Five frameworks. One evidence system.
Aerospace and defense companies do not get to choose which regulations apply.
Contract Disqualification
CMMC non-conformity is not a fine. It puts contract eligibility at risk.
CMMC eligibility depends on the required status, assessment result, contract and permitted remediation rules. Limited Plans of Action and Milestones may be permitted for eligible requirements, subject to strict conditions and deadlines.
Certification Rejection
DO-178C findings must be resolved and can delay certification.
DO-178C findings must be resolved and can delay certification — a traceability gap found during the Software Accomplishment Summary review must be closed before type approval.
110 requirements. 317K+ vulnerabilities. And your contract renewal is already scheduled.
NIST SP 800-171 requirements assessed at CMMC Level 2, each requiring objective evidence of implementation for C3PAO assessment.
Known open-source vulnerabilities tracked by Black Duck — with 63,000+ exclusive BDSA advisories not in NVD.
Of aerospace and defense codebases contain high or critical open-source vulnerabilities. Source: Black Duck OSSRA 2026.
Black Duck BDSA advisories ahead of NVD on average — critical lead time for ITAR-restricted component vulnerability response. Source: Black Duck BDSA product documentation.
Reduction in audit preparation time when SBOM, vulnerability, license, remediation, and approval evidence are maintained continuously.
Aerospace and defense companies answer to more than one framework — simultaneously.
| Regulation | Who it affects | Timing | What you must answer | How X-DLM™ helps |
|---|---|---|---|---|
| CMMC 2.0 | US Defense Industrial Base (DIB) contractors supplying to the Department of Defense. | In force — rolling DoD contract renewals. CMMC eligibility depends on the required status, assessment result, contract and permitted remediation rules. | CMMC Level 2 assesses 110 NIST SP 800-171 requirements. SBOM delivery may be required separately by contract. Limited Plans of Action and Milestones may be permitted for eligible requirements, subject to strict conditions and deadlines. | Polarion governs CMMC practice workflows; Black Duck provides vulnerability and SBOM evidence; X-DLM™ routes findings into auditable work items with timestamps, owners, and approval chains. |
| DO-178C | Avionics, airborne software teams — all Design Assurance Levels (DAL A–E). Required for FAA/EASA type approval. | Ongoing — required for every new certification and major modification. DO-178C findings must be resolved and can delay certification. | Software plans, requirements traceability matrix, static analysis records, test cases and results, configuration control records, PSAC and SAS documentation. | Polarion links requirements through architecture, code, static analysis, test, release — one traceable chain. Black Duck provides vulnerability and component data. Evidence builds as work is done. |
| NIST SP 800-218 (SSDF) | US federal contractors and software vendors in the DoD supply chain. | Active federal procurement requirement — SBOM delivery now standard in DoD contracts. | Secure development practices, vulnerability management, SBOM provision, provenance tracking, third-party component control, evidence of process maturity. | Black Duck generates SPDX/CycloneDX SBOMs; Polarion maintains SSDF lifecycle evidence; X-DLM™ synchronizes both for contracting officer delivery. |
| ITAR / EAR | US exporters of defense articles and dual-use technology with software components. ITAR controls defense articles, services and related technical data identified under the USML. | Ongoing — enforced by DoS and DoC. Criminal penalties and export privilege revocation for violations. | Open-source component traceability in export-controlled software; provenance records for every dependency. Export classification depends on the software's technical characteristics, jurisdiction, end use and destination—not simply its open-source status. | Black Duck identifies components with export-control implications; X-DLM™ routes flagged components into Polarion review workflows before they reach an export-controlled build. |
| IEC 62443 | Industrial automation, OT/ICS software — defense systems and critical infrastructure suppliers. | Referenced in DoD supply chain requirements. Widely used security lifecycle baseline for connected industrial systems. | Security lifecycle requirements, zone and conduit modeling, supplier cybersecurity requirements, security level documentation. | Polarion templates and X-DLM™ workflow automation align to IEC 62443 security lifecycle requirements; Black Duck supplies component risk intelligence. |
| Open Source License Obligations | Any defense contractor using open-source components in export-controlled or commercially delivered software. | Ongoing — applies at point of use, distribution, or delivery to the government. | License identification, restriction detection, IP exposure management, ITAR-relevant component flagging, documentation of all license decisions. | Black Duck tracks 3,000+ license types; X-DLM™ routes license decisions into Polarion for documented review and sign-off — producing an auditable license decision record. |
From Black Duck finding to Polarion evidence trail.
- 01
Detect
Black Duck scans source, binaries, containers, and firmware — producing SBOM data, vulnerability intelligence, license risk, and ITAR-relevant component flags.
- 02
Route
X-DLM™ synchronizes findings into Polarion as governed work items — with assigned owners, CMMC practice mapping, escalation timelines, and approval chains.
- 03
Trace
Findings are linked to requirements, architecture, code, test cases, test results, releases, and risk acceptance decisions — the DO-178C and CMMC evidence chain.
- 04
Prove
LiveDocs and Polarion workflow history produce the evidence package on demand — for C3PAO assessment, DER review, contracting officer delivery, or program audit.
One evidence system for every framework.
Book a walkthrough of how X-DLM™ operationalizes CMMC, DO-178C, NIST SSDF, ITAR/EAR, and IEC 62443 evidence in aerospace and defense engineering workflows — on Siemens Polarion and Black Duck.