SentinelOne CMMC Review: Where It Actually Lands in Your Level 2 Scope

CMMC status update — verified August 27, 2026: On July 13, 2026, the Department of War (DoW) suspended CMMC Phase II, which had been scheduled to begin November 10, 2026. Phase I Level 1 and Level 2 self-assessment requirements remain in place. DFARS 252.204-7012, NIST SP 800-171 Revision 2 for the current CMMC Level 2 program, applicable SPRS submissions, and annual CMMC affirmations remain in force. Nothing on this page assumes a Phase II deadline.

By The Defense Compliance Report Editorial Team

Last verified: August 27, 2026 · Evaluation depth: documentary review of published records — no hands-on product test · Compensation relationship with SentinelOne: none

---

If you searched for a SentinelOne CMMC review, here is the answer before anything else: SentinelOne cannot make you CMMC compliant, and it is not a CMMC assessment provider. In a CMMC Level 2 environment, the endpoint agent, the management platform, the external service relationship, the people operating it, and the data each one touches do not automatically share one asset label.

For most deployments, SentinelOne provides security functions and therefore belongs in the Security Protection Asset analysis. But 32 CFR 170.19 defines five Level 2 asset categories, and Table 4 separately determines how an external SentinelOne service is treated. If an external cloud service receives Security Protection Data without CUI, its services are assessed as Security Protection Assets. If that cloud service processes, stores, or transmits CUI, the CSP must meet the cloud requirements in DFARS 252.204-7012. Which path you are on is a configuration, data-flow, contracting, and operating decision you make. It is not a property of the product name.

SentinelOne does hold a current FedRAMP record for one exact offering. We pulled it: package FR1919071020A, “SentinelOne Singularity Platform High,” FedRAMP Certified since September 10, 2024, Rev5 Agency path, Class D (High). SentinelOne states that offering is delivered through AWS GovCloud (US).

Here is the part almost nobody tells buyers. That record does not prove that the tenant on your order form, every module you use, your reseller’s managed service, or every support path sits inside that package. These are the five scope tests that decide the answer:

1. Exact offering: What tenant and service are named on the order form?
2. Actual payload: What data leaves each endpoint—not what the brochure calls it?
3. Content-capable features: Can an analyst, automation, script, vault, or API move file contents or CUI-bearing output?
4. Operating boundary: Who administers the service, from where, and under which contract?
5. Evidence and retention: Can you prove the configuration, access, monitoring, and retention your SSP says you have?

---

The verdict, at a glance

Bottom line: SentinelOne is a credible endpoint security candidate for a CMMC-scoped environment. Whether it is the right one depends on your exact offering, feature settings, actual payloads, data retention, support path, and who is actually watching it.

---

How we evaluated this

This is a documentary review. On August 27, 2026, we read the FedRAMP Marketplace record, 32 CFR Part 170, DFARS 252.204-7012, the CMMC scoring methodology in 32 CFR 170.24, the current DoW Phase II suspension materials, and SentinelOne’s own product pages, CMMC pages, public feature documentation, datasheets, and published pricing—and compared them line by line.

We did not test the product, log into a tenant, review the private FedRAMP package, obtain a quote, or interview SentinelOne. We say so up front because the word “review” gets abused in this category, and because you are about to spend real money based on what you read here.

The Defense Compliance Report has no compensation relationship with SentinelOne, any SentinelOne reseller, Schellman, or Coalfire. Links to SentinelOne on this page are untracked primary-source links, not affiliate links. Our methodology, editorial standards, and corrections policy explain how claims are sourced and changed.

---

The Defense Compliance Report is an independent trade publication and decision resource for CMMC and Defense Industrial Base compliance—mapping a contractor’s level, CUI scope, assessment type, and timeline to the right provider category, so DIB contractors choose the right CMMC path before they spend six figures.

We are not affiliated with the Cyber AB, the Department of War, the Department of Defense, DCMA DIBCAC, NIST, SentinelOne, or any U.S. government agency.

---

What a trustworthy SentinelOne CMMC review has to answer

Answer capsule: A useful product review for CMMC purposes must resolve five things: which exact cloud offering holds the authorization, what data leaves the endpoint and where it goes, which content-capable actions can change that data flow, which of the 110 NIST SP 800-171 Revision 2 requirements the deployment can contribute to, and who operates and evidences it after the license is signed. A review that skips any of the five is a product brochure with a different headline.

Most of what currently ranks for this query does skip them. One page assigns SentinelOne a numeric “87% NIST 800-171 coverage” score and a verdict of “READY”—a number that cannot establish an organization’s CMMC status, for reasons we will explain. SentinelOne’s own CMMC explainer, published May 26, 2026, says Level 1 has 17 practices and still presents Phase 2 as starting “approximately December 2025.” The controlling figures are 15 Level 1 requirements, Phase I beginning November 10, 2025, and Phase II—originally scheduled for November 10, 2026—suspended on July 13, 2026.

So here are the five questions, in the order your brain actually needs them:

1. Is the FedRAMP record the answer? No. It is one piece of proof for one exact service offering.
2. Could my configuration be moving CUI into a vendor cloud right now? Several features and workflows can move content. Their presence does not prove CUI movement; their configuration and use decide it.
3. Which of the 110 requirements does this actually help with? Fewer than a product-level percentage implies. More than “it is just antivirus” suggests.
4. Who operates it and produces the evidence? A license without an operating owner is an unread alert queue.
5. What does it really cost? The public $50-per-endpoint annual difference buys 90-day rather than 14-day native retention, which changes your incident-evidence risk.

---

Is SentinelOne CMMC compliant?

