Readiness across a supplier population, on each contractor’s consent.

The question this seat answers

“How do we obtain trustworthy assurance across an enormous supplier population without paying for, or forcing industry to pay for, continuous manual reassessment?”

This seat adds no assessment and no measurement work. It reads the record each contractor already keeps for its own affirmation. In a contractor that measures with Enclave AI™, the agents re-scan its connected cloud sources about every seven days, and its Level 2 package is refreshed on its subscription tier cycle. That work is paid for by the contractor’s own subscription; sharing it with your office is not a separate charge.

For each contractor that shared with your office, your view shows that recorded state as of its last measurement, with its age in days, so you can see how current it is. It is a recurring record, not a live feed. The affirmation stays with each contractor’s Affirming Official.

As of September 23, 2026: on July 13, 2026 the DoW CIO suspended the CMMC Phase 2 transition and began a 60-day review of the program, and the USW(A&S) implementing memorandum provides that, during the suspension, solicitations may designate CMMC Level 1 (Self) or Level 2 (Self) only. What still applies.

How a contractor comes onto your portfolio

1. You set up your seat. On this page, enter your office’s name and a .gov or .mil contact address, as a program office (PEO) seat or a DIBCAC seat. A confirmation link goes to that address; opening it creates the seat and sends its private dashboard link to the same address.
2. Contractors see your office by name. A Level 2 contractor that turns oversight sharing on in its own Enclave AI™ workspace sees every active program office and DIBCAC seat listed by name, yours included, and decides for each one. Your office’s name is visible to those contractors.
3. Two switches, both the contractor’s. The oversight-sharing switch in its workspace, and its decision naming your office. With either one off, you see nothing about that contractor.
4. Your office asks; each contractor decides. The seat has no roster of named suppliers. To bring suppliers onto your portfolio, your office asks them directly to share with it from their workspaces.
5. Level 1 contractors are not on it. A Level 1 workspace does not offer oversight sharing, so the portfolio covers Level 2 contractors only.

What you see

A dashboard of cards and a table, and the same data as a machine-readable status.json feed beside your dashboard link. Every total covers the consented set only: a contractor that has not shared with your office is in no total and not on the page.

• Across the consented set: how many engagements, the mean and median SPRS estimate, how many were measured within 30 days, and how many had at least one requirement regress since their previous measurement. The feed adds how many have a score and a histogram of scores (below 0, 0 to 49, 50 to 79, 80 to 109, and 110).
• Each contractor that shared with your office: its name; its estimated SPRS score; the NIST SP 800-171 revision it targets; the score change since its previous measurement; requirements met and not met; days since its last measurement; and whether a designated executive at that company adopted the posture shown (or it is not yet reviewed, disapproved, or superseded since it was reviewed). A contractor targeting Revision 3 shows projected requirement counts against it and no score against it, because no DoD scoring method exists for Revision 3; its SPRS estimate is its Revision 2 figure. CMMC Level 2 is bound to NIST SP 800-171 Rev. 2 today: 32 CFR 170.14(c)(3) states that the CMMC Level 2 security requirements are identical to the requirements in NIST SP 800-171 R2. On an account that holds several entities, the row says which entity it describes.
• In the feed, for each of those contractors: its planned and not-applicable counts; counts of what was measured from a connected source, attested by the contractor, or has no evidence; how many requirements regressed and improved since the previous measurement; when it was measured; and the state of its recurring re-scan (on schedule, overdue, ended, not yet measured, or not applicable).

SPRS figures are directional estimates under NIST SP 800-171 Revision 2, the revision with a DoD assessment methodology, produced by the agents from contractor intake and connected, read-only configuration data. They are not certified C3PAO assessments and not scores a DoD system measured.

The dashboard re-reads the recorded state every 5 minutes while it is open. That re-reads the record; it does not re-measure anything.

See a sample of the program office view, with fictional data →

What you do not see

• Any contractor that has not turned oversight sharing on and named your office, or anything about it, including whether it works with us.
• A contractor’s system data, its evidence files, or CUI. The rows carry the posture summary, not the evidence behind it.
• Which individual requirements are met or not met. The rows carry counts.
• A prime’s roster, or a share a contractor gave anyone else. A grant to a prime or to another office does not open your view.

Why the record holds up

The evidence behind each contractor’s state is recorded with SHA-256 hashes. Evidence certificates and point-in-time posture statements are sealed with SHA-256 over their own content and, when a signing key is provisioned, signed with Ed25519, so a later change is detectable. Anyone holding one can check it at /verify without taking our word for it.

Measurement reads configuration metadata through the read-only access each contractor grants in its own commercial tenants: AWS, Azure, Microsoft 365, Google Workspace, Okta and CrowdStrike Falcon. No GCC High, GovCloud or Azure Government tenant is connectable today. The platform stores, processes and transmits no CUI; see the CUI boundary.

Withdrawal and switching off

A contractor can withdraw its share with your office at any time from its workspace; your view closes on your next load. Turning its oversight sharing off withdraws every oversight share it had given, yours included, and turning it back on restores none of them: it names your office again if it wants you to see it. Every decision is kept as an append-only record, so a change of mind is a new entry and the earlier one stays readable.

If your seat is switched off, every contractor’s share with your office is withdrawn at the same time, and switching the seat back on restores none of them. The dashboard link is a bearer credential: anyone who holds it can open the dashboard, so keep it as you would a password. The dashboard can replace it with a new link at any time: the new link is emailed to the seat’s contact address, and the old link then stops working.

What this seat does not do

It does not assess, certify or affirm, and it is not a DIBCAC assessment or a C3PAO assessment. It does not verify a contractor’s award, eligibility or SPRS submission. It supports your office’s oversight of a supplier population; each contractor’s obligations stay with that contractor, and its Affirming Official makes its affirmation decision. Certification assessments are conducted by independent Cyber AB-authorized C3PAOs or DCMA DIBCAC.

One record, five seats

The agency and program office seat is one of five views of the same recorded state, in order from the contractor outward: the contractor’s own workspace, its MSP, MSSP or ESP, its C3PAO, its prime, and an authorized agency or program office. Each seat sees only what the contractor granted it. That same recorded state supports self-assessment, C3PAO assessment, delta assessment, prime oversight and government verification without recreating the compliance record for every audience.

Cost

No price is published for this seat, and any price would be published on this page before it applied. Each contractor’s own subscription pays for the agents’ work on its environment; see pricing and Level 2.