CMMC compliance where every one of the 320 objectives is proven before an executive signs
Every one of the 320 objectives proven before an executive signs the affirmation.
See one case, screen by screen ↓Software that builds the System Security Plan and POA&M against NIST 800-171 for CMMC assessments at defense contractors. CMMC Compliance adds seven agents that draw the CUI boundary from your real flows, write each SSP statement from the configuration it cites, grade all 320 objectives, compute the SPRS score and keep the POA&M inside 32 CFR 170.21. Your compliance lead decides, and your affirming official signs only when every claim is proven.
How to choose AI solutions for back-office and enterprise work →
Updated
A defense contractor that handles CUI has to meet the 110 requirements of NIST SP 800-171 — 320 assessment objectives — write a System Security Plan, score itself on the DoD Assessment Methodology from −203 to 110, post the score in SPRS and keep a POA&M that only certain gaps may go on. Then a senior official affirms that all of it is true. Phase 1 self-assessments have applied since 10 Nov 2025, and with Phase 2 paused in July 2026 the self-assessment, the SPRS score and the annual affirmation still stand.
Today the boundary is drawn in workshops from old diagrams, so CUI on a forgotten file share is found by the assessor, not by you. The SSP describes intent — “we encrypt CUI” — rather than the setting. Self-assessments mark “met” with no evidence behind it, POA&Ms carry gaps that 32 CFR 170.21 does not allow, and the affirming official signs a score he cannot see the proof for. A false affirmation is a False Claims Act matter.
Estimated split for a mid-size defense business unit's first Level 2 self-assessment, by hand and with the solution.
Seven agents map the CUI boundary, write and grade the SSP, and keep the POA&M inside the rule; the compliance lead decides and the senior official signs.
Kestrel & Vane Defense Systems, the defense business of Kestrel & Vane Group, needs Level 2 (Self) status in SPRS before option year 2 of contract HQ-26-C-0418 on 30 November. It is Thursday 15 October, 46 days out. Here is the day, screen by screen, in the working solution.
The agents finished at 06:10: 412 assets sorted, 110 statements checked, 320 objectives graded. The SPRS score is 96, up from the 72 posted on 14 Mar; 291 of 320 objectives are proven. One gap blocks Tom Reese's affirmation, and five more things need Nadia.
POA&M agent, 06:04: “FS-02 holds CUI with no encryption — 3.13.11 cannot go on the POA&M.”
Nadia asks in plain words, beside the agents' overnight thread. The POA&M agent answers: file share FS-02 holds 412 CUI-marked files with no encryption at rest, which fails 3.13.11 for 5 points — and a requirement worth more than 1 point cannot go on a POA&M. Each claim carries a numbered source she can open.
“Until FS-02 is fixed or taken out of scope, Tom would be affirming a status we do not have.”
The Asset agent sorted 412 assets from the inventory, 90 days of firewall flows and the data labels: 64 CUI assets, 23 Security Protection Assets, 118 Contractor Risk Managed Assets, 31 Specialized Assets and 176 out of scope. Three of 38 flows cross the boundary where they should not, drawn dashed on the map. The SPRS rail beside it lists the 10 requirements still not met, 14 points, each with its POA&M eligibility.
Flow F-17: the CAD group wrote 2,184 files to \\fs02\eng-share in 90 days, and 412 carry the CUI//SP-CTI marking. The agent proposes moving FS-02 from out of scope to CUI asset at 97% confidence and shows each step it took. CNC-14, a 5-axis mill with a vendor support link, came in at 61% — below its 80% line, so it went to Luis Ortega instead of a proposal.
The Asset agent reads CUI markings, never file contents, and never moves an asset out of scope on its own.
The Practice agent writes that software installs are blocked by allow-list policy AL-02 on the 22 enclave laptops. The Assessor agent disputes it: the endpoint log shows 14 enclave workstations where users installed software in the last 30 days. Both arguments sit side by side, the Assessor's verdict stands, and Nadia settles it.
The Assessor agent cannot be overruled by the Practice agent and cannot lower the bar.
In 4 min 12 s the Assessor agent graded every objective of NIST SP 800-171A: 291 met, 21 not met, 8 not applicable. In its first pass it refused “met” on 26 objectives that had a statement but no evidence; the Evidence agent found proof for 19. The 10 findings carry their points and a POA&M chip.