Answer capsule: No endpoint security product is “CMMC compliant.” Under 32 CFR Part 170, CMMC status applies to an organization’s assessed information system and its implementation of security requirements—not to a piece of software. SentinelOne can contribute capabilities and evidence toward specific requirements, but the contractor still owns scope, configuration, policy, people, monitoring, documentation, affirmation, and the assessment itself.

This sounds pedantic until a reseller puts “CMMC compliant” in a proposal and your assessor asks what that means.

Here is the translation table we would hand any DIB buyer sitting through a vendor pitch:

One clarification that saves arguments: SentinelOne is a software vendor. It is not the C3PAO conducting your Level 2 certification assessment. Under 32 CFR Part 170, an authorized or accredited CMMC Third-Party Assessment Organization performs that assessment. An RPO is a Cyber AB registered provider designation used for readiness services; it does not issue your CMMC Level 2 certification. A SentinelOne partner may separately hold one of those designations, so verify the exact legal entity and current status in the Cyber AB Marketplace rather than inferring it from a product logo or reseller claim.

The right CMMC provider is not the same for every contractor. The category you need—a C3PAO, an RPO or readiness consultant, an MSSP, a GRC platform, or a CUI enclave—depends on your required CMMC level, whether you handle FCI or CUI, your assessment type, your cloud and IT environment, and your contract timeline. The solicitation or contract establishes the required CMMC status; your actual FCI/CUI handling and architecture establish the scope. Use Find My CMMC Path to map your situation to the right provider category before you request quotes. Do not submit CUI, drawings, credentials, or sensitive contract details.

---

Is SentinelOne FedRAMP authorized—and does that actually help you?

Answer capsule: Yes, for one exact offering. The FedRAMP Marketplace lists SentinelOne Singularity Platform High, package FR1919071020A, as FedRAMP Certified, Rev5 Agency path, Class D (High), certified since September 10, 2024. SentinelOne states that the offering is hosted in AWS GovCloud (US). But 32 CFR 170.19 Table 4 makes the data flow decisive: a CSP processing SPD without CUI is assessed as a Security Protection Asset; a CSP processing CUI must meet the DFARS 252.204-7012 cloud requirements.

The exact record, verified

Sources: FedRAMP Marketplace package FR1919071020A and SentinelOne’s federal government page, retrieved August 27, 2026.

Now the part that changes your decision

The rule that governs the ESP data-flow question is 32 CFR 170.19(c)(2), Table 4. An ESP is an external person or organization providing services that involve CUI or Security Protection Data. A CSP is an ESP that provides cloud services. SPD is defined in 32 CFR 170.4 to include security-relevant data such as logs generated or ingested by a Security Protection Asset and data about the configuration or vulnerability status of in-scope assets.

Here is the Table 4 decision, reproduced in plain language:

Read the middle row twice. When the external EDR service receives SPD without CUI, FedRAMP is not the gate in Table 4. The service is still in scope. You must document the ESP relationship in the SSP, obtain or create the service description and customer responsibility matrix, and prepare to show the evidence relevant to the security capabilities it provides. Our External Service Provider assessment guide covers that general rule in full.

That is a scoping-and-evidence problem, not automatically a FedRAMP procurement problem.

The top row is where the DFARS cloud test becomes a hard gate—and that is the row you can fall into through actual data movement.

The one thing we will criticize, because silence is not the problem here

Here is our damaging admission about this vendor, stated plainly: SentinelOne does publish CMMC guidance, and one of its current CMMC pages gets basic CMMC facts wrong. It says Level 1 has 17 practices instead of 15, presents Phase 1 as effective December 16, 2024 instead of the contractual rollout beginning November 10, 2025, and still places Phase 2 at approximately December 2025 even though the original Phase II date was November 10, 2026 and the Department suspended it on July 13, 2026.

SentinelOne also publishes a separate CMMC checklist that correctly tells readers to inventory all five asset categories. That makes the record mixed, not nonexistent.

Now the part that matters: neither page answers the SentinelOne-specific questions a Level 2 buyer needs answered. Neither maps the commercial tenant versus FR1919071020A, identifies content-capable features, explains how actual payloads can cross the CUI line, identifies the service description and CRM a contractor should request, or commits to the DFARS incident obligations below.

A vendor can still make a strong security product while publishing weak compliance guidance. But do not hand a generic vendor explainer to an assessor as proof of your scope.

The half of the clause nobody quotes

If your deployment lands in the CSP-plus-CUI row, read the clause all the way through. DFARS 252.204-7012(b)(2)(ii)(D) requires the contractor to ensure that the external CSP meets security requirements equivalent to the FedRAMP Moderate baseline and complies with paragraphs (c) through (g) for cyber incident reporting, malicious software, media preservation and protection, forensic access, and cyber incident damage assessment.

A Class D (High) offering addresses a higher FedRAMP impact profile than Moderate. Good. But the public Marketplace record alone does not prove that your exact purchased modules, support path, managed service, and contract accept paragraphs (c) through (g). We found no public SentinelOne commitment covering that full contractual set. That is not an accusation—few vendors publish one. It is a contract question for your representative, and it belongs in writing before CUI reaches a vendor cloud.

And one question we can answer before your reseller raises it

You may hear “DoD Impact Level” or “DoW Impact Level” in a sales call. An Impact Level is not the contractor-cloud test stated in DFARS 252.204-7012(b)(2)(ii)(D). The clause asks for FedRAMP Moderate-equivalent security and paragraphs (c) through (g). A separate government mission system, contract, or authorization may impose an Impact Level requirement, but an IL claim does not substitute for your Table 4 and DFARS analysis.

---

Which SentinelOne features can move CUI into SentinelOne’s cloud?

