DarkShield<\/a> is commonly used to locate and classify CUI before assessments.<\/span><\/p>\nQ:\u00a0 Does masking replace encryption?<\/b>
\n<\/b>No. Masking complements encryption by reducing exposure in authorized use cases.<\/span><\/p>\nQ:\u00a0 Can IRI handle unstructured CUI like PDFs and emails?<\/b>
\n<\/b>Yes, including scanned documents and images.<\/span><\/p>\nQ:\u00a0 Is masked data still usable for testing and analytics?<\/b>
\n<\/b>Yes. IRI supports format-preserving and rule-based masking.<\/span><\/p>\nQ:\u00a0 Does this help with insider threat mitigation?<\/b>
\n<\/b>Yes, by eliminating unnecessary access to clear-text data.<\/span><\/p>\nQ:\u00a0 How does this support least privilege?<\/b>
\n<\/b>By ensuring sensitive values are never present where they are not required.<\/span><\/p>\nQ:\u00a0 Can discovery rules be customized to agency definitions of CUI?<\/b>
\n<\/b>Yes, using extensible pattern libraries and policies.<\/span><\/p>\nQ:\u00a0 Is this applicable to cloud and hybrid environments?<\/b>
\n<\/b>Yes, including on-prem, cloud, and big data platforms.<\/span><\/p>\nQ:\u00a0 Does IRI provide reporting for auditors?<\/b>
\n<\/b>Yes, with detailed discovery and masking reports.<\/span><\/p>\nQ:\u00a0 Can IRI tools run continuously?<\/b>
\n<\/b>Yes, supporting ongoing compliance monitoring.<\/span><\/p>\nQ:\u00a0 Does masking impact application performance?<\/b>
\n<\/b>IRI masking is designed for high performance and scalability.<\/span><\/p>\nQ:\u00a0 Is this relevant to Level 1 contractors?<\/b>
\n<\/b>Yes, especially for FCI minimization and future readiness.<\/span><\/p>\nQ:\u00a0 How does this help beyond compliance?<\/b>
\n<\/b>It improves security posture, reduces breach impact, and enables safer data reuse.<\/span><\/p>\nConclusion<\/b><\/h5>\n
CMMC compliance is ultimately about reducing risk to sensitive defense information. IRI\u2019s data discovery and masking software provides the technical means to operationalize CMMC requirements with precision, scalability, and auditability. For defense contractors and consultants, a data-centric approach not only accelerates certification but also builds a stronger, more resilient security foundation for the long term.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"Abstract The Cybersecurity Maturity Model Certification (CMMC) is a cornerstone of the U.S. Department of Defense (DoD) strategy to safeguard Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) across the Defense Industrial Base (DIB). While CMMC defines what safeguards must be implemented, defense contractors and their consultants still need practical, auditable technologies to operationalize<\/p>\n
Read More<\/a><\/div>\n","protected":false},"author":3,"featured_media":18877,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[8],"tags":[2317,2320,2306,2307,2308,1386,280,14,2318,2314,2311,2312,2309,2313,1388,2289,2315,2310,2316,1750,379,2319],"class_list":["post-18859","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-protection","tag-audit-and-accountability","tag-cloud-and-hybrid-security","tag-cmmc","tag-cmmc-2-0","tag-cui-protection","tag-darkshield","tag-data-discovery","tag-data-masking","tag-data-minimization","tag-data-centric-security","tag-defense-industrial-base","tag-dod-cybersecurity","tag-fci-protection","tag-federal-compliance","tag-iri-darkshield","tag-iri-data-protector-suite","tag-least-privilege","tag-nist-sp-800-171","tag-risk-management-framework","tag-sensitive-data-protection","tag-test-data-management","tag-unstructured-data-security"],"acf":[],"yoast_head":"\nMasking Data for CMMC Compliance - IRI<\/title>\n<meta name=\"description\" content=\"Explore the CMMC framework to enhance cybersecurity across the Defense Industrial Base and protect crucial information.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Masking Data for CMMC Compliance\" \/>\n<meta property=\"og:description\" content=\"Explore the CMMC framework to enhance cybersecurity across the Defense Industrial Base and protect crucial information.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/\" \/>\n<meta property=\"og:site_name\" content=\"IRI\" \/>\n<meta property=\"article:published_time\" content=\"2025-12-17T22:45:40+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-10T19:08:02+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/Featured-Image-cmmc-compliance.