AppSec Tooling Under CMMC: A Contractor's Checklist

Many federal contracts now expect a software bill of materials, and the ability to generate one cleanly from your scanning tool saves real time versus assembling one by hand. Confirm your candidate tool can export a standard-format SBOM directly, and check that it covers the full dependency tree, not just top-level packages, since an assessor or a downstream prime may ask for the detail.

A prime contractor flowing requirements down to a subcontractor will often ask for this specific detail directly, so it's worth confirming before the request arrives rather than after.

NIST SP 800-171 includes controls for scanning for vulnerabilities, remediating them, and correcting system flaws, and your scanning and remediation records can serve as evidence for those controls during a CMMC assessment. Whichever tool you choose, make sure it can produce a clean export of findings and fix history mapped to a specific time window, since that export is what an assessor will actually want to see.

Don't wait for the assessor to ask before checking whether your tool's export actually lines up with how the control is worded.

Federal Binding Operational Directives set the pace here directly: fifteen calendar days for a critical vulnerability on an internet-accessible system, thirty for a high-severity one, and roughly fourteen days for a vulnerability already on the government's known exploited list¹. A contractor holding itself to that same standard internally, even on systems not directly covered by the directive, has a much easier story to tell during an assessment than one operating on an informal, undocumented timeline.

If your development happens inside a GitHub Enterprise environment with the appropriate government cloud configuration, GitHub Advanced Security keeps scanning and its records inside that same boundary, which simplifies your data-handling story for an assessor. If your environment spans multiple platforms or an air-gapped network, Snyk's platform independence may fit better, but confirm directly with the vendor how their hosting and data handling align with your specific contract's requirements before committing, since this is not a detail to guess at.

The real test isn't whether scanning happens day to day, it's whether you can hand an assessor a clean export of findings, fix dates, and SBOMs covering the assessment period without a week of manual assembly beforehand. Run a practice export at least once before your actual assessment window, specifically to find out what's missing, rather than discovering the gap during the real thing.

A practice evidence export should include:

• Findings from the scanning tool covering the full assessment period, not just the most recent scan.
• Fix dates for each finding, so the assessor can compare remediation timing against the deadlines you committed to.
• SBOMs in a standard format, exported directly from the tool rather than assembled by hand.
• A named owner for the export, so the process runs between assessments and not only just before one.

CMMC and NIST 800-171 assessments happen periodically, but the vulnerability management process they're checking is supposed to run continuously in between, and a program that only gets attention right before an assessment window tends to have gaps the assessor finds first. Name a specific person or role responsible for the vulnerability management process year-round, not just the assessment prep, so scanning results, fix records, and SBOM exports stay current without a scramble every time an assessment approaches.

This matters even more for a smaller contractor without a dedicated compliance department, where the temptation is to treat the whole process as a once-a-year project rather than an ongoing discipline. An assessor can generally tell the difference between a program that's been running continuously and one that was assembled the month before the assessment, and the difference shows up in exactly the kind of small inconsistencies that turn a routine assessment into a longer one.

Build a recurring calendar reminder into that person's role, separate from the assessment cycle itself, so the review happens on a schedule rather than whenever someone remembers. A contractor that can point to a routine cadence, rather than a single annual scramble, generally has an easier conversation with an assessor about how the program actually runs day to day.