Compliance intelligence

Posture that a
control assessment
does not show.

Six modules, computed from your system state, not typed into forms.

Request a demo Run the CMMC scoping wizard

ORION-1 / SPRSORION-1 / Compliance intelligence / SPRS

Computed

SPRS score

94of 110

6 practices open, 16 points

WEIGHTS 1, 3, 5

Six modules.
One source of truth.

Each module is computed from the same system state as your controls, findings and evidence.

NIST SP 800-171
SPRS score calculator
Your score under the DoD Assessment Methodology, with the gap ordered by point weight.
Score of 110
94
Practices open
6
Points open
16
FEDRAMP 20X
FedRAMP 20x Key Security Indicators
The indicator dashboard for FedRAMP 20x, read from your system state.
Indicators met
57
Need attention
4
CA-8
Penetration test tracking
Ingest the report, map findings to controls, open POA&M items, track each to verified closure.
Findings
14
Closed
11
POA&M items
3
SUPPLY CHAIN
Subcontractor compliance portal
Invite subcontractors, collect a documented self-assessment, see attested posture in one view.
Invited
4
Attested
3
In progress
1
REV 2 TO REV 3
NIST SP 800-171 Rev 3 transition
A crosswalk from 110 practices to 97 requirements, with unset parameters flagged.
Rev 2 to Rev 3
110 to 97
Parameters unset
7
CUI SYSTEMS
Model governance assessment
Inventory of language-model tools with access to CUI systems.
Tools
6
With CUI access
2
Needs review
1

Know your score
before your prime asks.

The score, the gap, and the order to close it in.

ORION-1 / SPRSORION-1 / Compliance intelligence / SPRS

Computed from system state

SPRS score

94of 110

104 of 110 practices met

Example prime threshold 88

Gap to 110, ordered by point weight

6 practices open

3.3.1In remediation
Create and retain system audit logs
5 pointsSystem administrator
3.11.2Open
Scan for vulnerabilities
5 pointsSecurity engineer
3.1.5In remediation
Employ least privilege
3 pointsSystem administrator
3.6.3Open
Test the incident response capability
1 pointSecurity engineer
3.1.9Open
Provide privacy and security notices
1 pointSystem administrator
3.1.10Open
Use session lock
1 pointPlatform engineer

Gap to 110, ordered by point weight
Practice	Requirement	Weight	Status	Owner
3.3.1	Create and retain system audit logs	5 points	In remediation	System administrator
3.11.2	Scan for vulnerabilities	5 points	Open	Security engineer
3.1.5	Employ least privilege	3 points	In remediation	System administrator
3.6.3	Test the incident response capability	1 point	Open	Security engineer
3.1.9	Provide privacy and security notices	1 point	Open	System administrator
3.1.10	Use session lock	1 point	Open	Platform engineer

110 minus 16 = 94

DoD Assessment Methodology for NIST SP 800-171. Weights 1, 3, 5. Range minus 203 to plus 110.

Rev 2 to Rev 3,
mapped for you.

The crosswalk carries each implementation across and flags every parameter still unset.

3.1.1Authorized access control
3.1.2Transaction and function control
3.5.3Multifactor authentication
3.5.7Password complexity
3.5.8Password reuse

03.01.01Account management
03.01.02Access enforcement
03.05.03Multi-factor authentication
03.05.07Password management

110 to 97

110 practices become
97 requirements.

Organization-defined parameters

Values you define for Rev 3 requirements

03.01.01Account inactivity periodSET
03.01.08Logon attempt limitSET
03.01.10Device lock inactivity periodUNSET
03.05.07Password composition rulesSET
03.13.11Cryptography typesUNSET

Unset parameters stay flagged
until a value is recorded

See your subcontractors' posture,
posture, not their
word for it.

One invitation per subcontractor. Their documented self-assessment becomes a posture you can see.

Prime
Your program
Invitation
Sent from the portal
Self-assessment
Documented by the subcontractor
Attested posture
Affirmed by the subcontractor
Prime view
Status across the supply chain

ORION-1 / Supply chainORION-1 / Compliance intelligence / Supply chain

3 of 4 attested

Subcontractor A
Attested
CMMC level
Level 2
SPRS score
104
Assessed
2026-09-18
Subcontractor B
Attested
CMMC level
Level 2
SPRS score
91
Assessed
2026-08-30
Subcontractor C
Attested
CMMC level
Level 2
SPRS score
77
Assessed
2026-09-02
Subcontractor D
Self-assessment in progress
CMMC level
Level 2
SPRS score
Pending
Assessed
Invited 2026-10-01

Subcontractor posture
Subcontractor	CMMC level	SPRS score	Assessed	Status
Subcontractor A	Level 2	104	2026-09-18	Attested
Subcontractor B	Level 2	91	2026-08-30	Attested
Subcontractor C	Level 2	77	2026-09-02	Attested
Subcontractor D	Level 2	Pending	Invited 2026-10-01	Self-assessment in progress

Attested: affirmed by the subcontractor in a documented self-assessment.

CMMC Phase II
is suspended.

Your obligations
are not.

Third-party assessments were suspended on July 13, 2026. Self-assessment, DFARS 252.204-7012, the 110 NIST SP 800-171 requirements and SPRS entries remain.

SUSPENDED

Third-party assessments

STILL IN FORCE

Self-assessment
DFARS 252.204-7012
110 NIST SP 800-171 requirements
SPRS entries

Free

CMMC scoping wizard

About 20 minutes. No account.

SEVEN STEPS · BUSINESS CONTEXT TO SCOPING PACKAGE

Start scoping

Authorization is not a destination. It is a system property.

Request a demo and we will walk one finding from detection to signed evidence.

Request a demo See the platform

Federal programs
Invitation only, with CAC and PIV.
Request access
Commercial teams
Self-register with single sign-on.
Create a workspace
Pricing
Plans start at $2,500 per month. In-boundary and air-gapped deployments are scoped per program.
See pricing

Posture that a control assessment does not show.

Six modules. One source of truth.

SPRS score calculator

FedRAMP 20x Key Security Indicators

Penetration test tracking

Subcontractor compliance portal

NIST SP 800-171 Rev 3 transition

Model governance assessment

Know your score before your prime asks.

Rev 2 to Rev 3, mapped for you.

See your subcontractors' posture,posture, not their word for it.

CMMC Phase II is suspended. Your obligations are not.