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1110\" \/>\n\t<meta property=\"og:image:height\" content=\"532\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"David Friedland\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"David Friedland\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/\"},\"author\":{\"name\":\"David Friedland\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/cdb89f0c0a9c88810b8516d4b140734a\"},\"headline\":\"Masking Data for CMMC Compliance\",\"datePublished\":\"2025-12-17T22:45:40+00:00\",\"dateModified\":\"2026-03-10T19:08:02+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/\"},\"wordCount\":1222,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/Featured-Image-cmmc-compliance.png\",\"keywords\":[\"Audit and Accountability\",\"Cloud and Hybrid Security\",\"CMMC\",\"CMMC 2.0\",\"CUI Protection\",\"DarkShield\",\"data discovery\",\"data masking\",\"Data Minimization\",\"Data-Centric Security\",\"Defense Industrial Base\",\"DoD Cybersecurity\",\"FCI Protection\",\"Federal Compliance\",\"IRI DarkShield\",\"IRI Data Protector Suite\",\"Least Privilege\",\"NIST SP 800-171\",\"Risk Management Framework\",\"sensitive data protection\",\"test data management\",\"Unstructured Data Security\"],\"articleSection\":[\"Data Masking\/Protection\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/\",\"url\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/\",\"name\":\"Masking Data for CMMC Compliance - IRI\",\"isPartOf\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/Featured-Image-cmmc-compliance.png\",\"datePublished\":\"2025-12-17T22:45:40+00:00\",\"dateModified\":\"2026-03-10T19:08:02+00:00\",\"description\":\"Explore the CMMC framework to enhance cybersecurity across the Defense Industrial Base and protect crucial information.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/#primaryimage\",\"url\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/Featured-Image-cmmc-compliance.png\",\"contentUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/Featured-Image-cmmc-compliance.png\",\"width\":1110,\"height\":532},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.iri.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Masking Data for CMMC Compliance\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.iri.com\/blog\/#website\",\"url\":\"https:\/\/www.iri.com\/blog\/\",\"name\":\"IRI\",\"description\":\"Total Data Management Blog\",\"publisher\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.iri.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.iri.com\/blog\/#organization\",\"name\":\"IRI\",\"url\":\"https:\/\/www.iri.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png\",\"contentUrl\":\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png\",\"width\":750,\"height\":206,\"caption\":\"IRI\"},\"image\":{\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/cdb89f0c0a9c88810b8516d4b140734a\",\"name\":\"David Friedland\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.iri.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/995ea08bc7d036da625671cb48a636eb?s=96&d=blank&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/995ea08bc7d036da625671cb48a636eb?s=96&d=blank&r=g\",\"caption\":\"David Friedland\"},\"url\":\"https:\/\/www.iri.com\/blog\/author\/davidf\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Masking Data for CMMC Compliance - IRI","description":"Explore the CMMC framework to enhance cybersecurity across the Defense Industrial Base and protect crucial information.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/","og_locale":"en_US","og_type":"article","og_title":"Masking Data for CMMC Compliance","og_description":"Explore the CMMC framework to enhance cybersecurity across the Defense Industrial Base and protect crucial information.","og_url":"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/","og_site_name":"IRI","article_published_time":"2025-12-17T22:45:40+00:00","article_modified_time":"2026-03-10T19:08:02+00:00","og_image":[{"width":1110,"height":532,"url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/Featured-Image-cmmc-compliance.png","type":"image\/png"}],"author":"David Friedland","twitter_card":"summary_large_image","twitter_misc":{"Written by":"David Friedland","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/#article","isPartOf":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/"},"author":{"name":"David Friedland","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/cdb89f0c0a9c88810b8516d4b140734a"},"headline":"Masking Data for CMMC Compliance","datePublished":"2025-12-17T22:45:40+00:00","dateModified":"2026-03-10T19:08:02+00:00","mainEntityOfPage":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/"},"wordCount":1222,"commentCount":0,"publisher":{"@id":"https:\/\/www.iri.