Skip to main content
Live Webinar · Nov 3Register free →
Skip to main content

Commvault decoder/CMMC and NIST 800-171

What Commvault covers for CMMC Level 2.

The NIST SP 800-171 Rev. 2 requirements Commvault helps you meet, where to set each one up, the evidence an assessor will ask for, and what's still your job.

Mapped
25
Met directly
10
FIPS 140-3
#4989

Read this first

  1. 01

    Only one requirement names backups

    Rev. 2 has no contingency planning family. 3.8.9 is the only requirement about backups, and it's about confidentiality. Immutability and recovery mostly support incident response (3.6) and your SSP.

  2. 02

    Commvault covers its own scope

    Settings like MFA, lockout and audit logging apply to Commvault itself. Your identity provider, servers and network need their own evidence.

  3. 03

    Backups with CUI are in scope

    Repositories that hold CUI are CUI assets under 32 CFR 170.19, and the CommServe that controls them almost certainly belongs in your assessment scope too.

Menu paths are from Commvault's documentation for release 11.46 and move between releases. Points are the DoD Assessment Methodology values in 32 CFR 170.24. This is KELYN's reading, checked in November 2026; Commvault doesn't publish its own CMMC mapping.

Access control

3.1.1

Limit system access to authorized users, processes and devices.

Partly coveredPoints: 5POA&M: not allowed

How Commvault helps

Named users and user groups, with SAML single sign-on to your identity provider. Security associations tie each user or group to a role and the objects they can act on.

Manage > Account > Security > Users and User groups; Identity servers for SAML

Evidence

Export of users and user groups; screenshot of the SAML identity server; the Security Cleanup report showing no unused accounts.

Still yours

Joining, moving and removing people happens in your identity provider, and the policy is yours.

3.1.2

Limit access to the types of transactions and functions users are permitted to perform.

Partly coveredPoints: 5POA&M: not allowed

How Commvault helps

Roles are permission sets, applied to specific clients, plans or storage through security associations.

Manage > Account > Security > Roles

Evidence

Role definitions; the user and user group permissions report or User Capability report.

Still yours

Deciding who needs which role, and reviewing it on a schedule.

3.1.4

Separate the duties of individuals to reduce the risk of malevolent activity without collusion.

Met directlyPoints: 1POA&M: allowed

How Commvault helps

Multi-person authorization: deleting clients, plans, jobs or storage copies, and disabling compliance lock, need approval from a second admin. Changing the approval settings needs approval too.

Manage > Account > Security > Multi person authorization

Evidence

Screenshot of the approver group and approval count; one approval request and its decision from the audit trail.

Still yours

Defining separation of duties across your other systems.

3.1.5

Employ least privilege, including for security functions and privileged accounts.

Partly coveredPoints: 3POA&M: not allowed

How Commvault helps

Custom roles scoped to the minimum each team needs, with restore and delete authorization limited to a few people.

Manage > Account > Security > Roles

Evidence

A role matrix showing who holds admin, restore and delete rights; the Security Posture report items for restore and delete authorization.

Still yours

The same discipline everywhere else, especially domain admin accounts that could reach the backup servers.

3.1.7

Prevent non-privileged users from executing privileged functions and log those executions.

Partly coveredPoints: 1POA&M: allowed

How Commvault helps

Role checks block unpermitted actions, and the Audit Trail records operations by severity.

Monitor > Reports > Audit Trail

Evidence

Audit Trail export filtered to high and critical operations.

Still yours

Logging privileged functions on the operating systems Commvault runs on.

3.1.8

Limit unsuccessful logon attempts.

Met directlyPoints: 1POA&M: allowed

How Commvault helps

Account lockout threshold and duration for Commvault accounts. The Security Posture report checks both.

Manage > CommCell > Settings

Evidence

Screenshot of the lockout settings; the Security Posture report.

Still yours

With SAML sign-in, lockout is enforced by your identity provider, so the evidence comes from there.

3.1.9

Provide privacy and security notices consistent with applicable CUI rules.

