CUI lives in files. Protect it there.

Strip the acronyms away and CMMC compliance is largely a question about files. Controlled Unclassified Information in the defense industrial base is technical drawings, specifications, contract deliverables, and test data: documents that live on file shares, get copied into project folders, and accumulate for the life of a program. The NIST 800-171 control families behind CMMC, among them access control, audit and accountability, media protection, and incident response, all land in practice on how those files are governed.

That is the thesis of this piece, and it has a practical corollary: the fastest path to defensible CMMC compliance runs through the storage layer, where the CUI actually sits. Protect it there, with labeling, attribute-based access control, encryption, and audit built into the platform, and most of the hard assessment questions answer themselves.

CUI is information the government creates or possesses, or that a contractor handles on its behalf, that requires safeguarding under law, regulation, or policy without being classified. The National Archives maintains the official CUI Registry of categories; for defense contractors the dominant one is Controlled Technical Information, the drawings, models, specifications, and test results that describe how military systems work, alongside export-controlled data and procurement-sensitive material. Under DFARS 252.204-7012, contractors have been obligated to safeguard this data with NIST SP 800-171 controls for years; CMMC adds the verification, and since November 2025 the DFARS 252.204-7021 clause makes proven compliance a condition of award.

None of this data behaves like a database. It is produced by engineers in CAD tools and office documents, exchanged with primes and subs, copied into program folders, and retained for decades. It flows naturally to SMB and NFS shares because that is where multi-user engineering work happens. Which means the compliance boundary of a CMMC program is, to a first approximation, the file storage, along with every drifted permission and unlogged access on it.

The hard questions in an assessment are rarely about policy documents. They are operational: show that only authorized identities can reach CUI, that access is limited to need, that you can produce an audit trail of who accessed what, and that you would detect and respond to unauthorized access. Static share permissions and a native audit log strain under those questions, especially when programs share infrastructure and people rotate across contracts.

The strain has a shape every assessor recognizes. Group memberships accumulated over years no longer match need-to-know. A share created for one contract now holds three. The audit log, if enabled, records opens but not the context to judge them. Each finding is remediable alone; together they signal that the environment cannot demonstrate control over the data it holds. And demonstration, not intention, is what a C3PAO scores at CMMC Level 2.

CUI handling requirements start with marking, but paper markings do not enforce anything. RackTop’s approach begins by making the label a property of the data itself: datasets and files carry classification and program attributes at the storage layer, so “this is CUI, for this program, under this contract” is machine-readable where the data lives. Labeling at the data layer is what converts a compliance obligation into an enforceable policy input. It is the prerequisite for every downstream control, from access decisions to encryption boundaries to audit scoping.

Labeling also answers the inventory questions that stall so many CMMC programs at the start: where is our CUI, and how much of the environment does it touch? When labels live on the data rather than in a spreadsheet, scope is a query, and scope creep is visible the day it happens.

Attribute-based access control changes the shape of the assessment answer. When policy is evaluated per operation against clearance, program, citizenship, device, and context, the same storage can hold multiple programs with enforced separation, and the enforcement itself generates the evidence: an immutable, per-operation record of every access decision.

BrickStor SP enforces ABAC on every SMB, NFS, S3, and Web Drive operation, with Sentris integration carrying the identity attributes. In practice that means the engineer on Program A reads Program A’s drawings and is denied Program B’s, on the same platform, with the denial logged; a contractor whose citizenship attribute does not satisfy an export-control label never sees the file, regardless of what an old share ACL says; and when someone rotates off a contract, flipping one attribute revokes a whole class of access instead of an administrator hunting group memberships. This is the “limit access to authorized users and the types of transactions they are permitted” language of NIST SP 800-171 Access Control, implemented as a live decision rather than a standing permission. It is Zero Trust reaching the data pillar in exactly the sense the federal maturity models mean it.

Three more storage-layer capabilities close out the control families assessors weigh most heavily. FIPS 140-3 validated encryption with per-dataset keys satisfies the cryptography requirements and adds something DIB contractors specifically need: true cryptoshred. When a contract closes or CUI spills onto the wrong system, destroying the dataset’s keys renders the data cryptographically unrecoverable. That is a documented, minutes-long response to events that otherwise trigger data-destruction projects.

The immutable, per-operation audit record does double duty. For the assessment, it is the Audit and Accountability evidence produced by the platform rather than assembled from fragments. For operations, it is what makes the 72-hour incident reporting obligation under DFARS 252.204-7012 meetable: when something happens, the record already says which files, which account, from where, and when. And patented Active Defense stands in front of all of it, scoring every read and write behaviorally so that the adversary CMMC actually worries about, nation-state collection using valid credentials, is detected and stopped at the data, not discovered in a next-year audit.

Together these capabilities also enable the highest-leverage CMMC scoping move: the enclave. Consolidating CUI onto a platform that labels, enforces, encrypts, audits, and defends it natively shrinks the assessment boundary from the whole enterprise to the systems that matter, which is routinely the difference between a tractable Level 2 certification and a multi-year remediation program. Our guide to the CMMC program covers the scoping decision in depth.

The deeper point is that the adversary CMMC exists to frustrate is not the assessor. Nation-state collection against the defense supply chain targets exactly this data, often with valid credentials and patience. Controls that only satisfy the paperwork do not change that outcome; behavioral detection and per-operation enforcement on the CUI itself do. Contractors that build to the threat, rather than to the checklist, tend to find the checklist takes care of itself.