CUI in a prompt is CUI in someone else's data center.
Defense primes, tier-2 integrators, and the 80,000+ DIB SMBs handling CUI use 1331 so proposal teams, engineering, and BD can use AI without an FSO conversation or a CMMC finding.
“Contractors processing Controlled Unclassified Information shall implement the security requirements of NIST SP 800-171 within their assessed boundary; export-controlled technical data shall not be released to foreign persons or foreign-controlled infrastructure absent authorization.”
A prompt containing spec language, drawings, or contract performance data sent to a commercial AI endpoint is, simultaneously, a CMMC boundary violation and a potential ITAR export. The FY2026 NDAA directs DoD to publish an AI security framework for the DIB — CMMC-for-AI is arriving and primes are already cascading the clauses into Tier-2/3 subs.
“A proposal manager pasted spec language into Claude to tighten a Section L response. Our FSO found out from a SIEM rule. We now have a stop-work on every AI tool until we can prove the next one stays inside the boundary.”
The only posture an FSO and a CMMC assessor will accept on the first pass: a physical appliance inside the assessed boundary, with no outbound connectivity required. Updates apply via signed offline bundle.
Compliance by architecture, not by contract footnote.
Air-gap-compatible appliance
Runs inside your CMMC boundary with zero required outbound connectivity. Signed offline update bundles ship on schedule; the box never has to call home.
Open-weight models, US supply chain
Llama, Mistral, Qwen and other open-weight model files are loaded from signed bundles. No foreign-controlled API in the inference path; no foreign-person access via vendor support.
Per-program access scoping
API keys, agents, and audit logs scope to a program identifier. Proposal team for Program A cannot see prompts or completions from Program B — supports need-to-know enforcement out of the box.
NIST 800-171 evidence pack
Pre-mapped artifacts for AC, AU, CM, IA, SC, and SI families — the controls a CMMC assessor will ask about for AI tooling. Saves your SCA team weeks of new policy authoring.
The decision is rarely one person.
We've built collateral for each seat at the table — from the GC reading the bulletin to the platform lead writing the diagram.
The CMMC boundary is the answer. Everything else is a finding.
1331 gives an FSO an appliance that fits in the existing security plan, a CISO a SIEM feed showing zero outbound model traffic, and a BD lead a working AI workflow for proposal writing — same week, no waiver.