CMMC Level 2 / NIST SP 800-171 responsibility map
A defense supplier that runs NativeCAD in its own AWS GovCloud (US) account has to show its assessor where each security requirement is met. This page does that for the requirement families that touch a CAD tool. For every requirement it says what NativeCAD does, what stays with the customer's environment, and where neither applies. It is a map for your System Security Plan (SSP), not a certificate.
What this page is not. CMMC assesses an organization's information system and its scope. It does not certify software products, and NativeCAD is not "CMMC certified", "compliant" or "authorized". Nothing here is an assessment result. Your SSP, your scoping decision and your C3PAO (or DIBCAC) decide what counts. Treat this page as evidence to cite, and check each row against your own deployment.
Checked against the sources listed at the end on 2026-10-12.
Why NativeCAD fits the boundary
The software runs where the controlled data already is. In the GovCloud reference deployment (the GovCloud deployment guide):
- The vendor operates nothing. The image, the MCP server and the modeler all run in the customer's account and VPC. No CUI reaches FeatureBoard Labs, and there is no licence server, telemetry or update call to reach.
- The network contract is checkable offline:
node deploy/govcloud/validate.jsasserts no route out of the VPC and an exact VPC endpoint set, on every push. - Sandbox mode (on by default in the image) adds three process-level controls: a workspace jail, a runtime egress block and a hash-chained audit log.
- The supply chain is short and listed. The server has three npm dependencies plus a first-party kernel. Releases are signed, and the CycloneDX SBOM in
deploy/sbom/lists every component.
Whether a given workload is in your assessment scope is your decision (see 32 CFR 170.19 on scoping). The map below assumes the NativeCAD container holds CUI, so its requirements apply.
Which revision
CMMC Level 2 assesses against NIST SP 800-171 Revision 2: 110 requirements in 14 families. 32 CFR 170.14 says "The security requirements in CMMC Level 2 are identical to the requirements in NIST SP 800-171 R2." NIST published Rev. 3 (17 families) on 2024-05-14 and has superseded Rev. 2. DoD's position (CMMC alignment deck, Feb 2025) is that assessments stay on Rev. 2 until Rev. 3 is adopted through rulemaking. Trade reporting says the planned Rev. 3 rule had not been published as of mid-2026. Confirm the current status before you plan around either revision.
This map uses Rev. 2 numbering (3.x.y). Rev. 3 keeps the same families and adds Planning, System and Services Acquisition and Supply Chain Risk Management. The supply-chain rows (SBOM, signed releases, pinned digests) are the part of this map that Rev. 3's new families will lean on most.
How to read the tables
| Who | Meaning |
|---|---|
| NativeCAD | the product meets the requirement for its own surface, with the evidence named |
| Shared | NativeCAD or the reference stack contributes evidence and the customer completes it |
| Customer | the customer's environment owns it. NativeCAD does not get in the way |
| N/A | does not apply to a software product of this kind |
"Stack" means the reference CloudFormation template (deploy/govcloud/nativecad-govcloud.template.json). It is a starting point that you own once you deploy it. "Sandbox" means sandbox mode (packages/mcp/src/sandbox/, tools/audit_verify.js). the sandbox acceptance test proves each sandbox behaviour named below.
