CMMC Narrows Your Construction Software Options

If your firm does work on defense facilities, the question of which construction software you may use is no longer only a procurement decision. The drawings, specifications and submittals on that project can be controlled unclassified information, and there is now a rule in force that governs which systems are allowed to hold it. That rule eliminates a large portion of the construction software market before a feature comparison starts, and it is one of the few genuinely compelling reasons a contractor ends up building rather than buying.

Quick Summary

• Two rules are now in effect: the CMMC program rule since December 2024 and the acquisition rule that puts the clause in contracts since November 2025.
• Level 1 is a fifteen-requirement self-assessment. Level 2 is the 110 requirements of NIST SP 800-171 R2. Level 3 adds twenty-four more and is assessed by the government.
• Controlled information has to sit inside your assessment boundary, which most multi-tenant construction SaaS does not.
• The build-or-buy comparison changes: the alternative to a compliant system can be losing eligibility for the work.
• CodeBranch builds to a control set and does security assessment work. It does not certify CMMC — that is an accredited assessor’s role.

This is a case where the gap described in what construction companies build when their platform runs out is created by regulation rather than by workflow. The platform may model your business perfectly and still be unusable.

What Is Actually In Force Right Now?

Two rules, and they do different jobs.

The program rule came first. The CMMC Program final rule, published in the Federal Register in October 2024 and effective 16 December 2024, establishes the levels, the assessment types and a four-phase implementation plan running over three years.

The second rule is the one that reaches contracts. The DFARS acquisition rule took effect on 10 November 2025 and adds the contract clause at 252.204-7021 and the solicitation provision at 252.204-7025. Until three years after that date, the clause is applied where the requiring activity decides a CMMC requirement belongs in the contract; after that window it applies wherever a contractor’s systems will process, store or transmit federal contract information or controlled unclassified information.

That phase-in is the practical detail. It means a contractor who sees no CMMC clause in a solicitation today should not conclude the question is settled, because the same work rebid in two years may carry one.

The levels, as the program rule defines them:

• Level 1 — fifteen requirements, self-assessed annually, results entered into the government’s reporting system.
• Level 2 — the 110 requirements of NIST SP 800-171 Revision 2, either self-assessed every three years or assessed by an accredited third-party organization, depending on the contract.
• Level 3 — those 110 plus twenty-four selected requirements from NIST SP 800-172, assessed by the government’s own assessment centre, and only after a third-party Level 2 status is held.

Which Construction Data Is Actually In Scope?

More of it than most firms expect, and less than a panicked reading suggests.

Controlled unclassified information is not a property of the file type; it is a determination that comes from the contract and the agency. In practice, on defense facility work, the categories that commonly land in scope are site and floor plans for controlled facilities, security system drawings and specifications, utility and network infrastructure layouts, and photographs taken inside restricted areas. Submittals and RFIs become in scope when they reproduce any of the above, which they routinely do.

The practical test is not which software a document lives in. It is whether the document, if it reached the open internet, would tell someone useful things about a facility the government would rather they did not know.

Two things follow that people get wrong in both directions. Everything on a defense project is not automatically controlled — a schedule of general conditions usually is not. And a document does not become uncontrolled because it was emailed to a subcontractor, which is exactly how most of these exposures occur.

Why Does This Remove Most Construction Platforms From Consideration?

Because the data has to sit somewhere you can assess, and a multi-tenant cloud is not that place.

Read across and the trade becomes clear. The platforms that fit construction workflow best are the ones that put your data furthest outside your boundary, and the options that keep the data close are the ones you have to do more work to make useful.

This is why compliance drives custom development in this vertical more than it does elsewhere. It is not that bespoke software is inherently more secure — a badly built custom system is worse than a well-run platform. It is that the set of construction products that can be deployed inside a contractor’s own assessed environment is small, and when none of them fits the work, there is no off-the-shelf answer left.

How Does This Change a Build-or-Buy Decision?

It changes what the build is being compared against.

Normally the comparison is a subscription against a development budget, and the subscription usually wins. When a control set is in play, the alternative to having a compliant system can be not bidding a category of work — which turns the question from a cost comparison into a market access one. A contractor who does ten per cent of revenue on defense work is weighing the development cost against that ten per cent, not against a licence fee.

The order of investigation should still start with the cheapest options:

1. Can an existing product be deployed inside your boundary? Many vendors offer a self-hosted or government-community deployment. This is the least work when it exists.
2. Can the controlled subset be separated? Often only a fraction of project data is in scope. Keeping that fraction in a restricted system and everything else on your normal platform is smaller than rebuilding everything.
3. Is a purpose-built system the remaining option? Only after the first two fail.

That sequence matters because step two is frequently skipped, and it is often the right answer. The scope of what is controlled is narrower than the scope of a project, and designing around that boundary is much cheaper than treating the whole business as in scope. This is the same discipline as the broader question of when custom construction software is not the answer, applied to a case where the constraint is external.

What Does This Work Involve, and What Is Out of Scope?

It is worth being precise, because the market around this is full of overlapping claims.

CodeBranch builds software with security as a delivery requirement rather than a late-stage audit, and does independent security assessment work: two cybersecurity specialists from the team spent two years providing a final audit layer on top of a cybersecurity firm’s own testing pipeline, using static and dynamic application security testing, manual penetration testing and secure code review to surface findings that both the human team and the automated tools had missed. The team has also structured an AI-assisted security reporting system that consolidates the outputs of multiple assessment tools into a single gap report.

What CodeBranch does not do is assess or certify CMMC compliance. That is the role of an accredited third-party assessment organization, and no development partner can perform it for a system they also built. A firm that offers to build your system and certify it is describing a conflict, not a service.

The division of labour that works: your assessor determines the applicable level and scope, that determination becomes a requirement set, and the development partner builds against it. When controls arrive as requirements in the first phase, they are architecture. When they arrive after a system exists, they are rework.

When Does None of This Apply?

When no federal contract information or controlled unclassified information touches your systems.

A contractor doing private commercial and residential work has no CMMC obligation and should not spend a day on it. Neither should a firm whose only federal exposure is a subcontract where the prime holds all the controlled information and shares none of it — though that arrangement is worth confirming in writing rather than assuming, because it determines whether a flow-down clause lands on you.

For everyone else, the useful posture is to find out what your contracts actually say before the phase-in closes the discretion window. The answer determines the software decision, and the software decision is slower to reverse than the contract is to sign. That assessment is the kind of constraint CodeBranch builds into the Product Definition phase of software for construction companies, where a control set is a requirement like any other — just one you cannot negotiate.