AssuranceGraph AI

Know your SPRS score before your assessor does.

AssuranceGraph scores all 110 NIST SP 800-171 requirements exactly as 32 CFR 170.24 does, keeps your SSP and POA&M in step with your evidence, and keeps CUI inside your boundary when AI helps.

Join the pilot See pricing

Where a Level 2 self-assessment can land

Every contractor starts at 110 and loses 1, 3 or 5 points for each requirement not met, down to −203. The score decides what you can do next.

Scale compressed below 0.

Below 88No conditional status. Every gap has to close before you can be certified.
88 to 109Conditional status. Remaining 1-point gaps go on a POA&M and must close within 180 days.
110Final status. All requirements met.
Below 88: close gaps before assessment.

One live record of your CMMC readiness

Each change to a requirement recalculates the score, updates the documents that depend on it, and is written to an audit ledger your assessor can check.

SPRS score to the rule
5-, 3- and 1-point weights, partial credit only where the rule allows it (3.5.3 and 3.13.11), and unassessed items shown as unassessed, never as met.
POA&M that enforces the rules
Only eligible 1-point items can be deferred, the six never-deferrable requirements are blocked, and 180-day closeout alerts go out at 30, 14 and 3 days.
SSP drafted from live state
Every statement links to evidence, and a named person approves it before it is published. Export the SSP and POA&M as OSCAL 1.1.2, validated against NIST's schemas.
Tamper-evident evidence ledger
Every change is hash-chained with SHA-256, so altering an earlier record breaks the chain and shows.
Software releases as evidence
Import SARIF from ShipShield, CodeQL, Semgrep or Fortify. A signed ship verdict becomes evidence for 3.11.2, 3.11.3 and 3.14.1.
Time-boxed assessor access
Give your C3PAO read-only access to exactly the evidence you choose, for up to 90 days. Every view is logged.
Rev 2 and Rev 3 side by side
Track your NIST SP 800-171 Rev 2 status today and see how it maps to Rev 3.
Annual affirmation reminders
Your Affirming Official is reminded at 60, 30 and 7 days, with the current score in front of them.

AI help that never sends CUI out of your boundary

Sovereign Mode routes anything marked as CUI to a model running on your own hardware. If that model isn't available, the request stops. It never falls back to a cloud provider.

  • Only approved models, each checked by file hash and license.
  • Your node and our cloud exchange five kinds of signed messages, and nothing else.
  • AI drafts. A named person approves everything that is published.
CUI request goes to your on-premises model
Local model unavailable: request refused, nothing sent
Non-CUI request may use an approved cloud model

Pricing

Per workspace, billed monthly or yearly. Paying yearly costs ten months.

Essentials$449 /month$4,490 a year Professional$899 /month$8,990 a year Enclave$1,999 /month$19,990 a year
SPRS score, SSP and POA&M✓✓✓
Evidence ledger and affirmation reminders✓✓✓
OSCAL export—✓✓
Rev 2 and Rev 3 crosswalk—✓✓
Software releases as evidence—✓✓
Assessor access—✓✓
Sovereign Mode (on-premises AI for CUI)——✓

Enclave runs Sovereign Mode on hardware you supply and control. Prices are in US dollars.

Join the pilot

We are taking a small group of defense contractors preparing for CMMC Level 2.

  1. Email us with your company name and roughly how many people handle CUI.
  2. We set up your workspace and walk through your current score with you.
  3. You keep the workspace, and your evidence, when the pilot ends.

Email contact@cloudonesoftware.com

What AssuranceGraph is not. It helps you prepare for and maintain a CMMC Level 2 assessment. It does not certify you: only an authorized C3PAO can. Your score is only as accurate as the evidence behind it.

Built by CloudOneSoftware LLC, a SAM.gov-registered company in Jersey City, New Jersey.