Met directlyPoints: 1POA&M: allowed

How Commvault helps

A custom sign-in message shown on the Command Center login page.

Manage > CommCell > Settings > Custom Sign-in Message

Evidence

Screenshot of the login page showing the banner.

Still yours

The banner wording, approved by your legal or security team.

3.1.11

Terminate a user session automatically after a defined condition.

Met directlyPoints: 1POA&M: allowed

How Commvault helps

Command Center sessions time out after inactivity, and the option to stay signed in can be hidden.

Session timeout additional setting (documented for releases through 2024E); check the current path for your release

Evidence

Screenshot of the timeout setting; the Security Posture report's Command Center timeout item.

Still yours

Session limits on the servers and jump hosts admins use to reach Commvault.

Audit and accountability

3.3.1

Create and retain audit logs to enable monitoring, analysis, investigation and reporting.

Partly coveredPoints: 5POA&M: not allowed

How Commvault helps

The Audit Trail keeps critical and high-severity records for a year by default, and can forward audit records, alerts and events to a syslog server over TLS.

Monitor > Reports > Audit Trail; Manage > Settings > Diagnostics > Syslog server

Evidence

Audit retention settings; the syslog configuration; sample Commvault events in your SIEM.

Still yours

Your organization-wide logging policy and how long logs are kept.

3.3.2

Ensure actions can be traced to individual users.

Partly coveredPoints: 3POA&M: not allowed

How Commvault helps

Audit records name the user who acted, as long as everyone signs in with a named account or SAML identity.

Monitor > Reports > Audit Trail, filtered by user

Evidence

Audit export showing actions by named users; proof the built-in admin account is locked away and monitored.

Still yours

Banning shared accounts, and controlling the break-glass account.

3.3.5

Correlate audit review, analysis and reporting processes.

Partly coveredPoints: 5POA&M: not allowed

How Commvault helps

Syslog forwarding gets Commvault's audit trail into your SIEM alongside everything else.

Manage > Settings > Diagnostics > Syslog server

Evidence

A SIEM correlation rule or dashboard that includes Commvault as a source.

Still yours

The correlation itself happens in your SIEM.

3.3.8, 3.3.9

Protect audit information and tools, and limit audit management to a few privileged users.

Partly coveredPoints: 1 eachPOA&M: allowed

How Commvault helps

Audit data lives in the CommServe database and is reachable only through roles; a TLS syslog copy keeps a record outside Commvault.

Manage > Account > Security > Roles; Syslog server

Evidence

List of who can change audit and syslog settings; your SIEM's retention and write-protection settings.

Still yours

Protecting the SIEM copy.

Configuration management

3.4.2

Establish and enforce security configuration settings.

Partly coveredPoints: 5POA&M: not allowed

How Commvault helps

Security IQ's Security Posture report checks Commvault's own settings: lockout, password rules, MFA, SSO, timeouts, encryption, key management, compliance lock and ransomware protection.

Monitoring > Security IQ > Security posture

Evidence

A dated posture report, ideally a few over time to show it's kept up.

Still yours

Baselines for every other system, including the servers Commvault runs on.

Identification and authentication

3.5.3

Use multifactor authentication for privileged accounts and for network access to non-privileged accounts.

Met directlyPoints: 5, or 3 if MFA covers only remote and privileged usersPOA&M: not allowed

How Commvault helps

Two-factor authentication with a PIN or FIDO2 security key, for the whole CommCell or chosen user groups, or MFA inherited from your SAML identity provider.

Manage > CommCell > Enable two-factor authentication

Evidence

Screenshot of the two-factor setting, or your identity provider's MFA policy covering Commvault; the posture report's MFA item.

Still yours

MFA for the operating systems and the network paths admins use.

3.5.7

Enforce a minimum password complexity.

Met directlyPoints: 1POA&M: allowed

How Commvault helps

A password complexity requirement for Commvault's local accounts.

Manage > CommCell > Settings

Evidence

Screenshot of the complexity setting.