3.1 Access Control (AC)
| Req | Requirement (short) | Who | NativeCAD provides | Customer environment provides |
|---|---|---|---|---|
| 3.1.1 | Limit system access to authorized users, processes and devices | Shared | The MCP server has no network listener: it speaks stdio only, so there is no remote login surface. The modeler sits behind an internal load balancer whose security group admits only ClientCidr. | User authentication in front of the modeler (IdP, VDI or reverse proxy), the ClientCidr value, and IAM for who may start tasks or run the image. |
| 3.1.2 | Limit access to permitted transactions and functions | Shared | Sandbox refuses every tool that needs a network or an outside toolchain (SANDBOX_UNAVAILABLE) and lists them with reasons in cad_server_info.sandbox.unavailable. | Role design: who can invoke which agent, and with which licence. |
| 3.1.3 | Control the flow of CUI per approved authorizations | Shared | The strongest NativeCAD row. The workspace jail refuses any path outside /workspace (SANDBOX_PATH). The egress block refuses any network call from inside the process (SANDBOX_EGRESS). The VPC has no route out. The modeler's CSP pins connect-src to its own origin. Eval sharing writes a local bundle only. | The approved paths in and out of the enclave (media transfer, cross-domain), export and release authorizations, and DLP at your boundary. |
| 3.1.4 | Separate duties | Customer | None. | Role separation between build, deploy, operate and audit. |
| 3.1.5 | Least privilege | Shared | The container runs as UID 1001 with a read-only root, all Linux capabilities dropped, and ECS Exec off. The task role can only mount its own EFS access point, because the application makes no AWS API calls. | IAM policies and permission boundaries for people and pipelines. |
| 3.1.6, 3.1.7 | Non-privileged accounts for non-security functions; log privileged functions | Customer | NativeCAD has no accounts or privilege tiers of its own. | Privileged-account management and logging (IAM, CloudTrail). |
| 3.1.8 to 3.1.11 | Failed-logon limits, privacy and security notices, session lock, inactivity termination | Customer | N/A. NativeCAD has no logon. | Your IdP, VDI and workstation policy. |
| 3.1.12 to 3.1.15 | Monitor, encrypt and route remote access; authorize remote privileged commands | Customer | No inbound management interface exists on the MCP server. ECS Exec is off, so there is no remote shell into a task. | Transit Gateway, Direct Connect or VPN, managed access points, and remote-session monitoring. |
| 3.1.16 to 3.1.19 | Wireless and mobile device controls | N/A | Not applicable to a server-side container. | Your device and wireless policy. |
| 3.1.20 | Verify and control connections to external systems | Shared | The server makes no outbound connections: sandbox blocks them and the stack has no route for them. | The connections your boundary does allow. |
| 3.1.21 | Limit portable storage on external systems | Customer | The jail stops tools writing outside /workspace. | Removable-media policy. |
| 3.1.22 | Control CUI posted or processed on public systems | Shared | Sandbox refuses cad_report_bug, cad_quote_submit, cad_eval_share and cad_contest, which are the tools that would send data out. | Policy and training. |
3.3 Audit and Accountability (AU)
| Req | Requirement (short) | Who | NativeCAD provides | Customer environment provides |
|---|---|---|---|---|
| 3.3.1 | Create and retain audit logs | Shared | Sandbox appends every tool call, refusals included, to a per-process audit-*.jsonl in /workspace/audit/. A line holds the time, tool, arguments, SHA-256 of every file read or written, the result and the reason code. Geometry payloads are digested, never logged. The stack adds CloudTrail (multi-region, log-file validation, KMS), VPC flow logs capturing ALL traffic, and a KMS-encrypted app log group. | Retention beyond LogRetentionDays, and shipping /workspace/audit/ to WORM storage on a schedule. |
| 3.3.2 | Trace actions to individual users | Shared | Each audit line records the actor (agent, or human when _meta["nativecad/actor"] or NATIVECAD_ACTOR says so), the client scope and the document handle. The actor is a role, not a named person. | Bind each session to a named identity through your IdP, the task role and CloudTrail, then join that to the audit line by time and task ID. |
| 3.3.3 | Review and update logged events | Customer | The JSONL is plain, stable and machine-readable. | The review cadence and event selection. |
| 3.3.4 | Alert on audit logging process failure | Shared | If the server cannot write an audit line it refuses every later call (SANDBOX_AUDIT) rather than run unaudited. It will not start sandboxed without a writable audit directory. | Alarms on task failures and on CloudWatch Logs delivery. |
| 3.3.5, 3.3.6 | Correlate review, analysis and reporting; record reduction | Customer | JSONL and CloudWatch Logs are ready inputs. | SIEM, correlation and reports. |
| 3.3.7 | Synchronize system clocks | Customer | Audit timestamps come from the host clock. | Time source (for example Amazon Time Sync). |