Answer capsule: Feature names do not decide the asset category. Normal EDR telemetry is often Security Protection Data, but a file path, command line, script result, analyst prompt, or log field can itself contain CUI. SentinelOne also publishes features that deliberately upload executables, fetch threat files, run collection scripts, or open remote shells. Your answer comes from the enabled configuration and the actual payload—not from calling everything “telemetry.”

This is the section that does not exist anywhere else in one decision map, so we will be precise about what the public documentation proves and what it does not.

The movement map

Primary product sources for this map include SentinelOne’s Binary Vault page, Remote Script Orchestration description, Remote Shell description, Threat Center description, and published package matrix.

The finding, stated plainly

The tempting mistake is to treat “metadata” and “content” as clean product-defined buckets. They are not.

A command line can contain a CUI-bearing filename, project number, server path, customer identifier, or even a secret passed as an argument. A script can collect exactly what its author tells it to collect. An analyst can fetch a file because the file is the subject of the investigation. Binary Vault can upload benign executables as well as malicious ones.

Nobody has to be malicious for CUI to move. A tier-one analyst troubleshooting a false positive on an engineering workstation may retrieve the file on purpose, as part of the job.

None of this is a defect list. Every one of these features exists because responders need it. Binary Vault publishes exclusion controls precisely so you can fence it. Remote Shell publishes session controls and auditing because interactive access is powerful. Your job is not to be afraid of the product. Your job is to know which capabilities are enabled, what roles can use them, what data they have actually moved, and how you prove that answer in the SSP.

What we could not verify from a public primary source

We could not verify, without an authenticated tenant or private documentation:

• Whether Fetch Files is enabled by default in a new commercial tenant
• The current maximum file size for that action
• Whether a support ticket is required to enable it in each government environment
• Whether every file-fetch action is exposed in an exportable record suitable for an assessor
• The default state of Binary Vault in a newly provisioned tenant
• The exact modules and functions inside the private boundary of FR1919071020A

Those points belong in a written evidence request, not in a product review as unsupported facts.

The five-minute console test

Start with the URL you log into, but do not stop there.

A SentinelOne domain or government-specific portal can be a clue. It is not package-boundary evidence. Get all five items in writing:

1. Exact tenant and service offering
2. Order-form SKU and modules
3. Customer of record
4. Support and managed-service entities with administrative access
5. Written mapping to FR1919071020A, if anyone is relying on that package

Then export or screenshot the roles, enabled content-capable features, retention settings, and recent administrative activity. A verbal “you are on GovCloud” is not evidence.

---

⟶ Check your own tenant before you check anything else

You now have the Table 4 fork, the content movement map, and the five proof items. Ten minutes with your console and order form will tell you what you know—and, more important, what you still need in writing.

Download the CMMC Readiness Checklist →

Mark the endpoint, External Service Provider, SSP, network-diagram, responsibility-matrix, access, and retention evidence you already have. Every “not sure” becomes a line in the evidence-request email below.

Do not enter CUI, drawings, credentials, network diagrams, or contract details into any public form or tool.

---

Commercial console, GovCloud, or self-hosted: which do you actually need?

Answer capsule: The right deployment is the one that keeps your intended data flow, support path, and evidence inside a boundary you can defend. The FedRAMP-listed offering strengthens the cloud-service proof if CUI may reach the platform. A commercial cloud tenant can be acceptable when the external service receives SPD without CUI and the service is properly scoped and assessed. A contractor-operated deployment can remove the cloud CSP question, but it does not remove CMMC scope or the operational work.

The scoping option almost nobody explains correctly

If you self-host SentinelOne and your organization operates the management platform without an external company providing the relevant service, there may be no ESP relationship for that platform. The management system still belongs in your Level 2 asset analysis and will normally be a Security Protection Asset if it provides security functions without processing CUI.

But do not declare “no ESP” because the server is on-premises. If an MSP remotely administers it, an MDR service receives its alerts, a vendor support team accesses it, or logs flow to an external data lake, each external relationship needs its own Table 4 analysis.

You trade vendor-boundary paperwork for operational ownership. For a small shop with one bounded CUI enclave and a capable administrator, that can still be the cheaper answer. It is not the paperwork-free answer.

Four hypothetical situations, four different answers

A 25-person machine shop with one CUI enclave. You do not need platform breadth. You need a bounded architecture and somebody who actually watches alerts. The license is the easy part; the operating owner is the decision. Look at managed compliance and MSSP options before you look at SKUs.

An engineering firm already in Microsoft GCC High. Ask whether adding a second security cloud buys capability or buys a second boundary to document. Sometimes it genuinely buys capability. Make that call deliberately, not by inertia.

A software company running workloads in AWS GovCloud. Do not assume the word “GovCloud” aligns everything. Endpoints, cloud workloads, SIEM, management console, support team, and analysts may sit in different boundaries. Trace each one.

An isolated lab or test environment. Air-gapped operation is attractive right up until you need to prove malicious-code protection mechanisms were updated. Design the offline update and evidence-export procedure before you buy.

---

⟶ Not sure which provider category you actually need?

Deployment model, operating owner, and provider category are one decision, not three. If you are weighing readiness support, an MSSP to run the control, a GRC platform for evidence, or a CUI enclave to shrink the boundary, start by mapping the situation.

Compare CMMC provider categories → Use Find My CMMC Path →

The framework routes you to a category, not a guaranteed outcome. It is not a certification, legal opinion, or substitute for the contract. Do not submit CUI, drawings, credentials, or sensitive contract details.

---

Which of the 110 requirements can SentinelOne actually help with?