Still yours

Password rules in your identity provider. Password reuse (3.5.8) isn't covered by Commvault's documented settings.

Incident response

3.6.1

Establish an incident-handling capability that includes preparation, detection, analysis, containment, recovery and user response.

Partly coveredPoints: 5POA&M: not allowed

How Commvault helps

Recovery is the part Commvault owns: anomaly detection on backup data, threat scans to find a clean recovery point, and Commvault Cleanroom to restore into an isolated environment.

Monitoring > Threat indicators; Secure > Cleanroom recovery

Evidence

Your incident response plan, with the backup recovery procedure in it; the threat-indicator alert settings; the cleanroom runbook.

Still yours

The plan, the roles and the DFARS 252.204-7012 72-hour report to DoD.

3.6.3

Test the organizational incident response capability.

Partly coveredPoints: 1POA&M: allowed

How Commvault helps

Cleanroom recovery tests, with the Cleanroom Recovery Readiness report as a dated record.

Secure > Cleanroom recovery; Monitor > Reports

Evidence

Dated test report with the recovery time achieved, plus after-action notes.

Still yours

The tabletop exercise and lessons learned.

Media protection

3.8.9

Protect the confidentiality of backup CUI at storage locations.

Met directlyPoints: 1POA&M: allowed

How Commvault helps

Encryption on storage pools, keys held in an external key manager if you want them, restores limited by role, and deletes behind multi-person approval. Immutable locks and Commvault AirGap protect against deletion, not disclosure, so they support this requirement rather than meet it.

Storage pool > Configuration > Encryption; Manage > Settings > Key management servers

Evidence

Screenshot of storage-pool encryption showing the cipher (AES); key manager configuration; list of roles allowed to restore.

Still yours

Physical media such as tape, and access policies on any cloud storage accounts you own.

Security assessment

3.12.3

Monitor security controls on an ongoing basis to ensure they stay effective.

Partly coveredPoints: 5POA&M: not allowed

How Commvault helps

Security IQ tracks the posture score over time and can alert when it changes.

Monitoring > Security IQ > Alerts

Evidence

The alert definition and the score history.

Still yours

Continuous monitoring for everything outside the backup system.

System and communications protection

3.13.8

Use cryptography to prevent unauthorized disclosure of CUI in transit.

Met directlyPoints: 3POA&M: not allowed

How Commvault helps

Traffic between Commvault components runs in mutually authenticated TLS 1.3 tunnels. The FIPS tunnel mode needs every component on release 11.36 or later.

Network topology and network route settings

Evidence

Network route configuration; a list of component versions.

Still yours

Encryption for traffic Commvault doesn't carry.

3.13.10

Establish and manage cryptographic keys.

Partly coveredPoints: 1POA&M: allowed

How Commvault helps

Integrates with KMIP key managers, AWS KMS and Azure Key Vault, which protect each storage pool's master key.

Manage > Settings > Key management servers (Manage > Security in 11.40 and 11.42)

Evidence

Screenshot of the key management server; key rotation records from the key manager.

Still yours

The key lifecycle policy: who can rotate, recover or destroy keys.

3.13.11

Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.

Met directlyPoints: 5, or 3 if encrypted but not FIPS-validatedPOA&M: only if not FIPS

How Commvault helps

The Commvault Crypto Library 3.0 is FIPS 140-3 validated (CMVP certificate #4989), and Command Center can run in FIPS mode. It only counts when the approved mode and approved ciphers such as AES are in use.

Storage pool encryption cipher; FIPS mode for the Command Center web service; FIPS tunnel mode

Evidence

The CMVP certificate; the CommServe version properties showing Crypto Library 3.0; the cipher setting; the web service log confirming FIPS mode.

Still yours

Confirming the module covers your operating systems, and FIPS-validated crypto everywhere else CUI is encrypted.

3.13.16

Protect the confidentiality of CUI at rest.

Met directlyPoints: 1POA&M: allowed

How Commvault helps

Storage-pool encryption and external key management, as for 3.8.9.