| 3.3.8 | Protect audit information and tools | Shared | Each file is a hash chain. Editing, inserting, removing or moving a line breaks it, and node tools/audit_verify.js /workspace/audit names the first broken line (--require-sealed also fails a file with no session-end). Tools cannot read or write the audit directory (the jail). EFS, log groups and the trail bucket are KMS-encrypted. | Write-once storage and IAM on the log destinations. A hash chain cannot prove that a whole file was deleted. |
| 3.3.9 | Limit audit management to privileged users | Customer | The audit directory is off limits to every tool. | Who can reach EFS, CloudWatch Logs and the trail bucket. |
3.4 Configuration Management (CM)
| Req | Requirement (short) | Who | NativeCAD provides | Customer environment provides |
|---|---|---|---|---|
| 3.4.1 | Baseline configurations and inventories | Shared | One image, pinned by digest. The SBOM (deploy/sbom/) inventories the bundle. kernel/BUILD_INFO.json stamps the staged kernel. The stack is version-controlled infrastructure code. | The authoritative inventory, and the image digest you approved. |
| 3.4.2 | Establish and enforce security configuration settings | Shared | Secure defaults ship in the image: sandbox on, telemetry off (DO_NOT_TRACK=1, CADSOLVER_TELEMETRY=off), updater off, read-only root, capabilities dropped. | Drift detection and enforcement (for example AWS Config). |
| 3.4.3, 3.4.4 | Track, approve and analyze changes | Customer | Signed release manifests, the changelog and a regenerated SBOM per release give you the input for an impact analysis. | Your change board and approvals. |
| 3.4.5 | Restrict access for changes | Shared | The root filesystem is read-only. Sandbox forces the updater off, so a running server never replaces itself. Updates are a deliberate image rebuild. | ECR, CloudFormation and pipeline IAM. |
| 3.4.6, 3.4.7 | Least functionality; restrict nonessential programs, ports and services | Shared | Network-dependent tools are refused and listed. The image exposes one port (8080, modeler only). The MCP mode exposes none. | Ports, protocols and services at your boundary. |
| 3.4.8 | Deny-by-exception or permit-by-exception for software | Shared | The image carries three npm dependencies plus the kernel, and the sandboxed process cannot start network tools (curl, ssh, git, npm and the like). | Admission control: only approved digests run. |
| 3.4.9 | Control user-installed software | Shared | Read-only root, and no update path inside the sandbox. | Policy for host and workstation software. |
3.5 Identification and Authentication (IA)
| Req | Requirement (short) | Who | NativeCAD provides | Customer environment provides |
|---|---|---|---|---|
| 3.5.1, 3.5.2 | Identify and authenticate users, processes and devices | Customer | N/A. NativeCAD has no user accounts. The licence key identifies a licence, not a person, and is validated locally. | IdP, VDI, IAM roles and device identity. |
| 3.5.3 | Multi-factor authentication | Customer | N/A. | MFA at your IdP or VDI. |
| 3.5.4 to 3.5.9, 3.5.11 | Replay resistance, identifier reuse and lifecycle, password rules, feedback masking | Customer | N/A. | Your IdP policy. |
| 3.5.10 | Store and transmit only cryptographically protected passwords | N/A | NativeCAD stores and transmits no passwords. Keep CADSOLVER_LICENSE_KEY in your secrets store. | Secrets management. |
3.8 Media Protection (MP)
| Req | Requirement (short) | Who | NativeCAD provides | Customer environment provides |
|---|---|---|---|---|
| 3.8.1, 3.8.2 | Protect system media with CUI; limit access | Shared | CUI lives in one place: /workspace, a KMS-encrypted EFS volume behind a single access point. | Key policy, EFS access and physical protection of any exported media. |
| 3.8.3 | Sanitize or destroy media before disposal or reuse | Customer | All state is under /workspace, so there is one volume to sanitize. A tmpfs workspace leaves nothing behind. | Sanitization procedure and key destruction. |
| 3.8.4 | Mark media with CUI markings | Customer | NativeCAD does not apply CUI markings to files. | Marking process. |
| 3.8.5, 3.8.6 | Control access and accountability in transport; encrypt in transit | Shared | The audit log records the SHA-256 of every file the server reads or writes, so a file's identity can be checked at each hop. | Transfer tooling, encryption and chain of custody. |
| 3.8.7, 3.8.8 | Control removable media; prohibit unowned portable storage | Customer | The jail stops tools writing outside /workspace. | Removable-media policy. |
| 3.8.9 | Protect the confidentiality of backup CUI | Customer | The reference stack does not configure backups. | EFS backup policy. Backups should inherit KMS encryption. |
3.13 System and Communications Protection (SC)
| Req | Requirement (short) | Who | NativeCAD provides | Customer environment provides |
|---|---|---|---|---|
| 3.13.1 | Monitor, control and protect communications at boundaries | Shared | The stack has no internet gateway, NAT, egress-only gateway, Elastic IP, peering or Transit Gateway attachment, and no AWS::EC2::Route. VPC endpoints are exactly bedrock-runtime-fips, ecr.api, ecr.dkr, logs and s3. deploy/govcloud/validate.js checks each property by name. Flow logs capture ALL traffic. The load balancer is internal. | Your boundary devices, inbound connectivity (Transit Gateway, Direct Connect, VPN) and traffic monitoring. |
