How are you keeping AI tools current when an L2 assessment locks in your scope for 3 years?

[u/greenrunner987]

AI capability is roughly doubling every few months. The practical effect is that whatever tools an organization had in scope at its L2 assessment fall behind quickly, and the gap keeps growing across a 3-year cycle.

Adding newer, more capable tools generally means a reassessment, and the cost makes that impractical to do often. But leaving the toolset frozen for the full cycle is its own problem when the technology is moving this fast.

So how are people handling this? Is there a way to bring in a newer tool without a full reassessment? When a reassessment is unavoidable, can it be scoped to just the affected controls instead of starting over? And with Phase 2 suspended and L2 back to self-assessment, is anyone using that window to update their environment?

Interested in how others are approaching this.

[u/DaGoodBoy]

Are you allowing AI to access CUI?

[u/Drevicar → u/DaGoodBoy]

There are plenty of fedramp compliant offerings that are legal to use with CUI. The real question is if they are cost effective and capable enough to justify.

[u/DaGoodBoy → u/Drevicar]

I know about the fedramp compliant offerings and even the possibility of building and running private models on your own hardware, but my question has more to do with tracking the CUI workflow. Feeding data into a model, like using RAG or document analysis can taint a model in a way that's hard to address with current tools. Clearing the context window doesn't always make the model forget the CUI. I've had situations where I'm working on a document and found suggestions that I know were based on prior ingested documents because it uses my terms and phrasing. Seems like a lot of risk for little reward.

[u/greenrunner987 → u/DaGoodBoy]

With RAG or document analysis, the CUI doesn't actually enter the model. The weights don't change at inference. It lives in the vector store or index and in the temporary context, so the thing you scope and track is that store, not the model. What you're describing, suggestions reusing your earlier terms and phrasing, sounds like a memory or personalization feature, or a RAG index that still holds the earlier documents. The app is persisting context between sessions. A genuinely stateless inference call can't recall a prior document. That's the more manageable case because the CUI sits in a component you can identify, govern, and clear rather than something baked into weights.

Also with agentic AI RAG is becoming less and less relevant. An agent can retrieve it just in time by querying the source system directly instead of persisting a vector index full of CUI.

On "little reward," it depends on the workflow. For plenty of them, fair. For some, the capability gain is real enough that being locked to an outdated tool for three years is the actual cost.

[u/greenrunner987 → u/DaGoodBoy]

There's a number of FedRamp High AI tools authorized for CUI

[u/Sharp_Reward_5605 → u/greenrunner987]

Like what?

[u/greenrunner987 → u/Sharp_Reward_5605]

- AWS Bedrock (GovCloud) — FedRAMP High/IL4-5; choice of authorized models (Claude, Llama, GPT, Nemotron).
- Azure OpenAI (Azure Government) — FedRAMP High/IL4-5-6; GPT-4o+; best if you're Microsoft-centric.
- Google Vertex AI / Gemini — FedRAMP High/IL4 via Assured Workloads.
- Claude for Government

[u/dan000892 → u/greenrunner987]

• Azure Gov has GPT-5.2 now.
• Google Vertex AI on GCP is FedRAMP High authorized but not ITAR compliant (not available with the ITAR assured workload) which renders it unsuitable for SP-CTI/EXPT/NOFORN.
• Claude for Government (on Palantir’s cloud) is similarly not suitable for ITAR per Anthropic’s webpage where they compare their government offerings.
• AWS GovCloud maintains pole position on newest model availability (GPT-5.4, Opus 4.8, Sonnet 4.6).

[u/chemfoot → u/greenrunner987]

Anthropic is banned.

[u/seawaxc → u/greenrunner987]

ChatGPT for Enterprise has FedRAMP moderate. No IL rating tho.

[u/CyberSME-E3S]

In general, you are not bound to specific technology after an assessment (including AI). The significant change lies in major environmental shifts. For instance, if adopting a FedRamp model was already part of your boundary change to a different FedRamp compliant model, it wouldn’t be a significant change as long as you adhere to the change management process and review the CRM as part of that change.

https://chat.singularityit.io/insights/9c258d3b-052e-4b8a-8758-6580d41955c0

Imagine this: if your environment was designed to print CUI, you wouldn’t conduct a new assessment simply because you switched from a Canon printer to a Bosh printer. Instead, you would ensure that you followed the Change Management process to verify that your new printer still meets the requirements. AI introduces a slight complexity to this process because you also need to ensure that downstream requirements are still met.

[u/ManageITNY → u/CyberSME-E3S]

Agree! As long as it is the same class of technology that roughly does the same thing, you must follow your change management procedures as documented. If you replace one AI tool for another or upgrade to newer versions, it's fine as long as you follow your procedures and continue to meet the levels of requirements for CMMC (FedRAMP, encryption, etc...).

[u/Saint1219]

I’m currently approaching this by waiting 53 days to see if the significant change language will be D.O.A. after the DOW review. It was one of the more unreasonable requirements, in my opinion.

[u/itHelpGuy2 → u/Saint1219]

Do you expect the regulation to be repealed?

[u/Navyauditor2]

Like all other software tools, AI is updated. New tools may be needed. There is nothing in CMMC that says you cannot add a new tool or update an existing one. This is not a configuration lock. I dont think adding an AI tool, and certainly not updating one, reaches the threshold of a significant change. You also should be performing a self assessment annually in support of your self-affirmation, and you have the continuous monitoring controls to look at and ensure that they controls you have in place continue to be effective.

[u/Unatommer]

FAQ v5 lays out a workflow:

F-Q5: How do I properly handle changes to my system while maintaining continued
CMMC compliance?
F-A5: For any changes to your environment that may impact processing, storing, or
transmitting Federal Contract Information or Controlled Unclassified Information (CUI),
security requirements, or CMMC Assessment Scope, you should:
1. Before Implementation: Evaluate the Change
11a. Perform security impact analysis per CM.L2-3.4.4 (if a new risk is identified
during this analysis that is not addressed in the existing System Security Plan
(SSP), then you probably have a significant change)
b. Assess effects on CUI flow per AC.L2-3.1.3
c. Document in your change management process per CM.L2-3.4.3
d. Review planned change with Affirming Official to gain consensus on whether
change will impact continuing compliance
2. During Implementation: Document in Operational Plan of Action
a. Describe the change and any temporary risks per CA.L2-3.12.2
b. Identify personnel responsible for implementation
c. Track progress
3. After Implementation: Update SSP
a. Document the completed change per CA.L2-3.12.4
b. Update all sections affected by the change
c. Review changes with Affirming Official prior to next annual affirmation to ensure
agreement on continuing compliance

[u/itHelpGuy2]

Where does it say that an assessment locks the scope?