---
title: "How does Agent-side Redaction of CMMC Data Work?"
url: "https://dm0bkdes5q7a2ls.productfruits.help/en/article/cd50825c-bab3-4dca-a5f2-06cf5211e033"
language: "en"
last_updated: "2026-05-01T17:58:29.754Z"
---

# How does Agent-side Redaction of CMMC Data Work?

In the context of CMMC (Cybersecurity Maturity Model Certification), Agent-Side Redaction is a critical security control that ensures your compliance efforts do not accidentally create new security risks.

CMMC Agent-side redaction is a "Privacy by Design" feature where the Spirion Search Agent masks or hides sensitive portions of a data match **before** that information is ever transmitted to the Spirion Console or stored in the SaaS database.

## Why Agent-Side Redaction is Vital for CMMC

Under CMMC (specifically Level 2 and 3), **CUI (Controlled Unclassified Information)** must be protected at rest and in transit. If your Spirion Agent finds a piece of CUI (like a part number, a technical specification, or a contract identifier) and sends the full, unencrypted string to the Console for a report, **the Console itself may now be "in scope" for CMMC.**

Agent-side redaction prevents this "scope creep" by ensuring that the sensitive data never leaves the local machine in a readable format.

* * *

## How It Works (The Technical Flow)

1.  **Discovery:** The Search Agent (running locally on a workstation or server) identifies a match for a CMMC Data Type (e.g., an ITAR Technical Drawing Number).
2.  **Redaction Rule Applied:** The Agent checks its **Agent Policy**. If redaction is enabled for that Data Type, the Agent applies a mask (e.g., replacing characters with `*` or `X`).
3.  **Shipping:** The Agent ships the *redacted* snippet (e.g., `ITAR-XXXX-99`) to the Spirion Console.
4.  **Storage & Display:** The Console stores and displays only the redacted version. The full, original value remains only in the source file on the local machine.

* * *

## Key Benefits for CMMC Compliance

### 1\. Maintaining the "CUI Boundary"

CMMC requires you to define and defend a "CUI Boundary."

By using agent-side redaction, you ensure that your **Spirion Management Plane** (the Console and its database) stays *outside* the CUI boundary. This simplifies your audit because you don't have to prove that the Spirion Console meets the same rigorous CUI storage requirements as your primary file servers.

### 2\. Meeting "Least Privilege" (Control AC.L2-3.1.1)

CMMC mandates that only authorized users see CUI.

-   **Without Redaction:** Any IT admin with access to the Spirion Console could see raw CUI snippets from across the entire company.
-   **With Redaction:** The admin can see *that* CUI exists and *where* it is, but they cannot see the *actual* sensitive content. This maintains the principle of least privilege.

### 3\. Secure Audit Evidence

When a CMMC auditor (C3PAO) asks for proof that you are finding and securing CUI, you can show them your **Scan Results** reports. Because the data is redacted, you can safely hand over these reports without worrying about "Data Spill" (unauthorized disclosure of CUI).

* * *

## Configuration Tips for CMMC

-   **Partial vs. Full Redaction:** For CMMC, **Partial Redaction** is usually best. For example, showing `DWG-XXXX-55` allows a project manager to recognize which project the file belongs to so they can triage it, without exposing the full, sensitive drawing ID.
-   **Enable in the Agent Policy:** Redaction is configured at the **Agent Policy** level. You can have different redaction rules for different groups of machines (e.g., "Full Redaction" for executive laptops, but "Partial Redaction" for the engineering enclave).
-   **Redact the "Match Evidence":** Ensure you are redacting the "Match Evidence" (the snippet of text surrounding the find), as this context often contains as much sensitive CUI as the match itself.

## Summary

Agent-side redaction for CMMC is about **Risk Isolation.** It allows you to gain 100% visibility into where your CUI is located without the risk of centralizing that sensitive data in your reporting platform. It is the difference between a "Security Tool" and a "Security Liability."