Skip to main content

Now accepting design partners.

Request a demo
Request a demo

Resources

Get oriented
before a first call.

A scoping tool, documentation, reference pages and the current state of the rules, in one place.

Request a demoStart the scoping wizard

reaegis.com / resources

Reviewed October 2026
  1. 01Start hereScoping wizard, documentation, service status3 LINKS
  2. 02Reference pagesGates, integrations, deployment, security4 PAGES
  3. 03Regulatory statusCMMC, FedRAMP RFC-0024, NIST SP 800-1713 BRIEFS
  4. 04GlossaryFrom ATO to transparency log20 TERMS
  5. 05Find your pageAgencies, DoD programs, contractors, providers4 PAGES

ALSO AT

docs.reaegis.comstatus.reaegis.com
Reviewed October 2026

Three places to start.

A tool to run, documentation to read and a status page to check.

CMMC scoping wizardSeven steps, from business context to a finished scoping package.FreeNo accountAbout 20 minutes
  1. 01Business context2 MIN
  2. 02CUI identification3 MIN
  3. 03Asset inventory5 MIN
  4. 04CUI data flow mapping4 MIN
  5. 05Assessment boundary definition2 MIN
  6. 06Gap analysis against 110 practices3 MIN
  7. 07Scoping packageINSTANT
YOU LEAVE WITHLevel determinationBoundary descriptionCategorized asset inventoryCUI data flow diagramGap analysis with SPRS score
Documentationdocs.reaegis.comGuides for connecting a repository and reading your first findings.GUIDES02Connecting a repositoryReading your first findings (opens in a new tab)Service statusstatus.reaegis.comWhere to check on the service before you report a problem.LAYOUT ONLY.
LIVE STATE IS ON THE STATUS PAGE. (opens in a new tab)

Four pages to study.

Each one answers a single question: what runs, what connects, where it runs and how it is built.

Where the rules stand.

Three briefs on rules in motion: what changed, what still applies and where REAEGIS fits.

Phase II suspended32 CFR PART 170

CMMC

LEVELS 1 AND 2Self-assessmentsIN FORCEPHASE IIC3PAO assessmentsSUSPENDED

WHAT CHANGED

Phase II third-party C3PAO assessments were suspended on July 13, 2026.

WHAT STILL APPLIES

  • Level 1 and Level 2 self-assessments
  • DFARS 252.204-7012
  • The 110 NIST SP 800-171 requirements
  • SPRS entries
  • False Claims Act exposure for inaccurate affirmations

WHERE REAEGIS FITS

REAEGIS computes your SPRS score and your gaps from the systems that hold CUI.

For defense contractors

REVIEWED OCTOBER 2026

In the 2026 rulesMACHINE-READABLE PACKAGES

FedRAMP RFC-0024

{ "system-security-plan": { … } }JSON BY DEFAULT,
OSCAL OPTIONAL IN SOME CASES

WHAT CHANGED

The Consolidated Rules for 2026 replace Word and Excel templates with machine-readable data. JSON is the default, OSCAL optional in some cases.

WHAT STILL APPLIES

  • Continuous monitoring, every month
  • An updated POA&M
  • Current scan results
  • Change reporting
  • An updated inventory

WHERE REAEGIS FITS

REAEGIS produces the OSCAL SSP, assessment plan, assessment results and POA&M from live state.

For cloud service providers

REVIEWED OCTOBER 2026

Rev 2 to Rev 3REVISION

NIST SP 800-171

110practices, Rev 297requirements, Rev 3

WHAT CHANGED

From Rev 2 to Rev 3, 110 practices become 97 requirements with organization-defined parameters.

WHAT STILL APPLIES

  • The 110 requirements that CMMC cites
  • SPRS scoring across 110 practices
  • Weights of 1, 3 or 5 per practice

WHERE REAEGIS FITS

REAEGIS maps Rev 2 to Rev 3 in a crosswalk and flags the parameters that are not yet set.

See compliance intelligence

REVIEWED OCTOBER 2026

Twenty terms,
in plain words.

Grouped by what each term describes.
One sentence each.

01

Authorization

5 terms

ATO
AUTHORIZATION TO OPERATEThe formal decision by an Authorizing Official to accept the risk of operating a system.
Continuous ATO
ALSO WRITTEN cATOAn authorization kept in force by showing three competencies: continuous monitoring, active cyber defense and a secure software supply chain.
Impact level
IL2 TO IL5A DoD rating of data sensitivity for cloud systems: IL4 covers CUI, IL5 covers higher-sensitivity CUI and national security systems.
Inherited control
CONTROL INHERITANCEA control that another system or provider implements and your system relies on, instead of implementing it itself.
RMF
RISK MANAGEMENT FRAMEWORKThe seven-step NIST SP 800-37 process for authorizing a system and keeping it authorized, from Prepare to Monitor.

IN THE PRODUCT

See readiness in the Command Center

02

Evidence and records

7 terms

eMASS
ENTERPRISE MISSION ASSURANCE SUPPORT SERVICEThe DoD system of record for RMF.
OSCAL
OPEN SECURITY CONTROLS ASSESSMENT LANGUAGEA set of machine-readable formats from NIST for security plans, assessment results and POA&Ms.
POA&M
PLAN OF ACTION AND MILESTONESThe list of known weaknesses in a system, each with a planned fix and a date.
SBOM
SOFTWARE BILL OF MATERIALSAn inventory of the components and dependencies inside a piece of software.
SPRS
SUPPLIER PERFORMANCE RISK SYSTEMThe DoD system where a contractor records its NIST SP 800-171 assessment score.
SSP
SYSTEM SECURITY PLANThe document that describes a system, its boundary and how each control is implemented.
Transparency log
FOR EXAMPLE, SIGSTORE REKORAn append-only record of signing events, where any entry can be checked independently.

IN THE PRODUCT

See how evidence is signed and anchored

03

Programs and frameworks

5 terms

CMMC
CYBERSECURITY MATURITY MODEL CERTIFICATIONThe DoD program, codified at 32 CFR Part 170, that sets cybersecurity requirements for contractors at Levels 1 to 3.
CUI
CONTROLLED UNCLASSIFIED INFORMATIONGovernment information that is not classified but that law, regulation or policy requires to be safeguarded.
FedRAMP
FEDERAL RISK AND AUTHORIZATION MANAGEMENT PROGRAMThe federal program that standardizes security assessment and authorization for cloud services used by agencies.
Key Security Indicator
KSIA security outcome that FedRAMP 20x asks a cloud service provider to demonstrate.
STIG
SECURITY TECHNICAL IMPLEMENTATION GUIDEA hardening baseline published by DISA for a specific product or technology.

IN THE PRODUCT

See the compliance intelligence modules

04

People

3 terms

Authorizing Official
AOThe senior official who accepts the risk of operating a system and makes the authorization decision.
C3PAO
CMMC THIRD-PARTY ASSESSMENT ORGANIZATIONAn accredited organization that conducts third-party CMMC assessments.
ISSO
INFORMATION SYSTEM SECURITY OFFICERThe person responsible for the day-to-day security posture of a system.

Find your page.

Four audience pages. Each starts from your framework and ends with what you hand over.

Authorization is not a destination. It is a system property.

Request a demo and we will walk one finding from detection to signed evidence.

Request a demoSee the platform

  • Federal programs

    Invitation only, with CAC and PIV.

    Request access

  • Commercial teams

    Self-register with single sign-on.

    Create a workspace

  • Pricing

    Plans start at $2,500 per month. In-boundary and air-gapped deployments are scoped per program.

    See pricing