Clarion Street

Open-Source CUI Enclaves: The End of the Compliance Black Box?

·2 min read

CMMC requirements are in limbo. On July 13, 2026, the Department of War (DoW) suspended CMMC Phase II to allow a 60-day review by a new Reform Task Force. The goal is to align certification with the Acquisition Transformation System (ATS) and reduce the compliance burden on smaller businesses.

This suspension does not change existing obligations. Defense contractors must still follow NIST SP 800-171 Rev 2, perform self-assessments, and report scores to the SPRS. For contractors, the current regulatory ambiguity creates significant operational friction.

Open-CMMC, an open-source fork of Filebrowser from Trout Software, is a technical response to this shift. It moves away from the proprietary enclave model. Rather than relying on vendor assertions about security, Open-CMMC uses a “compliance-as-code” approach that makes security controls inspectable.

If a C3PAO assessor needs to verify AES-256-GCM encryption, OIDC authentication, or audit chain integrity, they can examine the source code directly. This provides programmatic proof instead of a vendor’s guarantee.

Open-CMMC covers approximately 72 of the 110 NIST 800-171 Rev 2 controls through its codebase. The remaining 38 controls typically require contractor management of policies, physical security, or host-layer protections.

Implementing an open-source enclave is more demanding than using a turnkey SaaS product. It requires managing a Linux host, such as RHEL or AlmaLinux, configuring FIPS modes, and potentially integrating a Wazuh stack for monitoring. This is a deliberate trade-off: you exchange the convenience of a proprietary product for the verifiability of open source.

The CMMC Reform Task Force will likely issue new requirements after its review. When regulations are unstable, a foundation that is mathematically and programmatically verifiable is a pragmatic choice. Open-source enclaves may offer the stability the Defense Industrial Base needs.

Sources