list exists
- Inventory current AI use by team and browser telemetry
- Classify data and repositories before enabling more AI
- Publish labels and DLP before scaling Copilot
- Put all approved AI systems, connectors, and brokers in the SSP and asset inventory
- Add AI vendor review and change-control clauses to procurement
- Train leaders, admins, engineers, and proposal staff differently
- Run at least one AI disclosure tabletop within 90 days
- Recheck self-assessment evidence and SPRS logic after rollout
Straight answers on CMMC + AI.
Do CMMC and DFARS obligations apply to how I use AI today?
Yes. FCI safeguarding under FAR 52.204-21 and CUI safeguarding under DFARS 252.204-7012 apply to any AI workflow that can process, store, transmit, summarize, or ground on contract data. SSP quality, evidence retention, and the 72-hour cyber-incident reporting obligation follow the data — not the tool — so an AI-connected process needs the same rigor as any other in-scope system.
Can I use ChatGPT or other public AI for defense work?
Treat public LLMs and web chatbots as prohibited for CUI. For FCI, allow them only if your acceptable-use policy explicitly permits sanitized, non-contract-specific use — with browser/DLP controls, no file uploads, no source code, and user attestation.
Do I need GCC High to use Microsoft 365 Copilot with CUI?
Microsoft states that Microsoft 365 Copilot is available in GCC, GCC High, and DoD, and in those environments prompts, responses, and generated content remain in the customer's U.S. government cloud tenant. For CUI use, GCC High (or an equivalent government-cloud boundary) is the appropriate path.
Does encrypting data before sending it to an AI service make me compliant?
No. The Department's CMMC FAQ is explicit that CSPs storing, processing, or transmitting CUI must meet FedRAMP Moderate-equivalent requirements, and that this applies even when CUI is only stored in encrypted form. Encryption in transit is necessary, not sufficient.
How fast must I report an AI-related incident?
DFARS 252.204-7012 requires rapid reporting within 72 hours of discovery of a cyber incident affecting covered contractor systems or covered defense information, and preservation of relevant images and monitoring data for at least 90 days.
What is FedRAMP Moderate-equivalent?
It's the security baseline a non-federal cloud service must meet to store, process, or transmit CUI under DFARS. In practice, most public consumer/enterprise AI SaaS does not carry this posture, which is why CUI-facing AI belongs inside an approved government-cloud boundary or documented enclave.
Which NIST revision does CMMC currently use?
NIST SP 800-171 Rev. 2 is the current CMMC baseline unless a specific contract says otherwise. Rev. 3 exists and future rulemaking is expected, but contractors should map AI controls to Rev. 2 today.
What this guide is grounded in.
Regulatory
- DFARS 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting
- FAR 52.204-21 – Basic Safeguarding of Covered Contractor Information Systems
- 32 CFR Part 170 – Cybersecurity Maturity Model Certification (CMMC) Program
- NARA CUI Registry (archives.gov/cui)
- Department memoranda and CMMC program FAQ (2025–2026)
NIST
- NIST SP 800-171 Rev. 2 – Protecting CUI in Nonfederal Systems
- NIST AI RMF Generative AI Profile (NIST AI 600-1)
- NIST IR 8269 / SP 800-218A / adversarial ML report
- NIST SP 800-61 – Computer Security Incident Handling Guide
Microsoft
- Microsoft 365 Government (GCC, GCC High, DoD) service descriptions
- Microsoft 365 Copilot in government clouds documentation
- Microsoft Purview – Information Protection, DLP, Audit, Retention
- Microsoft Defender for Endpoint & Defender for Cloud Apps
- Microsoft Entra Conditional Access documentation
FTC & other
- FTC guidance on AI companies and consumer data (2023–2025)
- Azure Foundry / OpenAI Service privacy and data-handling documentation
This guide reflects publicly available guidance current at time of writing. Contract language and clause text always control. Confirm licensing and tenant architecture with Microsoft or your licensing partner.