Agentic trust and compliance automation platform for continuous evidence collection, control monitoring, policies, and security questionnaire responses.
CMMC (US Department of War / DoD)
Quick answer
10 verified listings are tagged for CMMC in Agent Index dataset v0.1.27 (generated 2026-10-27).
The Cybersecurity Maturity Model Certification program verifies that defense contractors and subcontractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). As of 18 Oct 2026 the program is paused in Phase 1 (self-assessments).
Framework tags indicate relevance for evaluation, not certification. This is not a ranking.
The Cybersecurity Maturity Model Certification program verifies that defense contractors and subcontractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). As of 18 Oct 2026 the program is paused in Phase 1 (self-assessments).
Tag means the vendor's own pages document CMMC program support (framework library, requirement mapping, evidence, POA&M or affirmation workflows). It is not a CMMC certification of the tool or of your organisation.
Key facts
Official sources
Last checked 2026-10-18. Every sentence links to an official source in the dataset.
- On 13 Jul 2026 the Department of War (DoW) suspended CMMC Phase II requirements, which had been scheduled for 10 Nov 2026, and set up a CMMC reform task force. Phase I self-assessment requirements remain in place. Source
- Phase 1 began 10 Nov 2025; the program is paused in Phase 1. During this period DoW enforces NIST SP 800-171 Rev 2 compliance through self-assessments and select government-led assessments. Source
- CMMC protects FCI (FAR 4.1901) and CUI (32 CFR 2002.4(h)); DoW contractors and subcontractors handling FCI/CUI must achieve a specified CMMC level as a condition of contract award. Source
- Level 1 (Self): annual self-assessment and affirmation against the 15 requirements of FAR 52.204-21; results in SPRS; POA&Ms not permitted. Source
- Level 2 (Self): self-assessment every 3 years with annual affirmation against the 110 requirements of NIST SP 800-171 Rev 2 (DFARS 252.204-7012); results in SPRS; POA&Ms permitted per 32 CFR 170.21(a)(2) and must be closed within 180 days. Source
- The pause does not remove the obligation to protect information under DFARS 252.204-7012. Source
From this dataset
- 10 verified listings on this page, with headquarters in 4 HQ regions and 4 countries.
- Dataset version 0.1.27, generated 2026-10-27.
- The Cybersecurity Maturity Model Certification program verifies that defense contractors and subcontractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). As of 18 Oct 2026 the program is paused in Phase 1 (self-assessments).
Cite as: Agent Index by Heritage Services, CMMC (US Department of War / DoD), dataset v0.1.27 (https://theagentindex.io/frameworks/cmmc/)
FAQ (from this dataset)
What is listed on this framework hub?
The Cybersecurity Maturity Model Certification program verifies that defense contractors and subcontractors protect Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). As of 18 Oct 2026 the program is paused in Phase 1 (self-assessments). 10 verified listings from Agent Index dataset v0.1.27.
How many listings are on this page?
10 verified listings in dataset v0.1.27 (2026-10-27).
Which listings are headquartered in India, Asia-Pacific or Australia/NZ?
1 of 10 listings on this page publish an HQ in India, Asia-Pacific or Australia/New Zealand: 6clicks Hailey AI (Australia).
Is this a ranking?
No. This is not a ranking or score. Order is mechanical (from dataset fields such as name, framework-tag count or table membership), not a paid placement or quality judgement.
Official sources: dodcio.defense.gov/CMMC/About/ · dodcio.defense.gov/CMMC/
Related US government programs: FedRAMP · GovRAMP · TX-RAMP · US public-sector and FedRAMP comparison · How to verify a C3PAO
Use-case comparisons with 2+ listings tagged CMMC: TPRM and vendor-risk AI agents · US public-sector and FedRAMP AI agents
Related audit-firm listings (facts, not endorsements): CMMC auditors in the United States
Agents tagged for CMMC
10 listings. Tags indicate relevance for evaluation — not a certification that the vendor “implements” the law. CMMC tags show vendor-documented program support, not a CMMC certification of the product or of your organisation. If a vendor states it achieved CMMC for its own organisation, that is the vendor’s own posture, not a product feature.