“Grade each of the 320 objectives against evidence I can open; a statement alone is not proof.”
POA&M v4 holds nine requirements worth 1 point each, every one with an owner and a next milestone; the last is due 19 Feb 2027, 53 days inside the 180-day close-out. 3.13.11 on FS-02 is refused, and the agent prices the ways out: encrypt FS-02 in FIPS mode in about a day, or move the share into FS-11 and block F-17 in about three. Putting it on the POA&M is shown greyed — not allowed by the rule.
The rule, checked: score 96 is 88 or more · every item is worth 1 point · none from the never-on-a-POA&M list · close-out inside 180 days.
Nadia picks option A, turn on FIPS-validated encryption on FS-02, with the reason code “Remediate now — fastest path to Conditional” and a note for the record. Change CHG-20931 goes to Luis Ortega with a 2-day SLA, and the agents re-check it when it closes.
“I, Nadia Brennan, make this decision. It is signed and logged.”
Luis closes the change. The Evidence agent re-reads FS-02: encryption on, XTS-AES 256, FIPS-compliant algorithms enabled, and the validated module certificate EV-1187 matches the build. The Assessor agent marks 3.13.11 met, the Practice agent re-drafts the statement for Nadia to approve, and the score moves from 96 to 101.
The Evidence agent is read-only: it never changes a system, and a person makes every fix.
Tom opens the affirmation: six plain-words lines, each linked to its proof, five of five gates passed and the False Claims Act warning. He types his name, acknowledges the warning and verifies with his security key. The SPRS entry is prepared for Nadia to post, and the close-out and annual affirmations are scheduled.
“I affirm that Kestrel & Vane Defense Systems has implemented, and will maintain, the security requirements of NIST SP 800-171 Rev. 2 … with a score of 101.”
The same gap, seen by the five people who carry a CMMC programme — what their year looked like, and what it looks like now.
Seven agents map the CUI boundary, write and grade the SSP, and keep the POA&M inside the rule; the compliance lead decides and the senior official signs.
Sorts every asset into the five CMMC Level 2 categories with a reason and a confidence, from the inventory, 90 days of firewall flows, identity groups, the endpoint manager and the data labels — and finds CUI outside the boundary.
Collects and refreshes evidence from 11 systems on schedule, flags evidence older than the freshness rule, and re-checks a system when a change closes.
Writes the SSP implementation statement for each of the 110 requirements from the real configuration, citing the setting, and re-drafts when the boundary or a configuration changes.
Runs a mock assessment of all 320 objectives the way a certified assessor would, disputes statements the evidence does not support, and hands disputes and findings to the compliance lead.
Computes the SPRS score on the DoD Assessment Methodology — start at 110, subtract 5, 3 or 1 per unmet requirement — shows the arithmetic, and prepares the SPRS entry and the affirmation text.
Builds the POA&M with only eligible items, tracks the 180-day clock, and for an ineligible gap prices the ways out — remediation and re-scoping — with the time and the effect on the score.
Follows CUI to the subcontractors it reaches, checks each one's level, SPRS score and affirmation date every week, and drafts requests and holds.
Decide and sign. The agents propose; a named person decides.
On every screen, ask the agents why — about a gap, the score, a dispute or what you are signing. Each answer cites its source and can open the screen that acts on it.
Why is the affirmation blocked?
One gap. File share FS-02 holds 412 CUI-marked files with no encryption at rest. That fails 3.13.11 for 5 points, and a requirement worth more than 1 point cannot go on a POA&M — 3.13.11 only when encryption is used but not FIPS-validated. Until FS-02 is fixed or taken out of scope, Tom would be affirming a status we do not have.
What moved the score from 72 to 96?
Evidence for six requirements the March self-assessment scored as not met: 3.5.3 MFA (+5), 3.1.12 remote-access monitoring (+5) and 3.3.1 audit logs (+5), 3.14.2 malicious-code protection (+5), 3.1.5 least privilege (+3) and 3.1.6 separate admin accounts (+1). 24 points in all, each on the DoD methodology.
Why did you refuse “met” on 26 objectives?
Each had a statement but no evidence I could open. A statement is a claim, not proof. I asked the Evidence agent; it found proof for 19 — MFA, remote-access monitoring and audit logs, endpoint protection and privileged roles. The other 7 are the three disputed requirements.
What exactly am I signing?
