CMMC (Cybersecurity Maturity Model Certification) and ITAR (International Traffic in Arms Regulations) compliance software must enforce two distinct but overlapping regulatory frameworks that govern how defense contractors handle sensitive data. CMMC requires contractors handling CUI (Controlled Unclassified Information) to implement 110 security practices across 14 domains at Level 2, with third-party assessment required for contracts involving CUI starting in 2026. ITAR requires any company manufacturing, exporting, or brokering defense articles on the United States Munitions List to restrict technical data access exclusively to U.S. persons, with civil penalties up to $500,000 per violation and criminal penalties up to $1 million and 20 years imprisonment.
Most defense contractors need both frameworks simultaneously. The overlap creates a compound compliance problem: CMMC governs how you protect CUI across your entire IT environment, while ITAR governs who can see specific technical data regardless of how well your environment is secured. A perfectly CMMC-compliant system that allows a non-U.S. person to view ITAR-controlled drawings violates ITAR. An ITAR-compliant access control system that does not log access attempts or encrypt data at rest fails CMMC. The two frameworks reinforce each other in some areas (encryption, access control, audit logging) and diverge in others (ITAR's citizenship-based access has no CMMC equivalent, and CMMC's incident response requirements go beyond ITAR's scope).
What does CMMC Level 2 require for defense contractor software systems?
CMMC Level 2 maps directly to the 110 security requirements in NIST SP 800-171 Revision 2, organized across 14 domains: Access Control (22 requirements), Awareness and Training (3), Audit and Accountability (9), Configuration Management (9), Identification and Authentication (11), Incident Response (3), Maintenance (6), Media Protection (9), Personnel Security (2), Physical Protection (6), Risk Assessment (3), Security Assessment (4), System and Communications Protection (16), and System and Information Integrity (7). Every requirement must be fully implemented, not partially, for the contractor to pass a C3PAO (CMMC Third-Party Assessment Organization) assessment.
The requirements that most directly affect custom software systems include: multi-factor authentication for all users accessing CUI (3.5.3), encryption of CUI at rest and in transit using FIPS-validated cryptography (3.13.11, 3.13.8), audit logging of all access to CUI with timestamps, user IDs, and event descriptions retained for at least three years (3.3.1, 3.3.2), session lock after 15 minutes of inactivity (3.1.10), role-based access control that limits CUI access to authorized users with a legitimate need (3.1.1, 3.1.2), separation of duties so no single user can perform all critical functions (3.1.4), and system monitoring that detects and alerts on unauthorized access attempts (3.14.6, 3.14.7).
The assessment process requires evidence artifacts for every requirement: not just a policy document stating the requirement exists, but proof that the control is implemented, operational, and effective. For software systems, this means the assessor reviews actual system configurations, audit log samples, access control lists, encryption settings, and incident response records. A System Security Plan (SSP) documents how each requirement is met, and a Plan of Action and Milestones (POA&M) documents any gaps with remediation timelines. POA&Ms are permitted for a limited number of non-critical requirements, but the 2026 rule tightened the window: contractors must close POA&M items within 180 days of assessment.
What does ITAR require for software that handles technical data?
ITAR's core requirement is straightforward in principle and complex in implementation: technical data related to defense articles on the USML may only be accessed by U.S. persons. A "U.S. person" is defined as a U.S. citizen, a lawful permanent resident (green card holder), or a protected individual (refugee or asylee). Everyone else, including H-1B visa holders, L-1 visa holders, and foreign nationals of allied countries, is a non-U.S. person under ITAR and cannot access controlled technical data without a State Department-approved export license or a specific exemption.
For software systems, ITAR access control means every user account must be tagged with a verified citizenship status. The verification cannot rely on self-attestation alone; the contractor must have a documented process for verifying citizenship through I-9 documentation, passport verification, or equivalent HR records. The software system must then enforce access restrictions based on this verified status: ITAR-controlled documents, drawings, specifications, test data, and manufacturing processes are visible only to users whose accounts are flagged as U.S. persons. This restriction applies at every layer: the file system, the application interface, search results, email attachments, shared drives, and any export or print function.