Answer capsule: CMMC Level 2 currently uses the 110 security requirements in NIST SP 800-171 Revision 2, organized into 14 families and assessed with the objectives in NIST SP 800-171A June 2018. A well-configured endpoint platform contributes most directly to System and Information Integrity and can support parts of Configuration Management, Audit and Accountability, Risk Assessment, Access Control, System and Communications Protection, and Incident Response. It does not implement the program for you.

Under the CMMC Level 2 scoring methodology in 32 CFR 170.24, requirements carry values of 1, 3, or 5 points. You start at 110 and subtract the assigned value for a NOT MET requirement. There is no general partial-credit system, but the rule contains two narrow scoring exceptions: IA.L2-3.5.3 for MFA and SC.L2-3.13.11 for FIPS-validated encryption.

Do not blur two SPRS records:

• Under DFARS 252.204-7019 and 252.204-7020, a current Basic, Medium, or High NIST SP 800-171 DoD Assessment summary score is posted in SPRS.
• When DFARS 252.204-7021 applies, CMMC self-assessment results and annual affirmations are also maintained in SPRS for the applicable CMMC UID.

Our SPRS score guide explains the posting mechanics without treating a tool mapping as a score.

Which DFARS clause does what?

The Basic NIST score tied to -7019/-7020 and the CMMC status tied to -7021 are related records, not interchangeable labels. The solicitation provision at -7025 tells you the required status for the acquisition. None of the five clauses says “buy SentinelOne.”

Here is where a properly configured SentinelOne deployment can carry real weight. Every requirement below has a 5-point value in the current CMMC Level 2 scoring table:

This is a documentary capability mapping, not an assessment result. A C3PAO assesses your implementation and evidence, not this table.

The families it does not solve

Awareness and Training. Media Protection. Physical Protection. Personnel Security. Most of Maintenance. Most of Identification and Authentication—no EDR replaces MFA, identity proofing, account lifecycle management, or authenticator governance.

Count it honestly: SentinelOne’s strongest direct contribution is in System and Information Integrity. It can make meaningful but incomplete contributions across several other families. Anyone selling an endpoint agent as a CMMC solution is selling you a fraction of a program and letting you assume it is the whole thing.

Why “87% coverage” is not a real CMMC verdict

A page ranking for this query claims SentinelOne provides “87% coverage of NIST 800-171 controls,” declares a verdict of “READY,” and names two gaps—3.1.5 and 3.1.12.

Three problems, and they are worth walking through because they teach you how to spot this pattern anywhere:

1. The arithmetic does not close. Eighty-seven percent of 110 is about 96 requirements. Two gaps implies 108. Those are not the same claim.
2. The requirement numbers do not match the proposed fixes. The page names 3.1.5, least privilege, and 3.1.12, monitor and control remote access, then prescribes automatic screen locks and session termination—3.1.10 and 3.1.11.
3. It cites AC-11 and AC-12. Those are NIST SP 800-53 control identifiers, not NIST SP 800-171 Revision 2 requirement numbers.

The deeper issue: coverage percentages are not a property of software. The CMMC scoring method evaluates an organization’s implementation inside a defined boundary. A product-level percentage can be a private planning shorthand only if its author defines the mapping, assumptions, configuration, evidence standard, and exclusions. It is not a CMMC status, score, or certification verdict.

---

⟶ Endpoint coverage is a start, not a program

If you now understand the endpoint layer but are staring at requirements it does not touch, the next question is not which EDR. It is which provider category closes the rest.

See who to hire first for CMMC → Map the gap with Find My CMMC Path →

Readiness and SSP work, managed monitoring, evidence workflow, assessment, or a CUI enclave that shrinks the boundary—the right sequence depends on your required status, assessment type, environment, and timeline.

---

Does NIST SP 800-171 Revision 3 apply to this CMMC review?

Answer capsule: NIST withdrew SP 800-171 Revision 2 and superseded it with Revision 3 in May 2024, but Revision 3 is not the controlling CMMC Level 2 requirement set today. The current text of 32 CFR 170.14 makes CMMC Level 2 identical to NIST SP 800-171 Revision 2, and the Department’s July 2026 suspension guidance says it will enforce the interim baseline through Revision 2 self-assessments and select government-led assessments.

That does not mean Revision 3 can be ignored everywhere. DFARS 252.204-7012 separately says the covered contractor information system is subject to the NIST SP 800-171 version in effect when the solicitation is issued or another version authorized by the Contracting Officer. Read the solicitation, clause date, and Contracting Officer direction.

The clean rule is:

• For current CMMC Level 2 status and assessment: use the Revision 2 requirements incorporated into 32 CFR Part 170 and the June 2018 SP 800-171A objectives.
• For separate contractual safeguarding obligations: confirm the solicitation and Contracting Officer direction.
• Do not present a Revision 3 mapping as the controlling CMMC assessment set unless DoD amends the governing rule or your contract expressly establishes that requirement.

NIST’s publication status does not silently rewrite incorporated regulatory text. Your contract can still create a separate obligation that needs to be reconciled deliberately.

The same version-control point applies at Level 3: the current CMMC rule incorporates selected requirements from NIST SP 800-172, February 2021. NIST superseded that publication with SP 800-172 Revision 3 in May 2026, but the publication update does not by itself amend 32 CFR Part 170.

---

What SentinelOne costs for CMMC—and the $50 retention decision behind a DFARS evidence risk

Answer capsule: SentinelOne publishes U.S. list prices, which is rare in this market: Singularity Complete at $179.99 per endpoint per year and Singularity Commercial at $229.99, both displayed for 5–100 workstations as of August 27, 2026. Those are commercial prices, not a government-channel, FedRAMP-package, managed-service, or implementation quote. The public difference is 14 days versus 90 days of native data retention.

The published prices

Source: SentinelOne’s published package page, retrieved August 27, 2026.