That Kestrel & Vane Defense Systems has implemented the 110 requirements of NIST SP 800-171 for its CMMC Level 2 (Self) status — except the nine on the POA&M — and will keep them in place. Each line on this page links to its proof. You are the Affirming Official; nobody can sign for you.
13 screens from the working solution, on its sample data. Pick one to see it large.
The thresholds the agents work to are settings, signed and saved as a new version. What 32 CFR 170.21 fixes is shown and locked.
| Setting | Default | Choose from |
|---|---|---|
| Minimum score for Conditional status | 88 | Fixed by 32 CFR 170.21 — 80% of 110; locked |
| POA&M close-out | 180 days | Fixed by 32 CFR 170.21; locked |
| Evidence freshness — configurations | 30 days | Any number of days; older evidence cannot support “met” |
| Evidence freshness — documents and policies | 90 days · 365 days | Any number of days for procedures, records and logs, and for approved policies |
| Asset agent pre-selects proposals at | 95% | Any confidence; you still confirm them |
| Asset agent asks a person below | 80% | Any confidence; low-confidence categories go to the IT Security Manager |
| Owner task SLA | 5 working days | Any number of working days, then it escalates to the IT Security Manager |
| Affirmation reminders · supplier re-check | 60, 30, 7 days before · Weekly | Reminders to the Affirming Official and the lead · re-check against SPRS Weekly or Daily |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (vendor estimates of 3–6 months for a first SSP; US Department of Justice, Civil Cyber-Fraud settlement with a defense contractor, Mar 2025). Sources: 32 CFR 170 (CMMC Program, in force 16 Dec 2024; 170.21 POA&M rules; 170.22 affirmation) · NIST SP 800-171 Rev. 2 and 800-171A · DoD Assessment Methodology (−203 to 110) · Skadden, Jul 2026 (Phase 2 paused; self-assessment duties remain). Kestrel & Vane Group, its defense business, suppliers, contracts, systems and the people named on this page are fictional — characters and sample data in the working solution.
Software that builds the System Security Plan and POA&M against NIST 800-171 for CMMC assessments at defense contractors. CMMC Compliance adds seven agents that draw the CUI boundary from your real flows, write each SSP statement from the configuration it cites, grade all 320 objectives, compute the SPRS score and keep the POA&M inside 32 CFR 170.21. Your compliance lead decides, and your affirming official signs only when every claim is proven.
The Practice agent drafts the implementation statement for each of the 110 requirements from configuration exports, the policy library and the evidence vault, citing the setting it rests on. It writes “not implemented” when that is the truth and never changes an approved statement on its own; the compliance lead approves each one with a reason code.
The POA&M agent checks every gap against 32 CFR 170.21: a score of 88 or more, only requirements worth 1 point — or 3.13.11 when encryption is used but not FIPS-validated — none from the never-on-a-POA&M list, and close-out inside 180 days. An ineligible gap is refused, and the agent prices the ways out for a person to choose.
Yes. The Score agent computes it on the DoD Assessment Methodology — start at 110 and subtract 5, 3 or 1 for each requirement not met — and shows the arithmetic. It prepares the SPRS entry, but agents never post to SPRS: your compliance lead posts it.
The Asset agent reads the asset inventory, 90 days of firewall flows and the CUI markings on stored files — never the file contents — and flags flows that cross the boundary where they should not. In the working solution it found 412 CUI-marked files on a share listed as out of scope. It proposes; a person confirms every boundary change.
Yes. The Supplier agent follows CUI to the subcontractors it reaches and checks each one's required level, SPRS score and affirmation date every week. It drafts requests and CUI holds; nothing is sent or held until the Contracts Manager approves and signs.
Yes. The agents hold no approval rights and never sign or affirm. Every decision carries a named person, a reason code and a signature, and the affirmation stays locked until all its gates pass — then the affirming official reads each claim with its proof and the False Claims Act warning, and signs with his security key.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your current SSP, policies, asset inventory and the read-only connections to your systems — and it goes live once every quality gate has passed. We will walk you through it on your own boundary first.
Exceptions found before the auditor finds them, and one evidence set for both audits.
1-min demoNIS2 ComplianceEvery EU entity scoped, registered and evidenced per country, with the board signing off.
1-min demoCyber Incident ReportingEvery regulator clock met, from one cited set of facts the committee signed.
1-min demoWe'll run CMMC Compliance on a copy of your asset inventory, firewall flows and current SSP.