Compliance, engineered.
Federal CUI security for the companies behind the mission. We design, build, document, and operate NIST SP 800-171 environments across CMMC, federal cloud, and agency-specific requirements.
Built by practitioners who passed CMMC Level 2 inside our own environment.
The obligation doesn’t wait for the program.
CMMC changes. NIST revisions change. Agency processes change. The contractual duty to protect CUI does not. Build the security system around the obligation and each assessment becomes an assurance layer — not a new compliance project.
The obligation already applies
DFARS 252.204-7012 establishes safeguarding and incident-reporting duties. Applicable 7019/7020 provisions address assessment currency, SPRS reporting, and subcontract requirements. Confirm the incorporated NIST revision and document your assessment honestly.
One standard, two live baselines
Rev. 2's 110 controls decompose into objectives an assessor tests individually; Rev. 3 adds three families and Organization-Defined Parameters. Your contracts decide which revision binds each award — evidence is what survives either one.
Civilian agencies impose it their own way
GSA uses a CUI authorization lifecycle; NASA applies NPR 2810.7. DOE O 470.7 supersedes O 471.7 for covered activities while existing contract requirements remain until changed. Review the DOE context; your contract governs.
Someone will verify — pick your gate
Current DoD guidance retains CMMC self-assessments while the Phase II expansion is suspended. GSA authorization and other agency acceptance remain separate decisions. See the October 6, 2026 status review and confirm your actual contract terms.
- Entra IDLeast privilege, MFA, session control
- IntuneEvery device hardened to baseline
- PurviewCUI labeled, tracked, kept in bounds
- DefenderDetection across every endpoint
- WDACOnly approved code runs
- Audit & loggingEvidence as a byproduct of operations
Allyon achieved CMMC Level 2. June 2026.
The same Factory model we built inside our own assessed environment was applied to Allyon's program — from boundary definition through evidence collection and mock assessment.
"We couldn't have hit 110/110 with the same confidence without them."
We passed the assessment we prepare you for.
inDirectIT has been on the receiving end of the assessment process it helps clients prepare for. Our SSP, our POA&M, our evidence package, our GCC High tenant — assessed under CMMC Level 2 (32 CFR Part 170), with objective-level evidence for the assessed boundary. And in June 2026, Allyon ran the same production line to its own certification. CMMC proved our delivery model. NIST 800-171 and federal CUI security define the larger market we serve.
Our own certification isn't a badge on this page. It's the operating environment this site was planned in — the tenant, the controls, the evidence discipline. Living proof, renewed continuously.
The Federal CUI Security Factory: the same controls, the same evidence standard, the same runbook — every assurance lane.
Scope & Assess
Define the CUI boundary and establish the real baseline.
Architect
Design the target state across all six Microsoft security planes.
Implement & Document
Deploy and harden while the SSP is written from the live configuration.
Evidence & Sustain
Collect objective-level evidence, then hold the state under managed compliance.
Running this across a portfolio? See the portfolio model
You have three ways to buy this. Two of them are expensive twice.
Big consultancies bill you while they learn your environment, then staff delivery with the pyramid. Generic MSPs retrofit commercial tooling and call the policy binder "compliance." Both cost you again at assessment time. The third way is a fixed production line, run by the people who passed it themselves.
Practitioner-led
The people who sell the work are accountable for the work.
Fixed runbook
We don't bill you to invent the process during the engagement.
Evidence-first
The SSP and evidence are produced from the operating environment — not instead of it.
See the full comparison against big consultancies and generic MSPs
Microsoft-centric. Federal-first. Operated, not handed off.
Every architecture decision is made against NIST SP 800-171 — Rev. 2 obligations today, Rev. 3 in transition — with CMMC, GSA authorization, and agency-specific requirements as the assurance lanes on top. Six Microsoft security planes engineered as one system, in GCC High and Azure Government: Entra ID, Intune, Purview, Defender, WDAC, audit & logging.
01Entra ID
Least privilege, MFA, and session controls define who can enter the boundary and what they can do.
02Intune
Device baselines and configuration policies keep the endpoints inside the boundary consistent.
03Purview
Labels and data protection policies help keep CUI inside its approved destinations.
04Defender
Endpoint detection and response connect alerts to the people and runbooks that investigate them.
05WDAC
Application control restricts execution to approved code, reducing what can run on managed devices.
06Audit & logging
Collected logs, review routines, and retention produce evidence from daily operations.
Federal CUI & NIST 800-171
Determine what applies, define the CUI boundary, implement NIST SP 800-171, and produce the evidence that proves it — Rev. 2 today, Rev. 3 in transition, CMMC certification on top.
