CMMC readiness support with version-aware mappings — not an assessment.
Organizations in the defense supply chain are expected to implement NIST SP 800-171 practices and, depending on level, demonstrate them to an assessor. AssurIQ helps you get and stay ready: universal controls mapped to the practice families, evidence organized around what assessors look for, and continuous verification between assessments.
- Evidence gaps reduced 14 → 6; backup restore proof still open
- Privileged MFA moved PARTIAL → PASS and held for 61 days
- 1 approved exception expires in 41 days
- Collector coverage 97% of known subnets
The requirement areas, in plain language.
Original AssurIQ summaries — not reproductions of the standard. Use the primary source for the authoritative text.
Limit system access to authorized users and processes; identify and authenticate them; control privileged and remote access.
Create, protect and review audit records sufficient to trace actions to individuals.
Baseline configurations, change control, least functionality and software restriction.
Boundary protection, segmentation, encryption in transit and at rest, and secure architecture.
Periodic risk assessments, vulnerability scanning and remediation, and assessment of control effectiveness.
Incident handling capability; media protection; physical access controls; controlled maintenance.
Universal controls that carry evidence into each requirement area.
Illustrative, high-level mapping. Inside the product every mapping is versioned and every control shows its live state, confidence and evidence.
| Requirement area | AssurIQ universal controls | Typical evidence | Example state |
|---|---|---|---|
| Access control & identification | AIQ-IAM-001 unique identitiesAIQ-IAM-002 privileged MFAAIQ-IAM-005 remote access controls | Identity connector, AD posture, VPN/config reads | Partial |
| Audit & accountability | AIQ-LOG-001 central loggingAIQ-LOG-002 log protectionAIQ-LOG-003 review cadence | Log platform connector, review records | Partial |
| Configuration management | AIQ-CFG-001 config baselinesAIQ-CFG-002 change detectionAIQ-SW-002 software inventory | Config backups and diffs, collector inventory | Pass |
| System & communications protection | AIQ-NET-003 segmentationAIQ-NET-011 no KEV on exposed servicesAIQ-CRY-003 TLS | Topology snapshots, scans, external surface | Fail |
| Risk & security assessment | AIQ-VUL-001 scan cadenceAIQ-VUL-002 remediation SLAsAIQ-GOV-002 risk assessment | Finding history, remediation validation, register | Partial |
| Incident response | AIQ-IRP-001 plan reviewedAIQ-IRP-002 exercise | Policy artifact, exercise record | Evidence Gap |
| Media & physical protection | AIQ-CRY-001 disk encryptionAIQ-PHY-001 facility access records | Endpoint connector, manual attestation | Exception |
Example states are illustrative. An Evidence Gap means proof has not been collected yet — it is not a failed control.
What stays verified between assessments.
- Configuration baselines and diffs tracked by the collector
- Segmentation and boundary controls updated from topology snapshots
- Vulnerability cadence and remediation SLAs measured from finding history
- Privileged MFA and identity hygiene re-read from the identity provider
- Evidence organized per control with provenance and integrity hashes
- Point-in-time readiness snapshots for self-assessment and assessor preparation
What AssurIQ does not do.
- AssurIQ is not a C3PAO or assessor and does not issue CMMC certifications or scores of record.
- AssurIQ does not determine your required CMMC level or the scope of your CUI environment — your contract and advisors do.
- AssurIQ does not reproduce NIST or CMMC text; mappings are original high-level summaries.
- Some practices require organizational evidence (policies, training, physical controls) that AssurIQ records but cannot observe technically.
Common questions
Can AssurIQ produce our SPRS self-assessment score?+
How do version changes affect us?+
Do MSPs use this for defense-contractor clients?+
AssurIQ supports CMMC and NIST SP 800-171 readiness with version-aware mappings, evidence and continuous verification. AssurIQ is not an assessor, does not certify, and does not determine your required level or scope. Summaries are original AssurIQ wording.
Manage the endpoint. Understand the infrastructure. Prove the controls.
Explore the connected platform, or talk with the AssurIQ team about a controlled Windows RMM pilot. No production data is required to explore the fictional sandbox.