Trust & Compliance / CMMC 2.0
CMMC 2.0 compliance for CUI, enforced at the data layer.
XQ helps defense contractors meet CMMC 2.0 Level 2 and Level 3 by encrypting every piece of Controlled Unclassified Information (CUI) with customer-held keys, enforcing access policy each time it is opened, and logging every access — so CUI stays protected in commercial Microsoft 365, cloud storage and supply-chain workflows.
Built for Defense contractors and subcontractors handling CUI · MSPs serving the Defense Industrial Base · CISOs and compliance leads preparing for a C3PAO assessment
At a glance
FrameworkCMMC 2.0 (32 CFR Part 170), Levels 1–3
ProtectsCUI and FCI in email, files, chat, forms and cloud
Runs inCommercial Microsoft 365, AWS, hybrid and on-premises
EvidenceSigned, per-object audit trail with SIEM export
Works with Microsoft 365 · Outlook · SharePoint · OneDrive · Active Directory · Gmail · AWS · Splunk · QRadar
Pass your C3PAO assessment
Enforce — and evidence — the access-control and audit requirements assessors test, object by object.
Stay on commercial Microsoft 365
Enclave CUI inside your existing tenant instead of migrating everyone to GCC High.
Share CUI across your supply chain
Primes, subcontractors and partners open only what policy allows, and you can revoke it at any time.
We overlayed XQ’s Zero Trust Data Protection Platform, which achieved end-to-end encryption and persistent policy control of Controlled Unclassified Information (CUI) across email and file workflows. This enhanced level of protection was exactly what we needed — and enhanced our security as we passed the C3PAO assessment.
Chris Haigh, Certified CMMC Assessor, Professional and Instructor, Meerkat Cyber
What CMMC 2.0 requires
The Cybersecurity Maturity Model Certification (CMMC) is the Department of Defense program, codified at 32 CFR Part 170, that verifies how contractors in the Defense Industrial Base protect Federal Contract Information (FCI) and CUI. Primes flow the requirement down, so subcontractors and vendors need a CMMC status to keep bidding.
| Level | Applies to | Requirements and assessment |
|---|---|---|
| Level 1 | Contractors handling FCI | Basic safeguarding requirements; annual self-assessment posted to SPRS. |
| Level 2 | Contractors handling CUI — most DoD contracts | The 110 security requirements of NIST SP 800-171; most contracts require a triennial assessment by a Certified Third-Party Assessor Organization (C3PAO). |
| Level 3 | CUI on the highest-priority programs | Level 2 plus selected NIST SP 800-172 requirements against advanced persistent threats; government-led assessment. |
Level 2 builds on the safeguards contractors already owe under DFARS 252.204-7012, and it is the level most organizations handling CUI must reach. Certification typically takes months, so organizations bidding on DoD work should start well before the solicitation.
How XQ covers CMMC controls
Network controls stop applying the moment CUI is emailed to a subcontractor or synced to another cloud. XQ binds protection to each data object instead, so the controls assessors test keep working wherever the CUI travels.
| Requirement family | How XQ addresses it |
|---|---|
| Access Control | Each file, email and record is encrypted with its own key; keys are released only to authenticated, authorized users under RBAC, ABAC and geofencing policy evaluated at the moment of access. |
| Audit & Accountability | Every access attempt — including denied ones — is logged with who, when and where, in an immutable, HMAC-signed trail that exports to SIEMs such as Splunk and QRadar. |
| System & Communications Protection | Object-level AES-256 encryption protects CUI at rest and in transit across email, file sharing, chat, forms and cloud transfer, with customer-held keys the cloud provider never sees. |
| Media Protection & data lifecycle | Access can be revoked, expired or reprovisioned per object at any time — even after the data has left your environment. |
| Identification of CUI | AI-powered classification labels CUI categories at ingestion and maps them to NIST SP 800-171 controls; DLP rules enforce protection automatically before CUI is sent. |
See how XQ maps to the controls your assessor will test.
Stay in commercial Microsoft 365
XQ creates a secure enclave around CUI inside the tools your teams already use, as an alternative to moving the whole organization to Microsoft GCC High:
- Enclave emails and files directly within commercial Microsoft 365, Outlook and OneDrive.
- Sync users and security groups from Active Directory, and folders from SharePoint.
- Deploy selectively — only the users and workflows that touch CUI.
- Keep existing email addresses and workflows; no tenant migration.
- Extend protection to primes, subcontractors and mission partners without giving them access to your environment.
Evidence for your C3PAO assessment
Assessors ask for proof, not policy. XQ records the chain of custody for every CUI object — where it went, who opened it, and every denied attempt — and exports those events to your SIEM or for offline review, giving you control-by-control evidence for access control and audit requirements.
Related resources and articles
- ITAR and CMMC Level 2 on GCC Moderate: Implementation Plan
- Defense & Sovereignty solutions
- NIST SP 800-171 and CUI protection
- CMMC Assessment Postmortem with Chris Haigh of C3PAO Meerkat Cyber
- Meerkat Cyber Achieves C3PAO Certification from the DoD Using XQ Zero Trust Data Protection Platform
- How MSPs Can Streamline CMMC Compliance with XQ Data Protection Policies
- New CMMC Rule: Treatment of Controlled Unclassified Information (CUI) in Transit
FAQ
CMMC 2.0, answered directly.
Does XQ help organizations meet CMMC 2.0 Level 2?
Yes. XQ enforces the data-level safeguards Level 2 depends on — object-level encryption of CUI, access control evaluated at decryption, and a complete audit trail — across email, files and cloud, and maps its CUI classification to NIST SP 800-171 controls.
Can we reach CMMC Level 2 without moving to Microsoft GCC High?
XQ is designed as an alternative for organizations that want to stay on commercial Microsoft 365: it enclaves CUI emails and files inside your existing tenant, syncs with Active Directory and SharePoint, and deploys only to the users who handle CUI.
Does XQ cover all 110 CMMC Level 2 requirements?
No single product does. Many of the 110 requirements are policies, procedures and training your organization completes, often with an MSP or Registered Practitioner Organization (RPO). XQ — including alongside Microsoft 365 Business Premium — addresses the technical requirements that depend on protecting, controlling and auditing CUI, and supplies the evidence for them.
How does XQ protect CUI shared with subcontractors?
Protection travels with the data. Each shared object stays encrypted, and your policy decides who can open it, from where and until when — you can revoke a subcontractor's access at any time, even after the file has been delivered.
What evidence does XQ provide for a CMMC assessment?
An immutable, HMAC-signed log of every access attempt on every CUI object — who, when, where and whether it was allowed — exportable to SIEMs such as Splunk and QRadar or for offline review.
Does XQ work in disconnected environments?
Yes. XQ keeps policy enforcement running in disconnected, intermittent and limited-bandwidth (DDIL) environments such as the tactical edge.
Preparing for a CMMC assessment?
Talk to our team about protecting CUI in your current environment and the evidence your assessor will ask for.