Explore Federal CUI & 800-171Federal Cloud & Secure Modernization
Design and operate the Microsoft security stack as one CUI system — from identity and endpoint controls through data protection and cloud infrastructure.
Explore Federal CloudManaged Compliance
Operate the environment after implementation, so assessment readiness becomes an operating condition rather than a deadline you sprint at every three years.
Explore Managed ComplianceAlso Rev. 3 Transition Compliant AI Multi-Framework Risk Advisory Azure Government CMMC Readiness
Frameworks AI Governance Supply Chain Risk Export Control EASA Part-IS GDPR ISO/IEC 27001 ISO/IEC 27002
AI that can live inside the boundary.
Design and deploy auditable AI workflows for defense contractors without creating a second security architecture around the model.
Explore Compliant AI
CUIckStartAN inDirectIT PRODUCT
Built for the future.
Ready for today.
Compliant by design · AI-ready by design
A managed CUI enclave on Microsoft 365 GCC High, built and operated by inDirectIT. Only the people who handle CUI are onboarded; the rest of the business and the corporate network stay out of the assessment scope.
Delivery durations start only once Microsoft Azure procurement is complete and your GCC High tenant is provisioned. The 60-day and 14-day clocks do not run before then.
We productized our own operating system.
The systems inDirectIT built to pass its own assessment, packaged for contractors who want enterprise-standard tooling without big-consultancy pricing. Big firms sell you hours. We sell you the machine.
Want a number before a conversation?
Both panels here are illustrative. These give you the real ones.
Calculate your SPRS score Estimate your CUI scope Browse all tools & guidesSPRS Impact — Live Demo
ILLUSTRATIVEToggling five example items. Real scoring spans all 110 controls with 1/3/5-point weights — and without an SSP, no score can be submitted at all. Run your full score at CMMC Calculator.
Compliance Maturity Simulator
ILLUSTRATIVE · SPRS-STYLE SCORINGEvery category implemented — the posture a C3PAO expects to find. This simulator groups the DoD Assessment Methodology's weighted deductions into six families for illustration; a real score spans all 110 controls. Get your real number →
Practitioners, not a delivery pyramid.
The team responsible for inDirectIT's own assessed environment is accountable for client delivery. You don't meet senior practitioners during the sale and discover a different team after signature.
RJ Williams
Rick Scott
Kyle Kiider
Analysis written by the people who build it.
The questions every defense contractor asks us.
The ones that come up before almost every engagement.
What SPRS score do I need to bid on DoD work?
Under DFARS 252.204-7019/7020, applicable solicitations require a current NIST SP 800-171 self-assessment score in SPRS as a condition of award — and primes screen subcontractors on it. There's no universal passing number, but a thin or stale score quietly loses bids. Run yours free at CMMC Calculator.
What does a CMMC Level 2 gap assessment cost?
Pricing depends on the assessed boundary, evidence readiness, and agreed deliverables. Ours is fixed-scope: CUI boundary definition, scoring against all 110 controls, your real SPRS score, and a sequenced remediation register — priced up front, no discovery-phase creep.
Do we need GCC High to handle CUI?
Not always — it depends on whether your data carries ITAR/EAR or other sovereignty requirements. Many contractors can meet 800-171 in commercial M365 with the right configuration; export-controlled CUI generally points to GCC High. We're GCC High native and run our own certified environment there, so we scope this from experience, not a sales sheet.
How long does CMMC Level 2 readiness actually take?
Readiness depends on scope, existing controls, staffing, and evidence quality. Our CMMC Factory model compresses the technical baseline into a 12–14 week build because the playbook, templates, and evidence structures already exist — you're inheriting a working pattern, not funding an experiment.
Can our MSP be part of our CMMC scope?
Yes — an external service provider that touches your CUI or security functions is in scope, and its posture becomes your problem under shared responsibility. That's why it matters that we hold CMMC Level 2 ourselves: our controls and evidence are inheritable instead of being your weakest link.
What happens if we don't have a System Security Plan?
Without an SSP there is no submittable assessment at all — the DoD methodology treats it as a gate, not a deduction. And an inflated score submitted anyway is False Claims Act exposure. Start with the readiness checklist or a strategy call and get the SSP right first.
Tell us where you are. We’ll show you the shortest path forward.
Three questions. No email required. Get the right starting point before you talk to anyone.
Not sure? Find your path in 20 seconds.
3 QUESTIONS · NO EMAIL REQUIRED1 — Do your active contracts include DFARS 252.204-7012?
2 — Have you submitted a current SPRS score?
3 — Where does your environment live today?
Or go direct Gap assessment Strategy call The free tools
Ready to talk?
Every inquiry is reviewed by a practitioner. Expect a substantive reply — scope questions, not a drip campaign. Or email rj@indirectit.com directly.