The "deemed export" rule extends ITAR to domestic access. If a non-U.S. person employed at the contractor's facility views ITAR-controlled technical data on a colleague's screen, that constitutes a deemed export, the same violation as shipping the data to a foreign country. Software systems must prevent this through physical access controls (badge access to ITAR work areas), logical access controls (ITAR data inaccessible from non-ITAR workstations), and display controls (screen privacy filters, clean-desk policies enforced by system timeout).
Where do CMMC and ITAR overlap and where do they diverge?
The overlap is substantial in three areas. First, both require encryption: CMMC mandates FIPS-validated cryptography for CUI at rest and in transit, and ITAR requires encryption for technical data transmitted electronically (the State Department's guidance references NIST standards). A system that meets CMMC's encryption requirements generally satisfies ITAR's encryption expectations. Second, both require access control: CMMC requires role-based access limited to authorized users, and ITAR requires citizenship-based access limited to U.S. persons. Implementing both means a dual-layer access control system where access requires both role authorization AND citizenship verification. Third, both require audit logging: CMMC specifies detailed event logging with retention, and ITAR requires the ability to demonstrate that access controls were enforced (which effectively requires logging).
The divergence matters in four areas. First, ITAR's citizenship-based access control has no CMMC equivalent: CMMC does not care whether a user is a U.S. person, only whether they are authorized and authenticated. Second, CMMC's incident response requirements (detect, report, respond to incidents within defined timelines) go beyond anything ITAR explicitly requires. Third, CMMC requires continuous monitoring and vulnerability scanning; ITAR has no equivalent technical monitoring requirement. Fourth, ITAR's scope includes physical items and manufacturing processes, not just information systems; CMMC is purely an information security framework. A contractor building missile components needs ITAR controls over the shop floor and shipping, not just the document management system.
What do off-the-shelf compliance platforms actually cover?
Compliance platforms like Exostar, CMMC+, Coalfire's compliance management tools, and newer entrants like Summit 7 and Fortreum primarily handle the assessment preparation and documentation workflow. They provide: SSP templates mapped to NIST 800-171 controls, POA&M tracking with remediation timelines, evidence collection workflows where teams upload screenshots, configuration exports, and policy documents, pre-assessment gap analysis that identifies which of the 110 requirements are met versus unmet, and dashboards showing overall compliance posture across the 14 domains.
What these platforms do not do is enforce compliance inside the contractor's actual operational systems. They track whether the access control requirement is documented, but they do not implement access control in the contractor's engineering PDM system. They track whether encryption is documented, but they do not encrypt the contractor's technical data. They track whether audit logging is documented, but they do not generate the audit logs. The compliance platform tells you what you need to do; custom compliance software does it. For a defense contractor with 50 engineers, 200,000 technical drawings, and active ITAR and CMMC obligations, the gap between "documented" and "enforced" is where violations happen.
What does custom CMMC and ITAR compliance software include?
Custom compliance software builds enforcement directly into the systems where controlled data lives and moves. The core modules address the areas where off-the-shelf platforms stop.
Document management with automatic CUI marking applies CMMC's marking requirements at the point of creation. When an engineer creates or uploads a document, the system classifies it based on project association, content keywords, and metadata tags. Documents associated with ITAR-controlled programs receive automatic distribution statements ("Distribution authorized to U.S. Government agencies and their contractors") and CUI banners. The marking follows the document through every export, print, and email. If a user attempts to email a CUI-marked document to an external address without an approved encryption method, the system blocks the transmission and logs the attempt.
Project management with citizenship-gated visibility restricts what users can see based on their verified citizenship status and program assignment. A non-U.S. person assigned to a commercial (non-ITAR) program sees their tasks, documents, and communications. They do not see ITAR-controlled programs in the project list, cannot search for ITAR documents, and cannot be assigned to ITAR tasks. The system enforces this at the database query level, not just the UI level: even if the user constructs a direct API call or URL, the server rejects the request and logs the unauthorized access attempt.
Engineering collaboration tools with need-to-know enforcement go beyond role-based access. Even among U.S. persons, ITAR access is restricted to those with a need-to-know for their specific program. An engineer cleared for Program A cannot access Program B's technical data without explicit authorization from Program B's security officer. The system manages these authorizations as program-level access lists, separate from organizational role assignments. When an engineer transfers from Program A to Program B, their Program A access is revoked and Program B access is granted, with the transition logged and the revoking authority identified.
