As a Solution Architect here at Anchore, I spend a lot of time talking with defense contractors and organizations responsible for managing Controlled Unclassified Information (CUI). Lately, almost every conversation eventually turns to one looming topic: the reality of CMMC (Cybersecurity Maturity Model Certification) audits and compliance requirements..
The DoD’s CMMC 2.0 final rule officially took effect in November 2025, and what we are seeing in the field right now is both curiosity and anxiety for assessment preparedness. Phase 1 self-assessments are already here, but the real wake-up call is Phase 2, which kicks off on November 10, 2026. In just a few months, Level 2 contractors will face mandatory, third-party C3PAO audits to win or renew DoW contracts.
Many customers assume that simply moving their environments to FedRAMP-authorized cloud services will check the compliance box. It doesn’t, because it is just one part of the story. When it comes to your internal software development lifecycle, specifically securing container images and maintaining a rigorous software inventory, the burden of proof still falls heavily on your engineering and security teams.
For many prospects and customers, maintaining evidence for CMMC audits in regards to their SBOMs and container images is very burdensome. Chasing down vulnerabilities and cross-referencing data doesn’t scale.
We knew our customers needed a better way. They needed to stop treating CMMC compliance as a manual bottleneck and start treating it as an automated, everyday part of their CI/CD pipeline. That’s exactly why we built the Anchore Enterprise CMMC Policy Pack.
Automating the Complexities of CMMC 2.0 and NIST 800-171
As CMMC 2.0 rolls out, organizations have to understand exactly where they fall. While Level 1 handles basic federal contract information, dealing with CUI puts most of our customers firmly in the crosshairs of Level 2 , which maps directly to the stringent NIST SP 800-171 framework.
Securing internal network production environments to these standards requires strict adherence. Rather than asking teams to manually audit their Software Bills of Materials (SBOMs) and container images against these sprawling requirements, we designed the CMMC Policy Pack (available via the Enforce module) to automatically map our policy checks directly to those specific CMMC and NIST controls.
Here is how we help customers automate those technical controls directly out of the box:
| CMMC/NIST 800-171 Control | Anchore Policy Pack Scans | Anchore Enterprise Inspection |
|---|---|---|
| 03.01.07 | Least Privilege | Ensure containers are not running as root |
| 03.05.07 | Password Management | Assess images for secrets in plain text. |
| 03.11.02 | Vulnerability Scanning | Assess images & SBOMs for vulnerabilities & alert if a fix is available |
| 03.04.06 | Least Functionality – Ports | Ensure only authorized ports are open and/or ensure certain ports are denied |
| 03.04.06 | Least Functionality – Software | Deny unauthorized software from being deployed to production |
| 03.11.02 | Vulnerability Scanning – Specific CVE | Search for a specific CVE ID to block a production delivery |
| 03.14.02 | Malicious code protection | Assess images for malware |
| 03.04.01 | Baseline configuration | Software Inventory via a Software Bill of Material (SBOM) |
Fighting Container Drift in Your Base Images
One of the most common pitfalls I see with defense contractors is assuming that if an image passes a scan on Tuesday, it’s compliant on Friday. In the world of containers, container drift is a massive compliance risk. Your base images might be perfectly hardened when you build them, but as new vulnerabilities are discovered or unauthorized changes are made in production, that secure baseline “drifts” out of compliance.
To ensure technical controls don’t just exist on paper but are actively maintained despite container drift, we see our most successful customers implementing an automated workflow:
- Image & SBOM Analysis: As soon as the build completes, the container image and SBOM are analyzed to generate a definitive list of all the software packages.
- Vulnerability Scanning: The SBOM is assessed against CVE databases and GitHub Security Advisories for the most accurate and data rich experience.
- Policy Evaluation: The CMMC Policy Pack evaluates the image against predefined rules using regulatory guidance and can be modified to add a company’s specific risk posture.
- Governance Gate: Images that fail the CMMC policy check are automatically blocked from promotion to production registries. No manual intervention required.
- Continuous Audit: Existing images in the internal network are continuously monitored to ensure they remain compliant the moment new threat intelligence emerges.
Generating Evidence for Your C3PAO Audit
When your November audit requirements roll around, having accessible evidence is critical. Data is stored in perpetuity by default in Anchore Enterprise, where evidence is maintained for both vulnerabilities and policy compliance. Because all images are continuously monitored for vulnerabilities, auditors can clearly see policy analysis in action right within the platform.
Here is how Anchore Enterprise captures and displays this crucial audit evidence:
- Vulnerability Analysis
All images are continuously monitored for vulnerabilities.
- Policy Analysis in Action
The system generates “WARN” actions for discovered vulnerabilities and “STOP” actions for critical violations, such as an effective user running with root permissions or a missing Dockerfile. As indicated in the image below, the image was issued a “STOP” action because the effective user was running with root permissions and a Dockerfile was not provided. The “WARN” actions shown are due to the vulnerabilities that were discovered.
- Software Inventory
A core component of this evidence is the SBOM. An SBOM is a formal, machine-readable inventory of all the components, libraries, and dependencies that make up a software application or container image.
What’s Next
With the Phase 2 deadline right around the corner, organizations leveraging Anchore Enterprise for CMMC compliance are shifting from a reactive panic to a proactive security model. By building compliance natively into your policy-as-code, producing artifacts simply becomes an inherent part of the development lifecycle rather than a reactive roadblock.
This means that by the time an image is promoted to production or delivered to your DoD customer, you already know it complies with CMMC policies, meets your operational risk tolerance, and has a clear, easily exportable paper trail ready for your C3PAO auditor.
If you want to see how this looks in your own environment before the November 2026 deadline hits, or for more information on automating your compliance workflow, check out anchore.com.
A detailed guide mapping automated container inspections directly to DoW RMF and NIST security controls.