Storage pool > Configuration > Encryption

Evidence

The same evidence as 3.8.9.

Still yours

CUI at rest on every system other than the backups.

System and information integrity

3.14.2

Provide protection from malicious code.

Partly coveredPoints: 5POA&M: not allowed

How Commvault helps

Threat scans look for malware and encrypted or corrupted files in backup data before you restore it.

Monitoring > Threat indicators

Evidence

A threat indicators report.

Still yours

Endpoint protection on every system. Scanning backups doesn't replace it.

3.14.6, 3.14.7

Monitor systems to detect attacks and indicators of attack, and identify unauthorized use.

Partly coveredPoints: 5 and 3POA&M: not allowed

How Commvault helps

Anomaly detection and threat-indicator alerts flag unusual changes in backup data, such as mass encryption or deletion.

Monitoring > Threat indicators; Security IQ alerts

Evidence

Alert definitions and SIEM tickets raised from Commvault alerts.

Still yours

Your main detection tools. Backup anomaly alerts add a signal; they aren't the monitoring program.

FIPS-validated encryption

Validated only counts in approved mode.

The Commvault Crypto Library 3.0 holds FIPS 140-3 certificate #4989, and Command Center's FIPS mode uses a separately validated module (#4743). Older certificates for the 2.0 library were FIPS 140-2; some Commvault pages still cite them.

For 3.13.11, check three things: storage encryption uses AES, not one of the older ciphers the library also supports; Command Center and network tunnels run in FIPS mode, which needs every component on 11.36 or later; and your operating systems are covered by the certificate or Commvault's statement about them.

Commvault Cloud for Government

FedRAMP High, with a responsibility matrix.

Commvault Cloud for Government is listed on the FedRAMP Marketplace at Class D (High), which exceeds the FedRAMP Moderate bar DFARS 252.204-7012 sets for cloud services that store CUI. Commvault also lists GovRAMP High and states it meets DoD Impact Level 5 requirements.

SaaS moves many requirements to Commvault, but not all. Ask for the customer responsibility matrix in its FedRAMP package; it's the document that says which parts are still yours, and it belongs with your SSP.

Commvault Cloud for Government from KELYN

Turn this into evidence

Free AI prompts for the paperwork.

Questions

No product does. Commvault can meet several NIST SP 800-171 requirements for the backup system itself and supports others, but most requirements also depend on your identity provider, endpoints, network, policies and people. Your System Security Plan has to describe all of it.

Yes, if they hold CUI. Backup repositories that store CUI are CUI assets under the CMMC rule (32 CFR 170.19), and the systems that manage and protect them, such as the CommServe, are likely security protection assets. Both belong in your scope and your SSP.

The Commvault Crypto Library 3.0 holds FIPS 140-3 certificate #4989 in NIST's Cryptographic Module Validation Program, and Command Center's FIPS mode uses a separately validated module. Validation only counts when the approved mode and approved ciphers such as AES are in use, so check your storage encryption settings and the operating systems listed on the certificate.

Some can. Under 32 CFR 170.21, only 1-point requirements can be on a POA&M for conditional Level 2 status, plus 3.13.11 when you encrypt but not with FIPS-validated cryptography. 3.8.9 is a 1-point requirement; 3.1.1, 3.3.1 and 3.5.3 are not. Open items must be closed within 180 days.

Not publicly, as far as we could find. Commvault publishes a general shared responsibility model for Commvault Cloud. For Commvault Cloud for Government, ask for the customer responsibility matrix in its FedRAMP package, through the FedRAMP package request process or your Commvault representative or MSP.

It's listed on the FedRAMP Marketplace at Class D (High), which exceeds the FedRAMP Moderate requirement for cloud services that store CUI under DFARS 252.204-7012. You still have to implement the customer responsibilities in its package, and meet the clause's incident reporting rules yourself.

Want an engineer to check your Commvault setup?

KELYN runs Commvault for defense contractors and agencies. We'll review your configuration against these requirements and help you collect the evidence.

Talk to an engineerScore your readiness