You decide
- Whether the evidence meets your obligations
- Which open gaps to close first
- Whether your company is compliant
For defense contractors that handle controlled unclassified information
If your company handles controlled unclassified information on a Department of Defense contract, DFARS requires the security controls in NIST SP 800-171 and a self-assessment score on file. Compliance: NIST SP 800-171 gives you quarterly evidence for each requirement, so your score reflects what's actually in place.

It likely applies if your company is one of these:
Meet every security requirement in NIST SP 800-171
The controls behind each requirement, kept running
Evidence for each requirement that applies to you
Document how you meet them in a System Security Plan
Support for your System Security Plan and plan of action
Plan updates and records
Submit a self-assessment score to the Department of Defense
The evidence behind each scored requirement
Evidence behind the score you submit
Scoped to NIST SP 800-171, delivered every quarter without asking. The proof in your hands is never more than three months old.
Sample · Compliance Posture Report
ACME Corp · Quarter 3 · NIST SP 800-171
Sample report for a fictional business. Example figures.
Bundle discounts available.

One question to ask yourself
In 30 minutes, we talk through your setup and you leave knowing which plan fits.
Book a callSee exactly what you'd receive each quarter, by email.
Get the sample Posture Report by email