Defense (CMMC contractor) — Layered Protect Surface

Defense-in-depth view of a typical Defense (CMMC contractor) enterprise. Hover a component to surface its cross-layer dependencies, or run an attack path drawn from a CISA advisory relevant to this vertical.

Defense (CMMC contractor)CMMC 2.0 · NIST SP 800-171 · 800-172 · DFARS 252.204-7012permalink →

Vertical

External · Internet · Untrusted

●

Services

DNS & Domain

Identity (Okta/Entra)

CDN & Edge

Email Security

SIEM / XDR

Backup & DR

Secure Web Gateway

Privileged Access Mgmt

Process Historian

OT IDS / Anomaly

■

Assets

Laptops & Desktops

Mobile (iPhone/Android)

Network (Cisco/Meraki)

Firewalls (Palo Alto)

Cloud (AWS/Azure)

Servers (On-Prem)

Printers & IoT

USB & Removable Media

Engineering Workstation

IT-OT DMZ / Industrial Firewall

PLCs / ICS Controllers

⬢

Applications

ERP (SAP/Oracle)

CRM (Salesforce)

Google Workspace

Custom Web Apps

DevOps (GitHub/CI)

HR Platform

Accounting (NetSuite)

Slack / Teams

VPN / Remote Access

SCADA / HMI

◆

Data

Customer PII

Financial Records

IP & Trade Secrets

Employee HR Data

Cloud Object Storage

Databases (SQL/NoSQL)

Email & Messaging

Logs & Telemetry

Process & Telemetry Data

Protect-surface inventory · Defense (CMMC contractor)

JavaScript is disabled — the interactive map, vertical selector, and attack-path simulation are unavailable. The four layers and their 40 components for this vertical are listed below.

● Services · 10 components

DNS & Domain — Domain name resolution services — the first query in nearly every network connection. DNS is both critical infrastructure and an attack vector.
Identity (Okta/Entra) — Identity provider services including SSO, MFA, directory sync, and lifecycle management — the control plane of Zero Trust.
CDN & Edge — Content delivery and edge compute services accelerating web applications while providing DDoS protection and bot management.
Email Security — Email filtering, anti-phishing, and email authentication services (SPF/DKIM/DMARC) protecting the #1 attack vector.
SIEM / XDR — Security information and event management services correlating alerts across the entire protect surface for detection and response.
Backup & DR — Backup, disaster recovery, and business continuity services ensuring data survivability against ransomware and catastrophic events.
Secure Web Gateway — Web traffic inspection and filtering services enforcing acceptable use policies and blocking malicious content at the network edge.
Privileged Access Mgmt — Privileged access management services controlling and auditing admin access to critical systems — a cornerstone of Zero Trust.
Process Historian — Asset and process record-keeper that captures the time-series of every PLC tag and HMI event — the durable record OT operations and incident response both depend on.
OT IDS / Anomaly — Signature- and anomaly-based intrusion detection for ICS protocols (Modbus, S7, DNP3, OPC) deployed on SPAN/TAP at the IT-OT boundary and inside cells.

■ Assets · 11 components

Laptops & Desktops — Employee workstations (Windows, macOS, Linux) used for daily operations — the primary endpoint attack surface in most enterprises.
Mobile (iPhone/Android) — Company-owned and BYOD smartphones and tablets accessing corporate email, apps, and data through MDM-managed profiles.
Network (Cisco/Meraki) — Routers, switches, wireless access points, and SD-WAN appliances forming the physical and logical network infrastructure.
Firewalls (Palo Alto) — Next-generation firewalls at network perimeter and internal segmentation points enforcing traffic policies and threat prevention.
Cloud (AWS/Azure) — IaaS and PaaS resources including EC2 instances, Lambda functions, Kubernetes clusters, and managed services across multi-cloud environments.
Servers (On-Prem) — Physical and virtual servers in on-premises data centers running legacy applications, Active Directory, and file shares.
Printers & IoT — Network printers, smart displays, conference room systems, HVAC controllers, and badge readers — often unmanaged and unmonitored.
USB & Removable Media — USB drives, external hard disks, and removable media that bypass network controls and can introduce malware or exfiltrate data.
Engineering Workstation — OEM engineering workstation used to program PLCs and modify control logic — typically Windows-based with vendor toolchains (RSLogix, TIA Portal, ControlBuilder).
IT-OT DMZ / Industrial Firewall — Boundary-enforcing firewall (or data diode / unidirectional gateway) between the IT enterprise zone and the OT cells — the Purdue Level-3.5 DMZ.
PLCs / ICS Controllers — Programmable logic controllers and safety-instrumented systems running the physical process — the closest layer to operational impact.

⬢ Applications · 10 components

ERP (SAP/Oracle) — Enterprise resource planning system managing finance, supply chain, HR, and operations — the operational backbone of the enterprise.
CRM (Salesforce) — Customer relationship management platform containing sales pipeline, customer contacts, deal history, and marketing data.
Google Workspace — Productivity suite including Gmail, Drive, Docs, Sheets, and Meet used daily by every employee for collaboration and communication.
Custom Web Apps — Internal line-of-business applications, customer portals, and microservices built in-house and deployed on cloud infrastructure.
DevOps (GitHub/CI) — Source code repositories, CI/CD pipelines, container registries, and infrastructure-as-code tools forming the software delivery chain.
HR Platform — Human resources information systems (Workday, BambooHR) managing employee lifecycle, payroll processing, and benefits administration.
Accounting (NetSuite) — Financial management application handling invoicing, expense tracking, financial reporting, and regulatory compliance (SOX).
Slack / Teams — Real-time messaging and collaboration platforms where sensitive discussions, file sharing, and integrations create invisible data flows.
VPN / Remote Access — Legacy VPN concentrators and modern ZTNA solutions providing remote workforce access to internal applications and resources.
SCADA / HMI — Supervisory control and data acquisition platforms plus human-machine interfaces operators use to monitor and command the process.

◆ Data · 9 components

Customer PII — Personally identifiable information including names, SSNs, addresses, and payment details stored across CRM, ERP, and cloud databases.
Financial Records — General ledger, accounts payable/receivable, payroll data, and tax records maintained in ERP and accounting systems.
IP & Trade Secrets — Product designs, source code repositories, proprietary algorithms, and strategic plans stored in document management and version control systems.
Employee HR Data — Personnel records, benefits information, performance reviews, and compensation data in HRIS platforms like Workday or BambooHR.
Cloud Object Storage — AWS S3 buckets, Azure Blob Storage, and GCP Cloud Storage containing backups, media assets, logs, and application data.
Databases (SQL/NoSQL) — Production databases including PostgreSQL, MySQL, MongoDB, and Redis instances hosting application state and business-critical data.
Email & Messaging — Corporate email archives, Slack/Teams message history, and attached files containing sensitive business communications.
Logs & Telemetry — Security logs, application telemetry, network flow data, and audit trails aggregated in SIEM and observability platforms.
Process & Telemetry Data — Time-series tag data, batch records, recipe libraries, and process logs — the operational truth and the regulatory record of plant behavior.