Audit trail generation produces the evidence artifacts that CMMC assessors and DDTC (Directorate of Defense Trade Controls) auditors require. The system generates assessment-ready reports: access control lists by program and user, all access events for a specified date range, all failed access attempts (unauthorized users attempting to reach controlled data), all CUI markings applied and modified, all data exports and transmissions with recipient verification, and all user provisioning and deprovisioning events with approving authority. These reports map directly to NIST 800-171 control numbers so the assessor can verify each requirement against concrete system evidence.
How does CMMC compliance software handle the supply chain?
CMMC's flow-down requirement means that every subcontractor handling CUI must also achieve the appropriate CMMC level. For a prime contractor managing 20-50 subcontractors, this creates a supply chain compliance problem that off-the-shelf tools do not fully address. Custom compliance software manages the subcontractor compliance lifecycle: onboarding questionnaires that assess the subcontractor's current CMMC readiness, secure data exchange portals that enforce CUI handling requirements for shared technical data, subcontractor compliance status tracking with automated reminders for expiring certifications, and data flow mapping that documents which CUI flows to which subcontractors and through which channels.
The secure data exchange component is particularly critical. When a prime shares CUI with a subcontractor, the transmission must be encrypted, the receipt must be logged, and the subcontractor's access must be restricted to the specific data package they need for their scope of work. Standard file-sharing tools (SharePoint, Dropbox, even Microsoft GCC High) provide the encryption layer but do not enforce the data package scoping or the receipt logging at the granularity CMMC assessors expect. Custom portals build the scoping, logging, and access expiration directly into the exchange workflow.
When should a defense contractor build custom compliance software instead of buying?
Off-the-shelf compliance platforms work well for contractors whose primary need is assessment preparation and documentation. A contractor with 10 employees, one ITAR program, and a straightforward IT environment (Microsoft GCC High, a single PDM system, a simple network architecture) can likely meet CMMC Level 2 and ITAR requirements using commercial tools: Microsoft GCC High for email and document storage, a compliance platform for SSP and POA&M management, and manual procedures for ITAR access control (physical badge access, manually maintained access lists).
Custom compliance software becomes necessary when: the contractor manages multiple ITAR programs with different access populations (the need-to-know boundaries cannot be enforced manually at scale), the engineering team exceeds 30-50 people (manual access control reviews become unreliable), the technical data volume exceeds what a simple folder-permission model can handle (200,000+ documents across multiple PDM systems, file shares, and collaboration tools), subcontractor data exchange is frequent and involves CUI (monthly or more often, to 10+ subcontractors), or the contractor's operational systems (ERP, MES, project management) handle CUI alongside non-controlled data and need automated classification and access enforcement.
The cost comparison: Microsoft GCC High runs $35/user/month. A compliance platform runs $500-$2,000/month. Manual compliance management (the ISSO's time, spreadsheet tracking, manual access reviews) costs 0.5-1.0 FTE. That model works until scale breaks it. Custom compliance software runs $150,000-$400,000 to build and $3,000-$8,000/month to maintain. For a contractor with 100+ employees, 5+ ITAR programs, and active CMMC obligations, the custom system pays for itself in avoided violations (a single ITAR violation costs more than the entire custom system) and reduced ISSO labor.
How does Madgeek build compliance software for regulated industries?
Madgeek builds custom enterprise software for organizations where compliance is not a checkbox but an operational requirement woven into every system interaction. The Tejas Networks enterprise platform demonstrates this pattern: multi-level approval workflows that enforce process compliance, immutable audit trails that capture every action with full attribution, role-based access controls that restrict data visibility by function, and structured data handling that prevents unauthorized access or modification. That platform reduced paper-based approval processes by 90% while maintaining complete auditability, exactly the trade-off defense contractors face: streamlined operations that do not compromise compliance.
CMMC and ITAR compliance software projects start with a control mapping phase: mapping every NIST 800-171 requirement and ITAR obligation to the specific systems where enforcement must occur, identifying which controls are already met by existing infrastructure (GCC High, firewall configurations, endpoint management), and designing the custom software modules that fill the enforcement gaps. Development runs $150,000-$400,000 depending on the number of ITAR programs, the complexity of the subcontractor data exchange requirements, and the number of operational systems (ERP, PDM, MES, project management) that need compliance enforcement integrated into their workflows.
Need a team to build this for your business?