You got the letter from your prime. We built this for you.
Specifically for small DoD subcontractors handling FCI under CMMC Level 1. Not for enterprise GRC. Not for L2 third-party certification. One product, one buyer.
You handle FCI for a DoD prime.
Most common case. Federal Contract Information is anything generated for or provided by the government under a contract that isn't public. Drawings, specifications, technical packages, performance details.
What L1 covers: 17 practices across access control, identification, media protection, physical security, system communications, and system integrity. Everything we walk you through.
You're a small firm with no compliance staff.
You're the owner, or the office manager, or the IT person who got tagged with this. You don't have a security team. You don't have $10K to spend on a consultant.
What you get: a self-serve product designed for someone who knows their business but doesn't know NIST. Plain English, pre-drafted answers based on your shop type, documentation you can use for your self-attestation.
You're the IT person who got tagged with this.
Maybe you're internal IT, maybe you're the MSP, maybe you're the one tech-literate person in the company. You can handle technical answers but need help with policy and documentation.
What you get: technical practices auto-generate sensible drafts you can adjust. Policy practices give you templates. The SSP comes out clean enough to hand to your CEO for signature.
Who this is NOT for
- Companies handling CUI (Controlled Unclassified Information). You need Level 2 and a 3PAO assessment. We can point you at one when you're ready.
- Companies looking for a managed GRC platform. Try Apptega or Hyperproof.
- Companies needing FedRAMP authorization (cloud service providers). Try Drata or RegScale.
- Companies needing on-prem hardware appliances. Try NeQter Labs.
The wedge is small DIB subs, FCI only, Level 1 only. If that's you, we built this for you. If it's not, we'll be honest about it.