Compliance and trust management platform with AI-assisted evidence collection, continuous control monitoring, and multi-framework programs.
Compliance automation platform with Comply AI features for policies, remediation, risk, questionnaires and TPRM, plus Trust Center and CMMC/Defense packages.
Sovereign GRC AI engine that maps controls, finds gaps, drafts assessment responses and creates risks, issues and tasks inside the 6clicks Hub & Spoke platform.
Cyber GRC platform whose AI agents build and run end-to-end compliance workflows from natural-language prompts, covering evidence collection, control testing, gap analysis and continuous control monitoring.
AI GRC platform whose agents collect and map evidence, test controls continuously, assess policies against frameworks, run natural-language 'TI Playbooks' and answer security questionnaires.
Continuous controls monitoring platform whose RegML AI agents monitor controls, collect evidence, draft control documentation and trigger remediation for FedRAMP, CMMC and NIST programmes; RegScale CCM is FedRAMP High authorized.
CMMC- and NIST 800-171-focused GRC platform whose AI agents auto-map evidence to assessment objectives (Evan) and run automated control gap assessments with remediation steps (Alfie); FedRAMP 20x Low authorized.
AI-native GRC platform whose agents monitor controls, collect evidence, map controls, flag gaps, draft security-questionnaire responses and remediate gaps across 40+ frameworks, with a dedicated compliance expert per customer.
Enterprise GRC platform with a fleet of task-specific AI agents for evidence review, control advice and remediation, policy drafting, risk treatment planning, vendor questionnaire review and risk scoring, and customer security questionnaires.
Vendor-claimed CMMC support (not tagged)
These listings mention CMMC on a vendor page as something the product helps customers “meet”, without documenting CMMC program support (framework library, requirement mapping, evidence, POA&M or affirmation workflows) at the level used for the tag. Clearly labelled as claimed-only.
- Cav Compliance OS agents (formerly Caveonix) — Agentic cyber assurance and continuous compliance platform whose AI agents collect evidence, test controls, find gaps against 50+ frameworks (FISMA, NIST 800-53, FedRAMP, CMMC) and generate ATO artifacts; the platform is FedRAMP High authorized.
- Deep Fathom Compliance Readiness Platform (agentic CMMC / NIST SP 800-171 readiness) — CMMC and NIST SP 800-171 readiness platform for US defence contractors where AI agents interpret obligations, plan and advance routine readiness work, continuously map the CMMC boundary and collect evidence, with human review gates on consequential decisions.
- episki Autonomous GRC (AI Orchestration agents for policies, questionnaires, vendors and evidence) — A GRC platform built around agents that draft policies, answer inbound security questionnaires, review vendors' SOC 2 and CAIQ responses, map controls, assess risks and write deterministic evidence-collection recipes. Every plan, step-run and sensitive action goes through human approvals and safety floors. Pricing is published.
- Halo AI Agents (service management with FedRAMP GRC module) — ITSM/ESM platform (formerly HaloITSM) with AI agents: conversational agents for end users and fulfillers, and process agents (Dispatch, 1st Line Support, Major Incident, Knowledge, Change Management) that act on their own within role-based permissions. The platform, including a FedRAMP/CMMC GRC module, is FedRAMP 20x Moderate.
- ReliaQuest GreyMatter Agentic Teammates (GreyMatter for Government) — Agentic AI security operations platform whose six persona-based Agentic Teammates investigate and triage alerts and execute approved containment actions; GreyMatter for Government is FedRAMP Authorized (Moderate).
Saved
Reference:
We'll email you when a matching listing is added; no other automatic emails. Nothing is sent automatically now.
Related alternatives (relevance grouping, not a ranking): Secureframe alternatives
Best CMMC AI agents (mechanical listing order, not a ranking) · All frameworks