Cookies on fenixpyre.com
We use analytics and marketing cookies to learn how the site is used and to follow up on enquiries. They stay off unless you accept. Privacy policy
CMMC compliance
CMMC-compliant CUI without
disrupting a single workflow.
The toughest part of certification — encrypting CUI and controlling access to it — becomes the quickest step. No migration, no enclave, no VDI. FIPS-validated encryption applied at the file, inside the workflows your people already use.
CMMC LEVEL 2 · CUI LIFECYCLE COVEREDFIPS VALIDATED · IN-USE, IN-TRANSIT, AT-REST
STORED ON-PREM
8F A2 9C E7 01 B4
CUI stays in your existing storage — no migration to a new tenant.
PROCESSED ON ENDPOINTS
0D F8 2A C9 7E 31
Encrypted in use on endpoints and servers, which prevents CUI leakage.
SHARED WITH THIRD PARTIES
6B 04 FF A1 8D C2
Send and receive CUI direct from endpoints, control enforced post-transfer.
SOLIDWORKSAUTOCADREVITSIEMENS NXOFFICEPDFCATIAINVENTORSOLIDWORKSAUTOCADREVITSIEMENS NXOFFICEPDFCATIAINVENTOR
65%
LESS EXPENSIVE
than migrating to Microsoft GCC or a CMMC enclave solution.
110
NIST 800-171 REQUIREMENTS
the platform is built and operated in alignment with — across all 14 control families.
72H
DFARS 7012 WINDOW
forensic access reports support the reporting window required after a suspected exposure.
LEVEL 2
CMMC TARGET
FIPS-validated encryption integrated into current workflows for Level 2 compliance.
WHY CHOOSE POSTAUTH
Six reasons the hardest control
becomes the first one you finish
- 01ACCESS CONTROL
Automated access controls for CUI
Users handle CUI and non-CUI side by side on the same endpoints and servers, with controls set automatically for users, endpoints, applications and files — so you avoid compliance issues without disrupting operations.
- 02FIPS MODULES
FIPS validated cryptographic modules
CUI is FIPS encrypted at all times — at rest, in transit and in use. Combined with automated access controls, there is no need to implement a separate DLP solution to protect against CUI leakage.
- 03NATIVE APPS
Seamless access through native apps
Users can be trained in minutes because files open in native desktop applications inside existing workflows — including the most complex, like Revit, SolidWorks and AutoCAD.
- 04DEPLOYMENT
Implement in a few hours
Setup requires no CUI migration and no change to user workflows or processes. It integrates with your existing security stack: IAM, SIEM, SCIM and HSM.
- 05THIRD PARTIES
CMMC-compliant third-party sharing
Securely share and receive CUI with third parties directly from your endpoints, without setting up multiple accounts or migrating CUI into a cloud sharing platform.
- 06COST
Significantly less expensive
Over 65% less expensive than migrating to Microsoft GCC or a CMMC enclave, and it avoids paying for Gov Cloud virtual machines or VDI environments just so users can open CUI.
THREE ROADS TO LEVEL 2
Same certification.
Very different bills.
Most contractors are quoted a migration. Compare what each path asks of your data, your people and your budget.
COST COMPARISON PER POSTAUTH PUBLISHED FIGURES · SCOPE YOUR OWN ESTATE WITH AN ASSESSOR
A CONTRACTOR’S EXPERIENCE
A different path.
A clear result.
No gaps found
In this manufacturer’s
third-party gap analysis
We chose to implement PostAuth to protect CUI by applying the FIPS validation at the file level, rather than opting for a more expensive enclave solution.
This revolutionary approach allowed us to demonstrate that our controls and protections for CUI met CMMC compliance during a gap analysis conducted by a third-party CMMC assessor.
The assessor found no gaps or issues with this innovative method for handling and securing CUI.
NIST SP 800-171 / CMMC LEVEL 2
Find the control.
See the support.
Choose a named family to review the control references and how PostAuth supports them.
POSTAUTH CAPABILITIES
From control
to supporting evidence.
Connect the way you protect CUI to the records and architecture your assessment team needs to review.
ASSESSMENT PREPARATIONProtection.
Records.
Accountability.
Review your CUI workflow Records.
Accountability.
Build the evidence around
your actual environment.
CAPABILITY INDEX06 AREAS TO EXPLORE
01ATTESTATIONNIST SP 800-171 attested solution
NIST SP 800-171 attested solution
The SaaS platform is built and operated in alignment with all 14 control families and 110 requirements — suitable for contractors preparing for CMMC Level 2 or DFARS 7012.
