Clarion Street

The Compliance Paradox: Automating CMMC While the Target Keeps Moving

·9 min read

Two CMMC automation products showed up in recent months, and they answer the same question in opposite ways. One is a proposal from IdeaNavigator AI called “Defense security cert.” It reads a contractor’s NIST SP 800-171 self-assessment and writes a draft System Security Plan, a draft POA&M, and an SPRS score, then returns evidence checklists mapped to the 110 controls. The other is Aprio’s CMMC Analyzer, a tool that runs inside a customer’s Microsoft 365, Azure, and AWS environments and continuously checks technical controls, mapping what it finds into the SSP and POA&M as evidence accrues. One is a document generator; the other is a monitoring system. The market has split CMMC automation into two poles, and I would not put a whole budget into either one.

I have written around this question without answering it. The verification mechanism paused while the obligations did not, in the suspension post. The program’s future is a predictability problem, so the only safe planning base is the codified text, in the memo-not-a-rule post. And continuous compliance is a proof problem before it is a tool problem, in the automation gap post. What those three leave open is the buying decision. A contractor who has absorbed all of it still has to decide what to spend money on. The two products above are the market’s two answers, and the useful move is to split them, not to pick one.

The lightweight pole

IdeaNavigator AI is an idea-generation platform, and “Defense security cert” is an idea it generated and then scored. The concept is a readiness workspace: a contractor answers the self-assessment questions, the tool produces a draft SSP, a draft POA&M, and an SPRS score, and it emits evidence checklists mapped to the 110 Level 2 controls. The page is explicit that this is where it stops. The product ships, in its own words, “first as a structured assessment + document generator … rather than full continuous monitoring.”

The company scores the idea the way it scores everything on the platform: 52 out of 100 for validation, with the verdict “Research,” and 44 out of 100 for execution readiness. Its own named bottleneck is worth quoting, because it is the whole problem in one sentence. “Regulatory and timeline risk: phased CMMC rollout details, control set revisions (e.g., NIST 800-171 revisions), and DoD discretion on which solicitations include clauses can shift demand and product scope.”

The market-readiness numbers on the page trace to vendor surveys and cost guides, not to a government dataset. “Only about 1% of the DIB is assessment-ready.” First-cycle Level 2 compliance “commonly runs $75K-$300K+ and 12-18 months.” “Over 118,000 companies” are expected to need Level 2 certification, “roughly 68% … small businesses.” Proposed pricing sits around $5K to $25K a year. The 1% figure is corroborated by the CyberSheath survey I already cited in the suspension post. The rest I would treat as directional vendor claims, not measurements.

SkyPixelTech, an AI-assisted content site, ran an independent read of the same material on October 5 and came back unimpressed. Its verdict: “a product proposal, not an announcement that a service has launched.” The figures “provide no supporting methodology or identified independent dataset … should not be read as verified measurements.” On the generated documents, the verdict is direct: they “would not, by themselves, establish that a company meets CMMC requirements or pass an assessment.” That last line is the part that matters, and it is not a knock on the product. It is a description of what a document generator can and cannot do.

The heavy pole

Aprio sits at the other end. Its CMMC Analyzer is a Microsoft-native tool that continuously scans a customer’s Microsoft 365, Azure, and AWS environments, automatically collects and maps evidence to controls, and produces SSP-ready content. It deploys inside the customer environment, so the evidence never leaves it. Aprio is careful about the boundary the same way IdeaNavigator is, just on the other side of it: the tool is “designed to augment, not replace human validation” and does not substitute for a C3PAO assessment.

Aprio is also a vendor, and its C3PAO services sit right next to its monitoring product. Read it the way I have read the rest of this category, Scrut, LakeRidge, and Deep Fathom. The heavy pole is the continuous-monitoring position, and the company selling it is also the company that would assess you. That does not make the product wrong. It does mean the “heavy automation is the safe answer” line is a vendor narrative, not a neutral one.

The paradox

The general case for automation is worth stating first, because it is the one part of this I agree with. Jeff Ladner, Onspring’s chief product officer, made it in a CSO opinion piece in April: automation is the backbone of scalable CMMC execution, and AI is an enabler rather than a risk multiplier only when it sits inside a governance structure. That framing holds up. The problem is what happens when you apply it to a program whose target keeps moving.

The lightweight pole automates exactly the obligations that are live today. The SSP, the POA&M, the SPRS score, the annual affirmation, the evidence file. Those are cheap to automate, reversible, and required regardless of what the reform report says. But automating them does not establish compliance. A generated SSP is still your assertion. A generated SPRS score is still a number you are putting in front of the government. The False Claims Act exposure the suspension post describes sits on the number and the affirmation, not on the tool that produced them. The lightweight pole leaves that risk exactly where it was.