The license floor, before anything else

Simple arithmetic on the published prices:

This is commercial list-price math only. SentinelOne states that the displayed pricing is for 5–100 workstations, may exclude taxes and other charges, and that purchases are made through authorized third-party partners whose final pricing controls. It is not a Singularity Platform High quote. It is not a server quote, an MDR quote, an onboarding quote, a data-ingestion quote, or a total CMMC budget. Do not extrapolate it to 500 seats and call it a plan. Our CMMC Level 2 cost guide separates software, implementation, managed operations, readiness, and assessment costs.

Now the part that actually matters

DFARS 252.204-7012(e) requires the contractor, after discovering a covered cyber incident, to preserve and protect images of known affected information systems and all relevant monitoring or packet-capture data for at least 90 days from submission of the incident report.

Be precise about what this does and does not mean:

A 14-day product retention setting is not automatically a violation of paragraph (e). The obligation sits on the contractor, and relevant records can be exported and preserved in another system. But fourteen days gives you less native history and a much smaller window to recognize an event, preserve the records, and investigate activity that began earlier. If relevant telemetry has already aged out when an incident is discovered, you may be unable to preserve evidence that would otherwise matter.

The related trap: requirement 3.3.1 requires you to create and retain audit logs and records. It does not prescribe one universal one-year period. Your policy and SSP still have to match the system you operate. If the SSP says security event data is retained for one year and the only copy exists for fourteen days, you have documented a plan the system does not perform.

For a hypothetical 75-endpoint shop, the public annual difference is $3,750. That does not prove the higher tier is automatically right. It turns retention into a clear, priced evidence decision instead of an invisible setting.

What has to be in the quote

Any proposal you accept should break out, line by line:

• Exact cloud offering, tenant, and SKU
• Endpoint and server counts, separately
• Government or FedRAMP-package premium, if any
• Included modules and any modules outside the cited package
• Data-retention tier and data-lake ingestion charges
• Onboarding, deployment, migration, and training
• Managed detection and response, if included
• Support tier and technical account management
• Integration costs for SIEM, ticketing, SOAR, identity, and cloud workloads
• Reseller terms, minimums, renewal increases, and termination rights
• What happens to your data at termination, in writing
• Who provides the service description, CRM, and assessment evidence
• Whether paragraphs (c) through (g) of DFARS 252.204-7012 are accepted where required

---

⟶ Get pricing from the category that will actually operate it

A low per-endpoint price still produces an expensive unmanaged control if nobody is assigned to watch it. The buyers who get burned are not only the ones who overpay for licenses. They are the ones who buy software and no operating owner.

Request a scoped CMMC quote →

Tell us your required level or status, broad environment, scope size, and timeline, and we will route the inquiry to an appropriate provider category. Do not submit CUI, drawings, credentials, contract documents, or detailed network information.

Disclosure: The Defense Compliance Report may receive compensation for a qualified introduction when that relationship is disclosed. Compensation does not control our regulatory analysis or provider-category recommendation.

---

Who files the 72-hour report?

Answer capsule: The contractor remains responsible. DFARS 252.204-7012 defines “rapidly report” as within 72 hours of discovery and places the reporting obligation on the contractor. An endpoint platform, MDR provider, or autonomous response feature can assist with detection, containment, investigation, and drafting, but it does not erase the contractor’s clause obligation.

This is the paragraph we would underline for any DIB executive.

Your platform can contain a host quickly. That is genuinely valuable, and it is not the same as satisfying the clause. Paragraphs (c) through (g) require the contractor to address:

• A cyber incident report to DoD within 72 hours of discovery
• A review for evidence of compromise across the affected covered system and other systems that may have been accessed
• Submission of malicious software discovered and isolated in connection with a reported incident to the DoD Cyber Crime Center, following DC3 instructions
• Preservation of affected-system images and relevant monitoring or packet-capture data for at least 90 days from the report
• Access to additional information or equipment if DoD requests it for forensic analysis
• Information for a damage assessment if DoD elects to conduct one

The clause also requires a DoD-approved medium assurance certificate for reporting. Do not discover that requirement during the incident.

We found no public SentinelOne commitment to perform the complete paragraphs (c) through (g) obligation for a contractor. Again—few product vendors publish one. But if your incident-response plan says “our MDR handles it,” read the MDR contract. “We assist,” “we notify you,” “we provide reasonable cooperation,” and “we submit the contractor’s DIBNet report through an authorized process” are different commitments.

---

The 12 questions to ask before you sign or renew

Answer capsule: Before purchasing or renewing SentinelOne for a CMMC-scoped environment, obtain written answers covering the exact offering, the data flow, the responsibility split, and the evidence the platform will produce. If a seller cannot answer these in writing, you do not yet have enough information for a defensible decision.

Copy this into an email. It is the fastest way to convert everything above into a written record.

Exact offering

1. Is the service on our order form the FedRAMP-listed SentinelOne Singularity Platform High, FR1919071020A, or another tenant? Please state the exact service offering and tenant.
2. Which modules, APIs, data stores, support services, and managed services we are buying are inside that package boundary, and which are outside it?
3. Who is the customer of record—our company, our MSP, the reseller, or another entity?

Data flow

1. Which file-fetch, forensic collection, threat-file retrieval, Binary Vault, Remote Shell, Remote Script Orchestration, AI-assistant, and data-ingestion capabilities are enabled today? Who can invoke each one, and is each action logged in an exportable form?
2. Is Binary Vault enabled? What file types, paths, size limits, upload limits, and exclusions are configured?
3. Which roles can use Remote Shell and Remote Script Orchestration, where are the session and script records retained, and can we export them?
4. Where is our data stored, which subprocessors and support organizations can access it, and—from an export-control and contract perspective—can any non-U.S. person access customer content?

