Skip to main content

Now accepting design partners.

Request a demo
Request a demo

Defense contractors

Know your real posture before your prime asks.

Your SPRS score, your gaps and your evidence, computed from the systems that hold CUI.

Request a demoSee the platform

ORION-1 / SPRS

Computed 04:00 UTC

SPRS score

94of 110

NIST SP 800-171 Rev 2

DoD Assessment Methodology

Open practices, by weightPoints
  • Weight 5Create and retain system audit logs3.3.1-5
  • Weight 5Scan for vulnerabilities3.11.2-5
  • Weight 3Employ least privilege3.1.5-3
  • Weight 13 more practices at weight 1-3

Computed from the systems that hold CUI

2026-10-08 04:00Z

Your score is on file.
Your affirmation is binding.

Three pressures on every contractor that handles CUI.

  • 01

    An affirmation is a legal claim

    An inaccurate entry can be pursued under the False Claims Act.

    FALSE CLAIMS ACT ·
    CIVIL CYBER-FRAUD INITIATIVE

  • 02

    Your prime will ask for your score

    Your SPRS entry is part of how a prime chooses its subcontractors.

  • 03

    Requirements flow down the chain

    DFARS 252.204-7012 follows the CUI to every subcontractor that receives it.

    DFARS 252.204-7012 · FLOWDOWN

32 CFR PART 170

CMMC Phase II third-party assessments were suspended on July 13, 2026. Self-assessment, DFARS 252.204-7012 and the 110 NIST SP 800-171 requirements remain.

How REAEGIS answers

The score, the gaps and the proof come from the same signed records.

01

Your SPRS score,
computed continuously

Open practices are ordered by weight, so you can see which fix moves the score most.

AXIOMPHAROS

ORION-1 / SPRS gap

16 points to 110
  • 94Score today
  • 104After the two weight 5 fixes
  • 110Every practice met
PracticeScore if closed
  • Create and retain system audit logs993.3.1Weight 5
  • Scan for vulnerabilities1043.11.2Weight 5
  • Employ least privilege1073.1.5Weight 3
  • Test the incident response capability1083.6.3Weight 1
  • Provide privacy and security notices1093.1.9Weight 1
  • Use session lock1103.1.10Weight 1

DoD Assessment Methodology,
110 practices weighted 1, 3 or 5

range -203 to +110

02

Signed evidence behind
every affirmation

Each practice marked met points to signed records, so the person who affirms can see the basis first.

CHRONICLEAXIOM

3.14.1

Identify and correct system flaws

Met3 signed records

Evidence records

  • Scan result, api-gatewaysha256:9f2c…a41eRekor 142907113
  • Pull request #482, approvedsha256:5b7e…02c9Rekor 142907340
  • Verification re-scansha256:e01d…7a36Rekor 142907502

Affirming official

reads the basis first

Basis documented

REAEGIS documents the basis. The affirmation stays a decision made by a person.

03

Rev 2 to Rev 3,
mapped for you

The 110 practices become 97 requirements. Each one is mapped, and unset parameters are flagged.

AXIOM

ORION-1 / Rev 3

7 parameters unset
110Rev 2 practices
97Rev 3 requirements
7Organization-defined parameters unset
RequirementParameters
  • Account management3.1.1maps to03.01.01Set
  • Unsuccessful logon attempts3.1.8maps to03.01.08Set
  • Password management3.5.7, 3.5.8, 3.5.9maps to03.05.072 unset
  • Cryptographic protection3.13.11maps to03.13.111 unset
  • Supply chain risk management planNew in Rev 3maps to03.17.01New

Requirements with unset parameters are flagged

04

A portal for your
subcontractors

Invite each one, collect a documented self-assessment, and see attested posture across your supply chain.

AXIOMCHRONICLE

ORION-1 / Subcontractors

4 invited
  1. 01Invite
  2. 02Documented self-assessment
  3. 03Attested posture
SubcontractorSelf-assessment
  • Subcontractor AHandles CUIDocumentedAttested 2026-09-18
  • Subcontractor BHandles CUIDocumentedAttested 2026-10-02
  • Subcontractor CHandles CUIIn progressNot yet attested
  • Subcontractor DHandles FCIInvitedInvited 2026-10-06

Each attestation is recorded as a signed event

What you hand over

What you keep on file, what your prime asks for, and what stands behind your affirmation.

  • System security plan

    ssp.oscal.json

    How each requirement is implemented, tied to the evidence for it.

    • SSP
    • OSCAL

  • POA&M

    poam.oscal.json

    Open practices, ordered by weight, with closure evidence as each one is fixed.

    • POA&M
    • OSCAL

  • SPRS score basis

    sprs-basis-2026-10.pdf

    The score, each deduction by weight, and the records behind every practice marked met.

    • DOD ASSESSMENT METHODOLOGY

  • Signed evidence packages

    evidence-2026-10.bundle

    The documented basis for an affirmation.

    • COSIGN
    • REKOR

  • Scoping package

    scoping-package.pdf

    Level determination, boundary description, asset inventory, CUI data flow and gap analysis.

    • FROM THE SCOPING WIZARD

  • EVERY FILE IS

    • Signed with Cosign
    • Anchored in Sigstore Rekor
    • Checkable with public tools

Frameworks

  • CMMC Levels 1 to 3
  • NIST SP 800-171 Rev 2 and Rev 3
  • DFARS 252.204-7012

Where it runs

In REAEGIS cloud. Your team registers itself and signs in with the identity provider you already use.

REAEGIS cloud

Runs outside and connects to your pipeline.

Crosses the boundary
Findings and pull requests
Sign-in
SAML 2.0, OpenID Connect

HOW PEOPLE SIGN IN

Self-registration

  1. Your team

    Registers itself

  2. Single sign-on

    Your identity provider

  3. REAEGIS cloud

    Isolated by tenant

CMMC scoping wizard

Scope your assessment in one sitting.

  • Free
  • No account
  • About 20 minutes
  1. 01Business context2 min
  2. 02CUI identification3 min
  3. 03Asset inventory5 min
  4. 04CUI data flow mapping4 min
  5. 05Assessment boundary definition2 min
  6. 06Gap analysis against 110 practices3 min
  7. 07Scoping packageinstant
Start scoping

Authorization is not a destination. It is a system property.

Request a demo and we will walk one finding from detection to signed evidence.

Request a demoSee the platform

  • Federal programs

    Invitation only, with CAC and PIV.

    Request access

  • Commercial teams

    Self-register with single sign-on.

    Create a workspace

  • Pricing

    Plans start at $2,500 per month. In-boundary and air-gapped deployments are scoped per program.

    See pricing