02KEY MANAGEMENTHighest standards in key management
Highest standards in key management
Per-file encryption keys, an HSM for master keys, and integration with your enterprise HSM infrastructure — for environments where cryptographic assurance is a compliance pillar.
03EVIDENCEDetailed evidence reports for auditors
Detailed evidence reports for auditors
Audit-ready reports are generated automatically, showing who accessed what, when and where, alongside cryptographic enforcement logs.
04INCIDENT RESPONSEStreamlined incident response
Streamlined incident response
Every access attempt and failure is logged from any location, so a forensic access report can scope an incident fast and support the 72-hour DFARS 7012 window.
05SHARINGCompliant CUI sharing and receiving
Compliant CUI sharing and receiving
Exchange CUI with third parties while maintaining NIST SP 800-171 and DFARS 7012 compliance — encrypted in transit and at rest, with access control enforced post-transfer.
06EXITEasy offboarding
Easy offboarding
Files can be decrypted using your Customer Master Encryption Key at any point, which removes reliance on PostAuth for decryption.
DATA FLOW ARCHITECTURE
CUI never leaves your storage
to become compliant
Files stay where they are. Keys stay in an HSM. Only authorisation decisions and access events cross the wire.
01 / STORAGE
CUI stays put
On-premises shares, endpoints and servers keep the files. Nothing migrates to a government cloud tenant.
FILE :: LOCAL / ON-PREM
02 / REQUEST
Access is requested
Opening a file triggers verification of user, device and application before any decryption happens.
REQ :: USER + DEVICE + APP
03 / KEY
Key is authorised
Per-file keys are released from the HSM only when policy is satisfied. Master keys never leave it.
HSM :: PER-FILE KEY
04 / EVIDENCE
Event is recorded
Grants and denials stream to your SIEM, forming the enforcement log an assessor asks to see.
LOG :: SIEM STREAM
SIMPLIFIED FLOW · REQUEST FULL ARCHITECTURE DIAGRAM FROM YOUR SE
AVOID CMMC PENALTIES
Out-of-scope users and devices
cannot reach CUI.
Automated access controls let users handle CUI and non-CUI side by side on the same endpoints and servers — which is what removes the need for a separate DLP deployment and shrinks the risk of a mishandling violation.
✓IN-SCOPE USEROpens CUI in SolidWorks on a managed endpoint
✕OUT-OF-SCOPE USERSame file, same share — request denied before decryption
✕UNAPPROVED DEVICEPersonal laptop cannot obtain a key, so CUI stays ciphertext
✕UNAPPROVED APPLICATIONSoftware whitelisting blocks unauthorised apps from the file
✓NON-CUI WORKRuns on the same endpoint, unaffected by CUI controls
FAQ
CMMC compliance, answered.
Scoping is specific to your contracts and your estate — a 30-minute session with an engineer beats a doc.
Handling CUI generally puts a contractor at CMMC Level 2, which aligns to the 110 requirements of NIST SP 800-171. Level 1 covers Federal Contract Information only; Level 3 applies to a narrow set of programmes with the highest-priority CUI. Your contract language and DFARS clauses determine the answer for your organisation.
Implementation of all 110 NIST SP 800-171 requirements across 14 control families, evidenced by a System Security Plan and supporting artefacts. Encryption of CUI at rest and in transit using FIPS-validated cryptography, enforced access control, and auditable access records are among the controls assessors focus on most.
Scope the environment that stores, processes or transmits CUI, implement the controls, document them in an SSP with a POA&M for gaps, then undergo assessment — a third-party C3PAO assessment for most Level 2 contracts, with self-assessment permitted for a limited subset. A gap analysis before the formal assessment is the usual first step.
CMMC requirements are being phased into DoD solicitations, so the operative date depends on when your contracts are awarded or renewed and which phase applies to them. Contractors handling CUI today are already obligated under DFARS 252.204-7012 — check current DoD guidance and your contracting officer for your specific timeline.
Yes — that is precisely what scoping is for. Certification applies to the assessed environment where CUI lives. File-level encryption makes that boundary tighter: because protection travels with the file and out-of-scope users and devices cannot decrypt it, you can keep CUI and non-CUI work on shared endpoints without enlarging the assessment scope.
A System Security Plan, a POA&M for outstanding items, policies and procedures per control family, and evidence that controls actually operate — access records, cryptographic enforcement logs and configuration proof. PostAuth generates audit-ready reports showing who accessed what, when and where, which supplies much of that operational evidence directly.
YOUR NEXT MOVE
Start certification with
the hard part already done.
Thirty days, your own CUI, your own CAD and Office workflows. No migration, no enclave, no change to how your people work.