You decide
- Whether the evidence meets your obligations
- Which open gaps to close first
- When you're ready for assessment (your assessor decides certification)
For defense contractors with a CMMC requirement
Compliance: CMMCRegulated
Evidence for the CMMC assessment your contract requires.
CMMC is how the Department of Defense verifies that contractors protect the information in their contracts. Whatever form it takes, the controls underneath are NIST SP 800-171, so Compliance: CMMC builds on that evidence and keeps your company ready for assessment. s90 doesn't certify you. Where a contract calls for an outside assessment, an authorized assessor does.
At a glance
- Package
- Compliance: CMMC
- Evidence
- Compliance Posture Report, quarterly
- Stacks on
- Complete IT: Managed or Co-Managed
Does this apply to you?
It likely applies if your company's contract includes:
- A Department of Defense contract or solicitation that calls for CMMC
- A CMMC requirement flowed down from a prime contractor
- Work that involves federal contract information or controlled unclassified information
What the rule asks for, and what you receive.
- 01
Meet the requirements your contract calls for
The controls your contract requires, kept running
Evidence organized the way assessors review it
- 02
Document how you meet them
Support for your System Security Plan
Plan records
- 03
Pass the required assessment
Assessment readiness, and coordination with your assessor
Assessment readiness evidence
- 04
Affirm that you still meet them when your contract requires it
Evidence for each affirmation you make
Support for your affirmations
We provide the evidence. You decide.
s90 does
- Runs the controls the framework calls for
- Keeps the documentation current and prepares you for assessment
- Delivers a Compliance Posture Report every quarter
The Compliance Posture Report
Scoped to CMMC, delivered every quarter without asking. The proof in your hands is never more than three months old.
Sample · Compliance Posture Report
ACME Corp · Quarter 3 · CMMC
- Evidence organized the way assessors review it
- Current
- Plan records
- Current
- Assessment readiness evidence
- Current
Sample report for a fictional business. Example figures.
Other frameworks you may answer to.
Bundle discounts available.
One question to ask yourself
If your assessment were next month, could your company show the evidence?
Up to$500,000Cyber WarrantyBacked by Cork Inc.In 30 minutes, we talk through your setup and you leave knowing which plan fits.
Book a callSee exactly what you'd receive each quarter, by email.
Get the sample Posture Report by email