| 3.13.2 | Security-promoting architecture and engineering | NativeCAD | Pure JavaScript, no native modules, no WASM, no dev dependencies in packages/mcp. The stager (scripts/stage-kernel.js) hard-fails the build if the kernel closure reaches a native or undeclared package. | None. |
| 3.13.3 | Separate user functionality from management functionality | Shared | The MCP server exposes no management interface. The modeler server is GET and HEAD only. ECS Exec is off. | The administrative plane (IAM, CloudFormation). |
| 3.13.5 | Separate publicly accessible components from internal networks | Shared | Subnets never map public IPs, and tasks run with AssignPublicIp: DISABLED. | Your enclave network design. |
| 3.13.6 | Deny network traffic by default, allow by exception | Shared | Task egress allows only HTTPS to the VPC CIDR and the S3 prefix list. The endpoint security group's egress is 127.0.0.1/32. In the process, sandbox denies every network call. | Default-deny rules at your own boundary. |
| 3.13.7 | Prevent split tunneling | Customer | N/A. | VPN and VDI client configuration. |
| 3.13.8 | Cryptography to protect CUI in transit | Shared | The MCP server does no network I/O. The HTTPS listener uses ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04. EFS requires TLS. AWS APIs go over HTTPS VPC endpoints. | The ACM certificate and PKI. Always set CertificateArn: with it empty the stack serves HTTP, which is for a lab only. |
| 3.13.9 | Terminate connections after the session or inactivity | Customer | The static server is stateless. | Load balancer idle timeout and VDI policy. |
| 3.13.10 | Establish and manage cryptographic keys | Shared | One customer-managed KMS key with rotation on, which the validator enforces. | Key administration policy and separation of key custodians. |
| 3.13.11 | FIPS-validated cryptography for CUI | Shared | NativeCAD does no network crypto. It uses SHA-256 for the audit chain and licence check, and ed25519 to verify release signatures, through Node's crypto. The default base image, Red Hat UBI 9, is FIPS-capable: on a FIPS-mode host Node reports crypto.getFips() === 1 with no image change. Neither the image nor NativeCAD is itself a validated module. | Run on a FIPS-mode host (for example Fargate in GovCloud or a FIPS AMI) and cite the CMVP certificate for your platform's module. |
| 3.13.13 | Control and monitor mobile code | Shared | The modeler runs JavaScript in the browser by design, from its own origin only (default-src 'self', connect-src 'self'). Its CSP does allow 'unsafe-inline' and 'unsafe-eval', which the modeler needs. | Browser policy and monitoring on the workstation. |
| 3.13.15 | Protect the authenticity of communications sessions | Customer | Terminated at the load balancer. | Certificates and TLS policy. |
| 3.13.16 | Protect the confidentiality of CUI at rest | Shared | EFS, both log groups and the trail bucket are encrypted with the stack's KMS key. The validator fails the template if any is not. | Key custody, and encryption of anything you add (volumes, snapshots, S3). |
| 3.13.4, 3.13.12, 3.13.14 | Shared-resource information, collaborative devices, VoIP | N/A | Not applicable to this software. | Your environment. |
3.14 System and Information Integrity (SI)
| Req | Requirement (short) | Who | NativeCAD provides | Customer environment provides |
|---|---|---|---|---|
| 3.14.1 | Identify, report and correct flaws in a timely manner | Shared | Reports go to support@featureboard.ai. Fixes ship as new releases with a changelog. The release manifest is signed (ed25519). A server installs a release only if the signature and every artifact digest verify. In the sandbox the updater is off, so you rebuild and redeploy a new signed release when you choose. | Image scanning, patch cadence and redeployment. |
| 3.14.2, 3.14.4 | Malicious-code protection; keep it current | Customer | Pure JavaScript with no native modules shrinks the native-code attack surface. NativeCAD is not an antivirus product. | Image and host scanning, EDR. |
| 3.14.3 | Monitor security alerts and advisories | Shared | The SBOM gives you exact component names, versions and hashes to match against advisories. | The advisory feed and the triage process. |
| 3.14.5 | Scan files from external sources | Customer | Imports (STEP, DXF, PDF, Parasolid and others) are parsed by in-process JavaScript inside the jail. They are not scanned for malware. | Scan on the way into the enclave. |
| 3.14.6 | Monitor communications to detect attacks | Customer | VPC flow logs (ALL traffic) are on. | Detection and alerting on them. |
| 3.14.7 | Identify unauthorized use | Shared | Refused calls are audited with reason codes (SANDBOX_PATH, SANDBOX_EGRESS, SANDBOX_UNAVAILABLE). cad_server_info.sandbox counts refused egress attempts and names the audit file. | Alerting on those events. |
Other families
- Risk Assessment (3.11.2, 3.11.3). Vulnerability scanning and remediation are the customer's. The SBOM is the scan input for NativeCAD's own components:
deploy/sbom/nativecad-mcp-<version>.cdx.json. - Security Assessment and SSP (3.12.x). Customer. Use this page and the GovCloud deployment guide as inputs to the SSP.