Responsibility and documentation

1. Please provide the service description and the customer responsibility matrix required for the ESP relationship in 32 CFR 170.19(c)(2)(ii).
2. If the service will process, store, or transmit covered defense information, does the responsible CSP accept in writing the applicable obligations in DFARS 252.204-7012 paragraphs (c) through (g)?
3. If we use managed detection or response, which legal entity’s analysts access the tenant, from where, under which agreement, and which CMMC evidence does that entity deliver?

Evidence and terms

1. What is our configured retention today, what data does that period cover, where can we export it, and what does it cost to extend?
2. At termination, what happens to our data—export format, retrieval window, deletion process, deletion confirmation, residual backups, and timeline?

---

⟶ Take the checklist into the call

These twelve questions are the difference between a vendor conversation and a documented decision.

Download the CMMC Readiness Checklist →

It is mapped to the 14 NIST SP 800-171 Revision 2 families, with endpoint and External Service Provider evidence called out. No email gate. Print it, mark it up, and bring it to the renewal meeting.

---

SentinelOne vs. CrowdStrike vs. Microsoft Defender for CMMC

Answer capsule: There is no universally best EDR for CMMC. All three have government-oriented offerings or environments, but the public proof is not interchangeable. Compare the exact authorization record, service boundary, data flow, administrator and support access, operating model, and total cost—not the logo.

We verified the public records below on August 27, 2026.

Primary sources: SentinelOne FedRAMP record, CrowdStrike FedRAMP record, and Microsoft’s Defender for Endpoint for U.S. Government customers and Azure Government FedRAMP audit-scope documentation.

Read the authorization counts correctly. CrowdStrike’s 38 versus SentinelOne’s 8 measures current ATO/ATU letters, including reuse authorizations, shown for those packages. It is an adoption and reuse measure that can change. It is not a security score, product-quality score, or CMMC suitability rating.

The row that decides the purchase is the proof row. A government brand name, AWS GovCloud, Azure Government, GCC High, a FedRAMP logo, or a reseller’s statement does not by itself match your order form, modules, support personnel, external service, and actual data flow to the public record.

We are not telling you to switch. We are telling you which evidence to demand before you stay or move.

---

Does the CMMC Phase II suspension change any of this?

Answer capsule: On July 13, 2026, the Department of War suspended CMMC Phase II, which had been scheduled to begin November 10, 2026. The Department directed programs to use only Level 1 (Self) or Level 2 (Self) designations during the suspension and to remove Level 2 (C3PAO) and Level 3 (DIBCAC) requirements from affected active solicitations and existing contracts through the directed amendment or modification process. Phase I self-assessment requirements and DFARS 252.204-7012 remain.

The original four-phase schedule placed Phase I from November 10, 2025 through November 9, 2026, with Phase II beginning November 10, 2026. The Phase II transition and pending implementation milestones were suspended on July 13, 2026. The Department established a 60-day CMMC Reform Task Force and stated that, during the interim period, it would enforce NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments.

Here is the counterintuitive part, and it is the reason this page still matters.

For a Level 2 self-assessment, your organization defines the scope, evaluates the requirements, submits the result in SPRS, and uses an affirming official for the required affirmation. No C3PAO is standing in the room to challenge your Security Protection Asset analysis before you make that representation.

That does not reduce the need for a defensible SentinelOne data-flow decision. It makes your own documented reasoning more important.

The underlying clause obligations did not disappear. DFARS 252.204-7012 still requires safeguarding and incident reporting where the clause applies. DFARS 252.204-7019 and -7020 still govern the NIST SP 800-171 DoD Assessment record where included. The CMMC Level 1 and Level 2 self-assessment and affirmation requirements remain in Phase I.

Do not plan against the old November 10, 2026 Phase II deadline. Do not plan as though CMMC and NIST SP 800-171 disappeared. Track the Department’s current CMMC page and official amendments, not a vendor rollout graphic.

---

What we verified—and what we could not

Answer capsule: This review was assembled from the FedRAMP Marketplace, the current eCFR text of 32 CFR Part 170, the current DFARS clauses, NIST CSRC publication records, the Department’s Phase II suspension materials, and SentinelOne’s published product, CMMC, feature, federal, and pricing pages, all retrieved or rechecked on August 27, 2026. It does not include hands-on product testing, a private FedRAMP package review, an authenticated-tenant review, a quote, or a vendor interview.

What we verified on August 27, 2026

• The FedRAMP Marketplace record for FR1919071020A: offering name, package ID, status, lifecycle phase, certification profile, certification date, and current authorization count
• The five Level 2 asset categories and the ESP/CSP data-flow decision in 32 CFR 170.19 Tables 3 and 4
• The ESP documentation requirements for the SSP, service description, and customer responsibility matrix
• The current CMMC Level 2 use of NIST SP 800-171 Revision 2 and NIST SP 800-171A June 2018
• The Level 2 1-, 3-, and 5-point scoring method and the two limited partial-scoring exceptions in 32 CFR 170.24
• DFARS 252.204-7012 paragraphs (b)(2)(ii)(D) and (c) through (g)
• The distinct SPRS and acquisition functions in DFARS 252.204-7019, -7020, -7021, and -7025
• SentinelOne’s current public commercial prices, 14-day and 90-day retention tiers, package comparison, 5–100-workstation pricing note, and partner-pricing caveat
• Binary Vault’s upload of malicious and benign executables and its published file-type and path exclusions
• Remote Script Orchestration’s artifact-collection capability
• Remote Shell’s enablement, 2FA, and session-auditing statements
• Threat Center’s published ability to fetch a threat file
• SentinelOne’s CMMC explainer errors on the Level 1 count and implementation dates
• SentinelOne’s separate checklist reference to all five Level 2 asset categories
• CrowdStrike’s current public FedRAMP record for FR1807853629A
• Microsoft’s official description of Defender for Endpoint for U.S. Government customers
• The July 13, 2026 Phase II suspension, the originally scheduled November 10, 2026 transition, and the Department’s direction to retain Level 1 and Level 2 self-assessments during the suspension

