# DoD Contractors Assess CMMC RMM Tools

A contractor undergoing a CMMC assessment reported that its commercial NinjaOne remote monitoring and management (RMM) tool was cited for lacking FIPS-validated cryptographic modules under control 3.1.13. The contractor scoped the RMM as a Security Protection Asset and said technicians instruct users to close CUI before remote access. Commenters disagreed about whether FIPS validation applies to the tool under that control and whether the RMM enters the CUI boundary, so the issue remains one of assessment interpretation and documented system scope—not a settled determination that every RMM tool requires FIPS validation.

- Procurement and security teams should document the RMM’s system-boundary classification, how remote sessions are conducted, and safeguards intended to prevent CUI from being accessed or transmitted through the tool; they can ask the assessor to clarify the basis for the finding.
- Organizations evaluating RMM products can compare the commercial NinjaOne offering with NinjaOne for Government, which the signal describes as a higher-cost alternative. BeyondTrust was also mentioned as an alternative for remote-support functions.
- The tool’s actual use matters: if it handles or transmits CUI, that raises separate scope and security considerations from a session where CUI is kept outside the remote-access stream.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 05, 2026

### Government Entities
- U.S. Department of Defense (DoD)

### Vendors
- NinjaOne (Provider of the commercial RMM product assessed; a government-oriented offering was mentioned as a higher-cost alternative)
- BeyondTrust (Provider of remote-support software mentioned as an alternative to NinjaOne remote-control features)

### Key Quotes
> If you can prove the RMM tool is outside the CUI boundary during the session, and no CUI is being transmitted over that remote stream, FIPS isn't required for that specific tool.
> — Commenter

### Sources
- [Oh FIPS, everyone's favorite topic. 3.1.13 and RMM tools](https://www.reddit.com/r/CMMC/comments/1wyk82l/oh_fips_everyones_favorite_topic_3113_and_rmm) - reddit-cmmc