The DIY CMMC Trap: Why an Encryption Platform Alone Won’t Get You Through an Assessment.

Editor's note: CMMC has been updated several times since this post was first published, most recently when the Department of War suspended Phase 2 in July 2026. We have also rebranded: Intech Hawaii is now Intech Pacific. We updated this post in October 2026 to reflect the current state of the program. For the latest information, see our CMMC Overview and our CMMC Calendar.

Last updated: October 2026

A CMMC plan built only on a do-it-yourself encryption platform will not hold up in a CMMC assessment. These platforms promise fast, affordable Level 2 compliance through encrypted email, encrypted file sharing, and pre-filled documentation templates, and some advertise support for more than 90 percent of the 110 NIST SP 800-171 requirements. The encryption is real. The coverage claim is misleading. Contractors who rely on it instead of a qualified CMMC provider in Honolulu usually find out during the assessment, when the scope expands and the evidence is not there. This post covers the control gaps, the scoping problem, what assessors look for, and what Level 2 actually takes.

What "Over 90 Percent" Actually Means

The coverage figure is misleading in two ways.

Shared responsibility. Many of the "supported" requirements are shared, not inherited. A shared requirement still needs your people, your processes, and your evidence. The platform contributes one piece.

Uncovered requirements. Even if you accept the vendor's number, several requirements fall completely outside an encrypted email and file product. Some of them carry high point values or are never eligible for a POA&M under 32 CFR 170.21. If one of those is not met, you cannot receive Conditional Level 2 status, and there is no 180-day window to fix it.

Requirements an Encryption Platform Does Not Touch

These requirements have nothing to do with encrypted email or file sharing. You must meet them separately.

1. Session lock with pattern-hiding display (3.1.10). Devices must lock after inactivity and hide what was on screen. That takes endpoint management such as Microsoft Intune or Group Policy, with evidence across every device in scope.
2. Authorize wireless access (3.1.16). Wireless access inside the CUI boundary must be authorized, with policies and technical enforcement.
3. Control publicly accessible information (3.1.22). CUI must not appear on websites, portals, or social media. This requirement is never eligible for a POA&M.
4. Track, document, and report incidents (3.6.2). DFARS 252.204-7012 requires reporting cyber incidents through the DoD Cyber Crime Center (DC3) reporting portal within 72 hours of discovery, using a DoD-approved medium assurance certificate.
5. Test incident response capability (3.6.3). A written plan is not enough. Assessors want evidence of tabletop exercises or other tests.
6. System Security Plan (3.12.4). A template is not an SSP. Your SSP must describe your actual network, data flows, and people. This requirement is also never eligible for a POA&M.
7. Prohibit remote activation of collaborative devices (3.13.12). Webcams, microphones, and conference devices must not be remotely activated and must show when they are in use.
8. Control and monitor VoIP (3.13.14). Your phone system needs usage rules and monitoring.

The Shared Responsibility Illusion

Even for "supported" requirements, the platform covers only its own application. Examples:

• Access control (3.1.1): the platform controls who opens a file in its app. You still control access to every firewall, server, workstation, and room in scope.
• Awareness training (3.2.1 to 3.2.3): you need a documented program, including insider threat awareness. The platform cannot train your staff.
• Configuration management (3.4.1 to 3.4.9): baselines, change control, and software restrictions apply to every system in scope.
• Maintenance (3.7.1 to 3.7.6): maintenance must be controlled and logged, remote maintenance sessions need strong authentication, and equipment removed for repair must be sanitized.
• Personnel and physical security (3.9.1 to 3.10.6): screening, terminations, visitor control, and physical access logs.
• Risk and security assessment (3.11.1 to 3.12.3): risk assessments, vulnerability scanning, plans of action, and continuous monitoring.

A large share of the 110 requirements are policy, process, and people controls. No software product satisfies them on its own.

Encryption Does Not Create a Boundary

Some vendors imply that encrypting CUI shrinks your assessment scope. The DoW CIO has rejected that idea.

In its CMMC FAQ, updated in January 2026, the DoW CIO answers "No" to whether encryption alone can create logical separation within a CMMC assessment scope. Encryption provides confidentiality, but it does not prevent data transfer or enforce a network boundary. Logical separation comes from controls such as firewalls, routing rules, and segmentation.

The same FAQ answers "Yes" to whether encrypted CUI is still CUI. CUI remains controlled until it is formally decontrolled. That has two consequences:

• An encrypted folder on a shared network is not an enclave. If you cannot show enforced separation, the whole network may be in scope.
• Encrypted CUI still has to be stored in a cloud service that meets FedRAMP Moderate or equivalent. Encryption does not make a non-compliant cloud acceptable.

The Endpoint Blind Spot

CUI has to be decrypted to be read, and that happens on the user's device. If that device is compromised, cloud encryption does not help. Assessors expect to see:

• Endpoint detection and response on every device in scope.
• Full-disk encryption using FIPS-validated modules.
• Mobile device management for phones and tablets that access CUI.
• Host-based firewalls.
• Application control.
• Enforced patch management.