The heavy pole automates the part that would actually prove something, continuous monitoring of the technical controls, and it is premature. The assessment target is moving. Phase 2 has been suspended since July, the control set itself may shift, NIST SP 800-171 Rev 3 is drafted and sitting in a drawer, and no assessor has been shown to accept machine-generated evidence as control evidence. I have made that last point twice already, in the automation gap post and the compliance fabric post. A continuous-monitoring stack is a bet that the target stays where it is, and the target is the one part of this program that keeps moving.

Neither pole is a safe all-in. One produces paperwork that does not prove compliance. The other ties a heavy investment to a target that is still under reform. The two places automation can actually go are both wrong to commit to right now.

The split

This is the tooling version of the dollar split I wrote about last week. That post sorted spend into certification, controls, and evidence buckets. This one sorts tooling the same way.

Automate the cheap half now. The readiness documents and the evidence organization are where automation pays for itself without betting on the reform. If the report lands and Phase 2 resumes, a current SSP and a defensible evidence file are what you bring to the assessment. If the report lands and certification shrinks, the SPRS score and the affirmation are the representations the government holds against you, and a tool that keeps them accurate is cheap insurance. The lightweight pole is right about this half, and it is right for a reason the vendor did not intend: the cheap half is the half you cannot afford to get wrong.

Keep the expensive half as real security work. Control implementation and continuous monitoring are what an assessor or a government-led assessment actually inspects. No document generator fakes them, and no monitoring tool makes them unnecessary. The 110 controls are live today under DFARS 252.204-7012 regardless of the suspension. Spend on them as security, not as compliance theater, and do not outsource the thinking to a scanner.

Refuse to buy a rigid stack built for a target that is still moving. Continuous-monitoring automation is a capability to build toward, not a stack to lock in. The reform report is still unpublished, sitting in interagency review, and the Cyber AB’s “back half of October” date is an estimate, not a commitment. Until the instrument that makes the next target real actually publishes, a rule, a deviation, or a Part 170 amendment, treat heavy automation as something you assemble from the controls you already run, not something you sign a multi-year contract for.

What I am not claiming

A few boundaries, because the honest version of this is narrower than the sales version.

IdeaNavigator is a meta-artifact. An idea platform proposed a CMMC tool and scored its own idea 44 out of 100. Citing it as proof that lightweight readiness automation is a real, validated product category would be wrong. It is evidence that the category is being proposed faster than it is being proven, which is exactly the paradox. SkyPixelTech, the counterpoint, is also AI-assisted content, so it is a second datapoint, not an authority.

The “continuous monitoring is still in force” framing needs precision. What is live is the annual affirmation, the SPRS self-assessment, and the ongoing-monitoring control CA.L2-3.12.3, enforced through self-assessment and selected government-led assessments. That is not a literal always-on monitoring mandate imposed by the suspension itself. The obligations are real. The suspension did not create an always-on tooling mandate.

The reform report is not public. Anything said about what a reformed program will look like, continuous monitoring, risk scoring, compliance-as-code, hybrid assessment, is speculation by the Cyber AB and others, and they have said as much. Do not build against a forecast.

None of this is a reason to stand down. The obligations that survived the pause are real and enforceable, and the tools that keep the cheap half honest are worth the money now. The reason to hold off on the heavy half is that it is a bet on a target that has moved twice, and you do not lock a multi-year contract to a target that is still being argued about.

Sources

  1. IdeaNavigator AI — Defense security cert idea page (Jul 14, 2026)
  2. IdeaNavigator AI — Execution Scorecard: Defense security cert
  3. Aprio — CMMC Compliance Automation: SSP, POA&M, and Continuous Monitoring (Jun 23, 2026)
  4. SkyPixelTech — Support Your DIB Compliance Program With SaaS Automation (Oct 5, 2026)
  5. CSO Online — CMMC compliance in the age of AI (Jeff Ladner, Onspring)
  6. Department of War — DoW Suspends CMMC Phase II Requirements (Jul 13, 2026)
  7. DoW CIO — About CMMC
  8. Automata — CMMC Phase 2 suspended: what contractors still owe
  9. Overwatch Tools — What a Task Force Report Can and Cannot Change (Oct 5, 2026)
  10. CMMC.com — September 2026 Cyber AB Town Hall Recap
  11. Ntelsec — The Vault Brief: The reform report is written (Oct 5, 2026)