Complying with CMMC Configuration Management Requirements: Why Patching Isn’t Enough

This report explains how CMMC configuration management requirements apply to mobile devices, reviews relevant NIST guidance (including SP 800-171, SP 800-128, SP 800-124 Rev. 2, and SP 1800-4B), argues that patching alone is insufficient to meet CMMC controls, and advocates for Mobile Device Management, Mobile Application Management, and Mobile Threat Defense—specifically promoting Zimperium zIPS—as the recommended approach to protect CUI and achieve compliance.