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/#primaryimage"},"thumbnailUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/Featured-Image-cmmc-compliance.png","keywords":["Audit and Accountability","Cloud and Hybrid Security","CMMC","CMMC 2.0","CUI Protection","DarkShield","data discovery","data masking","Data Minimization","Data-Centric Security","Defense Industrial Base","DoD Cybersecurity","FCI Protection","Federal Compliance","IRI DarkShield","IRI Data Protector Suite","Least Privilege","NIST SP 800-171","Risk Management Framework","sensitive data protection","test data management","Unstructured Data Security"],"articleSection":["Data Masking\/Protection"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/","url":"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/","name":"Masking Data for CMMC Compliance - IRI","isPartOf":{"@id":"https:\/\/www.iri.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/#primaryimage"},"image":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/#primaryimage"},"thumbnailUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/Featured-Image-cmmc-compliance.png","datePublished":"2025-12-17T22:45:40+00:00","dateModified":"2026-03-10T19:08:02+00:00","description":"Explore the CMMC framework to enhance cybersecurity across the Defense Industrial Base and protect crucial information.","breadcrumb":{"@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/#primaryimage","url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/Featured-Image-cmmc-compliance.png","contentUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/Featured-Image-cmmc-compliance.png","width":1110,"height":532},{"@type":"BreadcrumbList","@id":"https:\/\/www.iri.com\/blog\/data-protection\/masking-data-for-cmmc-compliance\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.iri.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Masking Data for CMMC Compliance"}]},{"@type":"WebSite","@id":"https:\/\/www.iri.com\/blog\/#website","url":"https:\/\/www.iri.com\/blog\/","name":"IRI","description":"Total Data Management Blog","publisher":{"@id":"https:\/\/www.iri.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.iri.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.iri.com\/blog\/#organization","name":"IRI","url":"https:\/\/www.iri.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png","contentUrl":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2019\/02\/iri-logo-total-data-management-small-1.png","width":750,"height":206,"caption":"IRI"},"image":{"@id":"https:\/\/www.iri.com\/blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/cdb89f0c0a9c88810b8516d4b140734a","name":"David Friedland","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.iri.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/995ea08bc7d036da625671cb48a636eb?s=96&d=blank&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/995ea08bc7d036da625671cb48a636eb?s=96&d=blank&r=g","caption":"David Friedland"},"url":"https:\/\/www.iri.com\/blog\/author\/davidf\/"}]}},"jetpack_featured_media_url":"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/Featured-Image-cmmc-compliance.png","_links":{"self":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/18859"}],"collection":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/comments?post=18859"}],"version-history":[{"count":12,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/18859\/revisions"}],"predecessor-version":[{"id":19070,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/posts\/18859\/revisions\/19070"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/media\/18877"}],"wp:attachment":[{"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/media?parent=18859"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/categories?post=18859"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.iri.com\/blog\/wp-json\/wp\/v2\/tags?post=18859"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/cmmc-2.0-1-1024x558.png\")
<\/p>\n![\"\"](\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/discovery-masking-1-951x1024.png\"){kind=spacer}
<\/b><\/h5>\n![\"\"](\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/integrated-data_protection-1024x580.png\")
<\/p>\n![\"\"](\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/asset-identification.png\")
<\/p>\n![\"\"](\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/access-control.png\")
<\/p>\n![\"\"](\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/data-protection.png\")
<\/p>\n![\"\"](\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/risk-management.png\")
<\/p>\n![\"\"](\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/audit-monitoring.png\")
<\/p>\n![\"\"](\"https:\/\/www.iri.com\/blog\/wp-content\/uploads\/2025\/12\/IRI-data-discovery_masking_scenarios-1024x619.png\")
<\/p>\n