Each of these takes tools, licenses, and documentation that an encryption platform does not provide.

The CUI Data Flow Problem

Here is a scenario I see often. An employee downloads a CUI drawing from the encrypted platform, saves it to the desktop, attaches it to a normal Outlook email, and a colleague opens it on a personal phone. CUI just left the protected path four times.

Assessors trace data flows end to end, and they interview employees about how CUI moves. Shadow CUI is one of the most common gaps with overlay tools. Policies are not enough. Technical controls must actively prevent CUI from leaving the boundary.

What C3PAO Assessors Look For in a Honolulu CMMC Assessment

Persistence over time. Assessors want proof that controls have operated consistently. Quarterly access reviews mean records from several past quarters, not one spreadsheet built the week before.

Interviews. Assessors talk to staff at several levels. If people cannot explain how they handle CUI, that becomes a finding regardless of the technology.

Evidence for every objective. The 110 requirements break into 320 assessment objectives in NIST SP 800-171A. Each needs evidence: policies, procedures, logs, training records, and scan results.

Scope verification. The assessor validates your boundary. A boundary built on encryption alone will not survive this step.

The July 2026 suspension of Phase 2 means most contracts now accept a self-assessment instead of a C3PAO certification. That does not lower the bar. Your SPRS score and annual affirmation must be accurate, DIBCAC can still assess you, and primes can still require certification. A Honolulu contractor that self-assesses on the strength of an encryption platform is taking on False Claims Act risk. In June 2026, LOGZONE settled for $507,144 after reporting an SPRS score of 110 when DIBCAC found -170.

The Documentation Trap

Documentation is the most common gap I find. In more than 100 gap assessments, no company we assessed had the right documentation, including companies that paid a third party to produce it. Templates are a starting point. What assessors need:

• SSP: your actual architecture, inventory, and boundary.
• Procedures: the steps your people actually follow. A procedure that references a tool you do not own is a finding.
• POA&M: real gaps with realistic, assigned dates.
• Policies: specific, approved by leadership, reviewed on a schedule, and consistent with the technical controls.

This takes significant labor. Plan for it.

The Real Cost of the "Affordable" Option

The platform subscription is one line in a much larger budget. Expect additional spending on:

• Technology: endpoint detection and response, mobile device management, SIEM, and vulnerability scanning.
• Network: firewalls and segmentation.
• Physical security: access control, visitor management, and secure storage.
• People: consulting from qualified CMMC Certified Professionals or Certified Assessors, training and phishing simulation, background checks, and ongoing monitoring.

For a 50-person organization doing CMMC across the enterprise, I tell clients to expect about $100,000 to implement, about $75,000 for a C3PAO assessment, and $50,000 to $100,000 per year to maintain. A failed assessment, especially on a requirement that cannot go on a POA&M, puts contracts at risk. When contractors researching CMMC Honolulu providers compare quotes, this full budget is what they should be comparing against.

The Scoping Time Bomb

The pattern usually goes like this:

1. The company deploys an encryption platform and calls it the CUI enclave.
2. It defines the assessment scope around the platform alone.
3. Everything else is excluded.
4. The assessor applies the DoW CIO's position that encryption is not logical separation.
5. The scope expands to the whole corporate network.
6. The newly in-scope systems are unhardened and undocumented.

Fixing this takes real network changes, such as dedicated firewalls, segmentation, and routing controls. That takes months, not days, and it cannot be done during an assessment.

What CMMC Level 2 Takes and What a CMMC Provider in Honolulu Should Cover

No single product delivers compliance. Level 2 takes technology, people, and process:

1. A FedRAMP Moderate or equivalent environment for CUI.
2. Network segmentation enforced by firewalls.
3. Endpoint protection: detection and response, full-disk encryption, and device management.
4. Identity and access management with MFA everywhere.
5. A SIEM for log collection, correlation, and review.
6. Vulnerability management with regular scanning and timely remediation.
7. Documentation that matches your environment.
8. Security awareness training with records and phishing simulations.
9. A tested incident response plan.
10. Physical security for facilities and equipment.
11. Personnel security, including screening and access revocation.
12. Ongoing governance: continuous monitoring and periodic risk assessments.

An encryption platform can be one component of that list. This is not an argument against these platforms. For CUI that is not ITAR or NOFORN, we pair commercial Microsoft 365 with PreVeil Gov Community, and it works because the other eleven items are built around it. A qualified provider should help you plan, build, document, and maintain all twelve.

Talk to Intech Pacific About Your CMMC Assessment

Intech Pacific is the only CMMC Level 2 certified MSP in Hawaii and Guam and the only MSP in the region with CMMC Certified Assessors on staff. We have taken more companies through C3PAO certification than every other company in Hawaii and Guam combined.

To see how we help contractors in Hawaii and Guam, from a free readiness session to fully managed compliance, visit our CMMC Solutions page.