What we could not verify—and did not assert as fact

• The exact module boundary inside the private FedRAMP package for FR1919071020A
• Whether a reader’s tenant, reseller service, support path, MDR service, or add-on is inside that package
• SentinelOne’s contractual position on the complete DFARS 252.204-7012 paragraphs (c) through (g) obligation
• Commercial-tenant data residency, current subprocessors, or support-person access conditions for a particular customer
• The default state of Binary Vault in a newly provisioned tenant
• The default state, current file-size limit, or government-environment enablement process for Fetch Files
• Whether every file-fetch, script, remote-shell, or AI-assisted action is exposed in an exportable assessor-ready record
• A universal rule that endpoint telemetry is always SPD and never CUI
• A product-level number of NIST SP 800-171 requirements “covered”
• A public government-channel price or total implementation cost
• A public SentinelOne commitment that its MDR service files the contractor’s DIBNet report
• Any independently verified promise that buying SentinelOne causes or guarantees a CMMC result

Every one of those is either a numbered question above or a proof gate in the verdict table. None appears on this page as an established fact.

One more thing, on case studies. We looked for an attributable, independently verifiable CMMC assessment outcome involving SentinelOne and did not find one that met our standard. Vendor and partner case studies can describe a real organizational outcome, but that outcome normally reflects people, process, architecture, managed services, evidence, and an assessor—not an endpoint agent acting alone. We would rather print no pass-rate claim than imply a typical outcome we cannot substantiate.

What would upgrade this to a hands-on review: access to a government-offering demonstration, written confirmation of the modules and services inside FR1919071020A, a sample service description and CRM, a documented data-flow diagram, a scoped government-channel quote, an authenticated review of roles and audit exports, and at least one attributable customer interview from a CMMC-scoped environment.

Corrections and source contributions can be submitted through our corrections policy.

---

Who SentinelOne is right for—and who should look elsewhere

Answer capsule: SentinelOne is a strong candidate for contractors that can verify the exact offering, need capable endpoint detection and response, and have a real internal or managed operating owner. It is a poor software-only purchase for buyers seeking a turnkey compliance outcome, unwilling to map data flow, or unable to staff and evidence the control.

And the disqualification, stated plainly: if a reseller tells you SentinelOne “checks the CMMC box,” walk away from that advice. That statement collapses an organization, an assessment scope, 110 requirements, five asset categories, external services, people, policies, and evidence into a product logo.

That does not prove the product is bad. We did not hands-on test it. It proves the compliance claim is bad—and you will be the one signing the assessment and affirmation records.

---

Frequently asked questions

Is SentinelOne CMMC compliant?

No. CMMC status applies to an organization’s information system and implementation under 32 CFR Part 170, not to software. A configured SentinelOne deployment can support specific requirements and produce evidence, but your organization still owns scope, implementation, documentation, assessment, and affirmation.

Is SentinelOne FedRAMP authorized?

One exact offering has a current public FedRAMP record. The Marketplace lists SentinelOne Singularity Platform High, package FR1919071020A, as FedRAMP Certified, Rev5 Agency path, Class D (High), certified since September 10, 2024. SentinelOne states that the federal cloud offering is delivered through AWS GovCloud (US). Verified August 27, 2026.

Are all SentinelOne products and services inside that FedRAMP package?

Do not assume so. The public record names one cloud service offering. Match your tenant, SKU, modules, APIs, data stores, support path, reseller service, and managed service to the package in writing before relying on it.

Can I use a commercial SentinelOne cloud tenant for CMMC?

Potentially, yes. Under 32 CFR 170.19 Table 4, an external cloud service that processes SPD without CUI is in scope and assessed as a Security Protection Asset; FedRAMP is not the Table 4 gate for that row. If the service processes, stores, or transmits CUI, the CSP must meet the DFARS 252.204-7012 cloud requirements. Your actual payload and controls decide the row.

Is SentinelOne a CUI Asset or a Security Protection Asset?

There is no defensible one-label answer for the entire product relationship. A SentinelOne endpoint agent or management component providing security functions will normally be analyzed as a Security Protection Asset. A component that actually processes, stores, or transmits CUI is a CUI Asset. An external service is also subject to the separate Table 4 analysis. Classify each asset and service based on function, capability, actual data, and operating relationship.

Is endpoint telemetry Security Protection Data?

Often, yes. Security logs and configuration or vulnerability data fit the SPD definition. But the label “telemetry” does not cleanse the payload. File paths, command lines, scripts, logs, analyst notes, prompts, and outputs can contain CUI. Inspect the actual fields and workflows.

Can SentinelOne move my CUI files?

It has content-capable workflows. Binary Vault can upload malicious and benign executables to cloud storage. Threat Center can fetch a threat file. Remote Script Orchestration can collect investigation artifacts. Remote Shell can expose content an operator chooses to access. Public materials also identify forensic data collection. Whether CUI moves depends on what is enabled, invoked, and collected in your environment.

Is Fetch Files enabled by default, and what is its current size limit?

We could not verify those points from a publicly accessible primary SentinelOne source on August 27, 2026. Confirm them in the authenticated tenant or current API documentation and obtain the answer in writing. Until that evidence exists, the default state, size limit, and government-environment enablement process should not be stated as facts.

