Control aware compliance assistance
The backend maps requests to relevant CMMC and NIST controls before retrieving evidence and generating a response.
Confidential client case study
CMMC Compliance AI Backend
Agentic RAG, NIST grounded reasoning and structured compliance document generation for CMMC workflows.
A US based compliance technology company engaged Byond Boundrys to build the AI backend for a CMMC documentation platform, including agentic assistance, control aware NIST retrieval, gap assessment, document verification and SSP, POA&M and SRM generation.
Project classification: Byond Boundrys delivered the AI backend and APIs for a US based compliance technology company; the client owned the product, frontend, customer experience and go to market.
Grounded and cited responses
Generated guidance retains standards references so compliance professionals can review the basis of each answer.
Structured gap and document evaluation
Specialised services assess gaps, policies, procedures and evidence against control specific requirements.
01 / Business context
Who needed the solution
A US based compliance technology company building a CMMC exclusive documentation platform engaged Byond Boundrys to architect and build the AI backend that powers their workflow. The platform itself serves defense contractors, Managed Service Providers (MSPs/MSSPs), and CMMC consultants who need to prepare audit ready documentation aligned to CMMC and NIST 800-171. Our scope was strictly the AI/ML layer, an agentic AI compliance chatbot, the NIST focused reasoning engine, the agentic RAG system, gap assessment intelligence, document verification AI, and auto- generation engines for System Security Plans (SSP), Plans of Action and Milestones (POA&M), and Shared Responsibility Matrix (SRM) artifacts. The client owned the product, frontend application, customer experience, and go to market; we delivered the AI services that make the platform work.
02 / Challenge
What needed to change
The backend had to support formal CMMC assessment workflows with control level precision, auditability and privacy boundaries.
Generic LLMs could hallucinate on specialised control languageUnsupported interpretations could undermine assessor confidence and remediation decisions.
Document level RAG lacked control level precisionThe workflow needed retrieval aligned to specific CMMC and NIST 800-171 objectives, not broad document summaries.
Gap assessment spans 110+ Level 2 objectivesThe system required structured reasoning, prioritisation and remediation guidance across many related controls.
Policies and evidence needed objective level verificationUploaded documents had to be scored against specific requirements rather than merely summarised.
SSP, POA&M and SRM outputs had to be assessor readyGenerated artefacts required consistent structure, citations and traceability to validated evidence.
Sensitive CUI required a privacy first architectureThe AI layer was designed without client network access and without retaining sensitive CUI beyond the request lifecycle.
03 / Workflow transformation
Before and after
Previous workflow
- Generic LLM responses were difficult to trust for specialised control language
- Document level search missed objective specific evidence
- Gap assessments required manual reasoning across 110+ objectives
- Policies and evidence were reviewed manually against control requirements
- SSP, POA&M and SRM artefacts required repetitive manual preparation
- Sensitive information could not be exposed through uncontrolled integrations
Structured workflow
- Classify request intent and map it to relevant controls
- Retrieve NIST and client evidence with control aware RAG
- Evaluate posture, gaps and remediation needs through specialised agents
- Verify uploaded documents against objective level requirements
- Generate citation backed SSP, POA&M and SRM artefacts
- Return structured outputs through privacy first backend APIs for human review
04 / Solution
How we approached it
A LangGraph based multi agent service layer decomposed requests into intent detection, control mapping, grounded retrieval, compliance evaluation and structured output generation.
Intent detection
Classify each request as gap assessment, document verification, artefact generation or remediation guidance.
Control mapping
Link the request and supplied evidence to relevant CMMC and NIST 800-171 controls and objectives.
Control aware retrieval
Chunk standards and uploaded documentation at control boundaries, embed the content and retrieve objective level evidence.
Gap assessment engine
Evaluate posture across CMMC Level 2 objectives and return prioritised, NIST cited remediation guidance.
Document analyser
Verify policies, procedures and evidence against specific objectives and return actionable quality feedback.
Artefact generators
Produce structured SSP, POA&M and SRM outputs from validated evidence and control mappings.
05 / Example workflow
From input to reviewable output
1Detect request intent
2Map CMMC and NIST controls
3Retrieve standards and client evidence
4Evaluate posture, gaps or document quality
5Generate cited guidance or structured artefacts
6Human review, correction and action
06 / Delivery scope
What the delivery covered
Compliance workflow capabilities
- Real time control aware compliance chatbot
- Gap assessment across CMMC Level 2 objectives
- Policy, procedure and evidence verification
- NIST cited remediation guidance
- SSP, POA&M and SRM generation
AI, retrieval and evaluation
- LangGraph multi agent orchestration
- Control aware chunking and retrieval
- Pinecone vector indexing and semantic retrieval
- Structured output and citation enforcement
- Quality scoring, traceability and validation
Backend, cloud and privacy
- Node.js backend and API service layer
- Azure OpenAI reasoning and generation
- Microsoft Azure / Azure Government deployment foundation
- SOLID based modular architecture for framework extensibility
- No client network access and no CUI persistence beyond request scope
Scope boundary
Byond Boundrys delivered only the AI backend and APIs. The client retained ownership of the frontend, product experience and go to market. Quantitative impact figures are excluded from the public page.
07 / Architecture and controls
How the system is organised
Client product / frontend
Node.js API layer
Intent and control mapping agents
LangGraph orchestration
Control aware RAG
Pinecone vector retrieval
Azure OpenAI
Gap assessment and document verification
SSP / POA&M / SRM generators
Human review
Control aware grounding
Queries are mapped to CMMC and NIST controls before retrieval and response generation.
Structured and cited output
Compliance guidance and generated artefacts follow controlled schemas and retain standards references.
Privacy first processing
The AI layer does not connect to client networks and does not persist CUI beyond the request lifecycle.
Modular service boundary
Clean APIs separate the AI backend from the client owned frontend and product experience.
08 / Business value
Value observed during validation
1Pilot observed
Control aware compliance assistance
The backend maps requests to relevant CMMC and NIST controls before retrieving evidence and generating a response.
2Pilot observed
Grounded and cited responses
Generated guidance retains standards references so compliance professionals can review the basis of each answer.
3Pilot observed
Structured gap and document evaluation
Specialised services assess gaps, policies, procedures and evidence against control specific requirements.
4Pilot observed
SSP, POA&M and SRM generation
The API layer produces structured compliance artefacts from validated mappings, evidence and remediation inputs.
5Pilot observed
Privacy first request processing
The AI layer is separated from client networks and does not persist CUI beyond the request lifecycle described in the source.
6Pilot observed
Extensible backend architecture
Modular services and clean APIs support future NIST based frameworks after appropriate domain adaptation.
09 / Technology
Every component, with its role in the delivery.
Technology choices from the supplied project brief, mapped to the workflow each component supports.
Node.js
Backend runtime and API layer exposing AI services to the client product
Azure OpenAI
Reasoning, evaluation and structured compliance document generation
LangGraph
Stateful orchestration of specialised compliance agents
LangChain
RAG and LLM application orchestration
Pinecone
Control level semantic vector retrieval
text embedding ada-002
Embeddings for standards, controls and uploaded documentation, verify current production model
Microsoft Azure
Secure production deployment foundation, including Azure Government where applicable
Control aware PDF pipeline
Parsing, boundary aware chunking and normalisation of standards and evidence
Related work
Explore related case studies.