- Awareness and Training, Incident Response, Maintenance, Personnel Security, Physical Protection. Organizational controls. They do not depend on a software product, so there is no NativeCAD row.
Supply chain: the SBOM
The SBOM generator writes a CycloneDX 1.5 JSON SBOM for the staged MCP bundle. It reads only local files (the lockfile and the kernel stager's require-closure), runs offline and produces the same bytes for the same checkout.
node tools/sbom_cyclonedx.js # writes deploy/sbom/nativecad-mcp-<version>.cdx.json
node tools/sbom_cyclonedx.js --check # exit 1 if the committed SBOM is stale| Part | What it lists |
|---|---|
| the package | nativecad-mcp and its version |
| npm closure | every package in packages/mcp/package-lock.json, each with a package URL, version, declared licence and the dependency graph. The SBOM states how many packages carry a lockfile integrity digest (nativecad:lockfile-integrity-coverage); today the lockfile records none, so tarball hashes are not in the SBOM |
| kernel closure | one component for the first-party kernel files that stage-kernel.js ships, with a SHA-256 over the sorted per-file digests |
| assets | the fonts and other verbatim assets the stager copies, each with a SHA-256 |
Scan it with any CycloneDX-aware tool, for example grype sbom:deploy/sbom/nativecad-mcp-<version>.cdx.json. Regenerate it and commit it with each release. --check exits 1 when the committed file has drifted from the package version or the npm closure, and NativeCAD's CI runs it.
The SBOM covers NativeCAD's own bundle. It does not list the operating-system packages of the base image: scan the image you build (for example with syft) and record its digest, as step 2 of the GovCloud deployment guide says.
Sources
Checked 2026-10-12. Items marked (secondary) are trade or third-party reporting that I could not tie to a primary page. Confirm them before you rely on them.
- 32 CFR 170.14 (CMMC Level 2 requirements are identical to NIST SP 800-171 R2; assessment per SP 800-171A): https://www.law.cornell.edu/cfr/text/32/170.14 (eCFR is the official copy: https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-G/part-170).
- DoD CIO, "CMMC Alignment to NIST Standards", Feb 2025 (Level 2 = Rev. 2, 110 requirements in 14 families; Rev. 3 to be adopted through future rulemaking): https://dodcio.defense.gov/Portals/0/Documents/CMMC/CMMC-AlignmentNIST-Standards.pdf.
- NIST SP 800-171 Rev. 3, final 2024-05-14, 17 families, supersedes Rev. 2: https://csrc.nist.gov/pubs/sp/800/171/r3/final.
- NIST SP 800-171 Rev. 2, final 2021-01-28 (withdrawn 2024-05-14): https://csrc.nist.gov/pubs/sp/800/171/r2/upd1/final.
- (secondary) Defense Compliance Report, "NIST 800-171 interim baseline": Class Deviation 2024-O0013 Rev. 1 keeps DFARS 252.204-7012 on Rev. 2; the planned Rev. 3 rule (RIN 0790-AM01) not yet published; Phase 1 of the DFARS rollout began 2025-11-10; a July 2026 DoD memorandum reportedly suspended the planned 2026-11-10 Phase 2 date: https://thedefensecompliancereport.com/nist-800-171-interim-baseline/.
- NativeCAD evidence: the GovCloud deployment guide and the stack and image files it lists,
deploy/govcloud/anddeploy/container/.
Want this running inside your boundary? We will walk your team through the deployment and the map.
Talk to sales: sales@featureboard.ai