CMMC AI Compliance: Applying the Access Control and Audit Families to LLM Traffic Handling CUI
The CMMC Program, established by the DoD final rule at 32 CFR Part 170 effective December 16, 2024, requires defense contractors handling Controlled Unclassified Information to meet the NIST SP 800-171 controls, with Level 2 assessed against those requirements. The Access Control and Audit and Accountability families apply directly when a contractor employee or agent sends CUI into an LLM prompt. This piece walks the 800-171 control families that land on AI inference traffic, where standard controls miss it, and how to enforce access and produce the audit record an assessor samples.
The Cybersecurity Maturity Model Certification program, established by the DoD final rule at 32 CFR Part 170 effective December 16, 2024, requires a defense contractor handling Controlled Unclassified Information to meet the NIST SP 800-171 security requirements, with a Level 2 assessment measured directly against them. Program details are published by the DoD Chief Information Officer. The 800-171 controls predate the current wave of LLM adoption, and two of their control families apply the instant an engineer on a defense program pastes CUI into a model prompt: Access Control and Audit and Accountability. I want to walk those families as they land on AI traffic and show where a contractor's existing controls stop short of the prompt.
The 800-171 families that touch AI traffic
Two of the NIST SP 800-171 control families apply squarely to prompts carrying CUI.
Access Control (3.1). The family requires limiting system access to authorized users and to the transactions those users are permitted to execute, and controlling the flow of CUI. A model endpoint that any cleared employee can send any CUI to does not control that flow, because access to the AI channel is not scoped to the specific data a role may transmit.
Audit and Accountability (3.3). The family requires creating and retaining audit records sufficient to trace actions to individual users and to monitor for unauthorized activity. An audit record of AI usage that cannot show which user sent which CUI to which model fails the traceability that this family sets.
The rest of the 800-171 families still apply to the surrounding system. These two are where AI request traffic lives.
Where a contractor's existing controls miss the AI channel
A defense contractor with a mature 800-171 posture usually still has a gap on AI traffic. Access control is enforced on file shares, applications, and networks, and the enumeration of permitted transactions rarely includes which roles may send which CUI to which model. Audit logging captures authentication events and file access, and the content of a prompt is not among the events collected. Boundary protection inspects traffic, and a prompt leaves as an encrypted API call whose payload is not parsed. The controls are real and the AI prompt travels through a seam between them, carrying CUI that the assessor will absolutely ask about.
The access and audit decision CMMC requires
Meeting the Access Control and Audit families for AI traffic means deciding, per request, whether a caller may send this CUI to this model, and recording the decision so it traces to the individual. That decision runs on the request path before the prompt leaves the boundary. A policy decision point in front of the model evaluates each call and commits a record:
That record satisfies the flow-control expectation in the Access Control family (the transmission was evaluated and blocked) and the traceability expectation in the Audit and Accountability family (the action traces to a named user with full context). An assessor sampling AI usage during a Level 2 assessment can read it directly.
Why the audit record has to be independent
The Audit and Accountability family exists so that unauthorized activity can be detected and traced after the fact, which assumes the record is trustworthy. A log written by the same AI application that made the decision is self-attested, and it can be selectively written or lost if the application crashes after the model responds but before the log commits. A record produced independently on the traffic, before the response returns, holds up during an assessment and during an incident investigation. For a program where a single CUI spill can cost a contract, I would not let the tool that made the call also be the only witness to it. Related government coverage sits in government FedRAMP AI compliance and AI data residency controls.
DeepInspect
This is the gap DeepInspect closes for defense contractors. DeepInspect is a stateless proxy that sits inline in front of your AI traffic and is model-agnostic, so one layer covers commercial APIs like OpenAI and Anthropic, cloud models on Bedrock and Vertex, and self-hosted endpoints inside your boundary. For every request it evaluates the caller identity and role, the data classification in the prompt, and organizational policy, then returns a pass or block decision before the traffic reaches the model. Enforcement adds under 50 milliseconds in internal testing, and the default on ambiguity is deny, which matches the flow-control posture the Access Control family sets for CUI.
For every decision it commits an identity-bound audit record before the response returns, written independently of the calling application. That record gives a CMMC assessor the access and audit evidence the 800-171 families require on the AI channel that boundary and file-level controls do not parse. DeepInspect does not replace your System Security Plan or your 800-171 implementation. It enforces the Access Control and Audit families on the traffic where CUI reaches a model. Book a technical deep dive at deepinspect.ai.
Frequently asked questions
- Does CMMC apply to AI tools that handle CUI?
Yes, CMMC assesses a contractor against the NIST SP 800-171 requirements, and the Access Control and Audit and Accountability families apply whenever CUI moves, including when it moves into an LLM prompt. The model endpoint receiving CUI is inside the scope those families govern.
- Which 800-171 families apply to LLM traffic?
Access Control (3.1), which requires controlling the flow of CUI and limiting permitted transactions, and Audit and Accountability (3.3), which requires records that trace actions to individual users. Other families govern the surrounding system, but these two land on the AI request itself.
- Why do existing 800-171 controls miss AI prompts?
Access control and audit logging are typically enforced on files, applications, and networks. A prompt leaves as an encrypted API call whose payload is not parsed, so which user sent which CUI to which model is not captured by the controls a contractor already runs.
- What audit record does a CMMC assessor expect for AI usage?
A record that traces the action to an individual user with enough context to detect unauthorized activity, meaning who sent which CUI to which model under which policy. A generic log that an AI tool ran does not meet the traceability the Audit and Accountability family requires.
- Can application logs satisfy the CMMC audit requirement for AI?
They usually fall short, because they lack CUI classification and are written by the same system that made the AI decision. An independent, identity-bound record produced on the traffic before the response returns is the stronger evidence for the Audit and Accountability family.