Does SentinelOne need to be in my System Security Plan?

If it is in the CMMC assessment scope, yes. Security Protection Assets must be documented in the asset inventory, SSP, and network diagram. An ESP relationship and services must also be documented through the SSP, service description, and customer responsibility matrix under 32 CFR 170.19(c)(2)(ii).

Do I need a separate CMMC assessment of SentinelOne?

Not automatically. An ESP may voluntarily undergo a CMMC assessment to reduce effort during the organization seeking assessment’s review, and the minimum assessment type is dictated by the OSA’s DoD contract requirement. Otherwise, the relevant services are assessed within the OSA’s assessment as required by 32 CFR Part 170. Do not confuse the vendor’s FedRAMP package with your CMMC status.

How many NIST SP 800-171 requirements does SentinelOne cover?

There is no defensible universal product-level number. CMMC Level 2 currently uses 110 Revision 2 requirements across 14 families. The result depends on your configuration, scope, policies, people, operating records, and evidence. SentinelOne contributes most directly to System and Information Integrity and can support portions of several other families.

Does NIST SP 800-171 Revision 3 control CMMC Level 2 now?

No. The current CMMC Level 2 requirement set in 32 CFR 170.14 remains NIST SP 800-171 Revision 2, assessed with SP 800-171A June 2018. NIST has superseded Revision 2 with Revision 3 as a publication, and DFARS 252.204-7012 has separate version-at-solicitation language, so confirm the solicitation and Contracting Officer direction for non-CMMC contractual obligations.

How much does SentinelOne cost?

As of August 27, 2026, SentinelOne publishes $179.99 per endpoint per year for Singularity Complete with 14-day retention and $229.99 for Singularity Commercial with 90-day retention, displayed for 5–100 workstations. Enterprise is quote-only. Partner pricing controls, and government-package, managed-service, server, ingestion, and implementation pricing are not established by those public numbers.

Does the 14-day retention tier create a compliance problem?

Not automatically, but it creates evidence risk. DFARS 252.204-7012(e) requires preserving relevant monitoring or packet-capture data for at least 90 days from submission of a covered cyber incident report. Fourteen days of native retention leaves less history and less time to preserve records elsewhere. Your actual architecture, export process, policy, and SSP decide whether the evidence plan works.

Is SentinelOne a C3PAO or an RPO?

SentinelOne is a technology vendor. A C3PAO is an authorized or accredited CMMC Third-Party Assessment Organization that conducts a Level 2 certification assessment. An RPO is a Cyber AB registered provider designation associated with readiness services. A partner or reseller may separately hold a current designation; verify the exact entity in the Cyber AB Marketplace.

Do I need SentinelOne managed detection and response?

You need a named monitoring and response owner. That can be an internal team, SentinelOne or another vendor’s managed service, or a CMMC-focused MSSP. Compare which legal entity accesses the tenant, from where, what it commits to do, how quickly it acts, what records it delivers, and whether the contract addresses DFARS incident obligations where required.

Does the Phase II suspension mean I can wait on endpoint security or NIST SP 800-171?

No. The July 13, 2026 action suspended Phase II and pending implementation milestones; it did not eliminate Phase I self-assessment requirements or DFARS 252.204-7012. The Department states that it will enforce the interim baseline through NIST SP 800-171 Revision 2 self-assessments and select government-led assessments.

---

Need help deciding what type of CMMC provider you need?

Tell us your required level or status, broad scope, environment, and timeline, and we will route you to the provider category that fits the decision—not pretend one vendor fits every contractor.

Find My CMMC Path →

Request a scoped quote →

Do not submit CUI, drawings, credentials, contract documents, export-controlled technical data, or sensitive system details.

---

Disclosure

The Defense Compliance Report is an independent trade publication on CMMC and DIB compliance. We may receive compensation for qualified introductions, sponsorships, or partner referrals when disclosed. Compensation does not control our regulatory analysis, provider-category recommendations, or Cyber AB status verification. We have no compensation relationship with SentinelOne or any SentinelOne reseller.

Editorial notice

This is educational research, not legal, contractual, export-control, or compliance advice. Confirm your contract, scope, data handling, and applicability with qualified counsel and appropriately credentialed CMMC professionals. The solicitation or contract establishes the required CMMC status. The actual FCI/CUI data flow and architecture establish the assessment scope. A checklist does neither.

The Defense Compliance Report is not affiliated with the Cyber AB, the Department of War, the Department of Defense, DCMA DIBCAC, NIST, FedRAMP, SentinelOne, CrowdStrike, Microsoft, or any U.S. government agency.

Read our methodology, editorial standards, and corrections policy.

Primary sources

• 32 CFR Part 170 — CMMC Program
• 32 CFR 170.19 — CMMC scoping
• 32 CFR 170.24 — CMMC scoring methodology
• DFARS 252.204-7012
• DFARS 252.204-7019
• DFARS 252.204-7020
• DFARS 252.204-7021
• DFARS 252.204-7025
• NIST SP 800-171 Revision 2
• NIST SP 800-171A, June 2018
• NIST SP 800-172, February 2021
• SentinelOne Singularity Platform High — FedRAMP Marketplace
• SentinelOne federal government offering
• SentinelOne published packages and prices
• SentinelOne Binary Vault
• SentinelOne Remote Script Orchestration
• SentinelOne Remote Shell
• SentinelOne Threat Center
• SentinelOne CMMC explainer
• SentinelOne CMMC checklist
• Department of War CMMC status page
• Department of War Phase II suspension release, July 13, 2026
• CrowdStrike Falcon Platform for Government — FedRAMP Marketplace
• Microsoft Defender for Endpoint for U.S. Government customers
• Azure Government services in FedRAMP audit scope