Sovereign is the parent-organization tier: up to ten subsidiaries or CUI environments under one subscription, each with its own compliance state, established and evidenced against the same framework target. Your framework target is your choice: NIST SP 800-171 Rev. 2 (110 requirements, 320 assessment objectives; required and scored) by default, or NIST SP 800-171 Rev. 3 (97 requirements, 422 assessment objectives; emerging, no DoD score exists), selected at intake or from your workspace. CMMC Level 2 is bound to NIST SP 800-171 Rev. 2 today: 32 CFR 170.14(c)(3) states that the CMMC Level 2 security requirements are identical to the requirements in NIST SP 800-171 R2. Every 14 days Enclave AI™ delivers a CMMC readiness package for each entity, built from that entity’s intake and the read-only configuration data from its connected clouds. Once every entity has delivered its cycle, it sends one parent-level roll-up that ranks the measured entities weakest first. Per-entity SSPs and Evidence Library Indexes build out as each entity’s environment data accrues. One contract, one engine, one framework target across the portfolio.
What Sovereign adds on top of Fortress
- Up to 10 entities under one contract. Each subsidiary or CUI environment gets its own readiness package and SPRS posture estimate, measured from its own scoped intake and its own connected clouds, with its SSP and Evidence Library Index building out as its data accrues. The parent organization gets a roll-up each cycle that ranks the entities with measured scan results by estimated SPRS deduction and lists separately any entity whose report has no measured scan behind it.
- Cross-entity consistency, by construction. Every entity is measured by the same engine against the same framework target, so every entity’s readiness package uses one structure and one scoring basis, and the Multi-Entity Portfolio Roll-Up consolidates posture across every entity on the subscription, weakest first.
- Parent-level billing. One billing link for the whole subscription, held by the subscription administrator. A subsidiary’s own link never opens the parent’s billing.
- Confidentiality from minute zero. Mutual confidentiality obligations bind both parties from checkout under section 8 of the Terms and under the DPA, before any subsidiary data flows. If your legal team requires a standalone mutual NDA, send it to legal@elasticd3m.com before you connect the first entity.
- The engine runs through the weekend. The agents don’t stop on Saturday: scan cycles, drift scans and the parent roll-up run on their schedule regardless of the calendar.
- Everything in Fortress and Standard. Per entity, every 14 days. Rolled up at the parent.
Connected sources today: AWS, Azure, Microsoft 365, Google Workspace, Okta and CrowdStrike (commercial clouds). Other environments are covered from your recorded evidence and intake.
What life looks like at the parent level
The parent roll-up is emailed once every entity in scope has delivered its cycle. It is one PDF, with one row per entity. Entities with measured scan results are ranked weakest first by estimated SPRS deduction under the DoD Assessment Methodology, each with its non-compliant findings, the gaps in its latest report, the environments scanned and the date of its latest cycle. Entities whose latest report has no measured scan behind it are listed separately, with the basis of that report and the self-reported score, and are not ranked against the measured ones. Every figure comes from your own recorded data; none is written by a model. Each entity’s own readiness package and draft POA&M are delivered every cycle as well.
The first 30 days, per entity and at the parent
- Minute 0. Stripe processes your subscription. Welcome email + intake link. Mutual confidentiality under the Terms and DPA is in force from this minute.
- Day 1. Per-entity intake for each subsidiary in scope. Each entity connects the read-only cloud connectors it uses against its own AWS account, Azure tenant, Microsoft 365 tenant, Google Workspace domain, Okta org or CrowdStrike CID.
- After each intake. That entity’s first scan runs and its first readiness package is emailed within minutes: control-gap analysis against the 110-control baseline, SPRS posture, and a 30-day remediation plan. The parent-level roll-up follows once every entity in scope has delivered.
- Day 14. Second-cycle bundle per entity, with the roll-up regenerated once every entity in scope has delivered. Each entity’s workspace shows its score change since the last cycle and any controls that regressed.
- Day 28. Third-cycle bundle per entity. Sovereign refreshes every 14 days, the same cadence as Fortress, and connected sources are re-scanned about every 7 days in between.
“Why not run ten Standard subscriptions?”
You can. Ten Standard subscriptions are $24,950/month (ten times $2,495), each delivering every 30 days, with no roll-up across them: each entity’s POA&M arrives on its own, and consolidating them at the parent is your team’s job. Sovereign is $12,495 a month for up to ten entities, delivers every 14 days, and includes the parent-level roll-up.
Above 10 entities or a custom contract structure
Self-serve checkout covers up to 10 entities. A scope above 10 entities, or a custom contract structure, is not offered self-serve at this time. CMMC Level 3 is not offered.
The Big Idea, restated
A self-reported SPRS score is only as current as the environment behind it. Sovereign measures each CUI environment your parent organization owns against the same framework target, every 14 days, and consolidates the results into one parent-level roll-up, weakest entity first. Your executives decide what to affirm.
Start your subscription
$149,940 per year, or $12,495 month-to-month. The $999 CMMC Level 2 Readiness Snapshot credits in full to your first Level 2 subscription invoice if you subscribe with the same billing email within 30 days of receiving its PDF, under the Refund Policy.
Subscribe to Sovereign, $149,940/year →