Does Cyber Crucible meet CMMC and DFARS requirements for the defense industrial base?

Short answer: Cyber Crucible is not CMMC-certified, and it says so plainly. It supports a defense contractor's obligations under DFARS 252.204-7012 and CMMC primarily by not collecting Controlled Unclassified Information (CUI) and by supporting on-premises or air-gapped deployment inside the contractor's own boundary, where CUI stays under the contractor's control. 
 How it supports the contractor's obligations 
 
 No CUI collected. The endpoint agent analyzes behavior locally without extracting the files it protects, so CUI is not transferred to Cyber Crucible. 
 Boundary-preserving deployment. On-premises and air-gapped models keep all data within the contractor's assessed boundary. 
 Endpoint protection controls. Malware/ransomware prevention and monitoring map to the relevant CMMC practices and NIST SP 800-171 controls the contractor must implement. 
 US supply chain. US data is handled by US-based resources; offshore contractors do not handle US data or develop the agents. The software is EAR-controlled, not ITAR. 
 
 The honest boundary 
 CMMC certification is held by the contractor's environment, not by an individual security tool; Cyber Crucible is a control that supports several 800-171 requirements, not a substitute for the contractor's assessment. Mapping detail is available under NDA.