What you see
- Posture: your SPRS score and its trend, coverage across the 14 control families, and every control with its status. Scores change only when a practitioner publishes a completed assessment, never from a stray edit.
- POA&M: open items by severity with due dates and overdue flags, generated from assessment findings rather than retyped.
- Evidence: an inventory of artifacts with control mapping, SHA-256 fingerprint, and staleness, each one a pointer into your own GCC High environment.
- Baseline: your level on each of the Brilliant at the Basics 20, with the next rung to reach.
- Calendar and to-dos: assessment dates, evidence refreshes, and reviews, plus the action items assigned to your people.
- Documents and policies: your SSP, POA&M exports, reports, and letters, and your adopted Master Library release once it is approved.
- Planned integrations: billing synchronization, native support tickets, and project tracking remain unavailable until their integrations are ready. Contact your delivery team through your existing support channel.
What our team does on the other side
Practitioners run objective-level assessments against all 320 NIST SP 800-171A objectives, scoped to the whole enterprise, a family, or a single control. The SPRS engine applies the DoD Assessment Methodology scoring rules, including the SSP prerequisite and the two partial-credit requirements. Findings become POA&M items in one step, reports render from live data, and nothing reaches your dashboard until a complete assessment is published.
Zero CUI, by design. The portal stores metadata and pointers only. Your evidence files stay in your GCC High boundary; the portal records where they are and a fingerprint of what they were. Organization access is enforced by server-side authorization. Signed sessions expire after eight hours and are checked against revocable session records. Commercial Microsoft 365 and GCC High sign-in require separate tenant configuration and acceptance before client access opens.
| Status | Detail |
|---|---|
| Client access in preparation | The portal and CUIckStart enclave record views are implemented. Production access opens after Entra tenant configuration and a secure client pilot. Enclave records are maintained by the delivery team; live tenant telemetry, provider synchronization, native tickets, and work tracking remain unavailable. |
Questions we get about it
Does the portal store our CUI?
No. It holds metadata and pointers only. Evidence files stay in your GCC High environment; the portal records where each artifact lives, what control it supports, when it was collected, and its SHA-256 fingerprint.
Can we change our own SPRS score in the portal?
No, and neither can a single edit on our side. The published score changes only when a practitioner publishes a completed assessment covering all 110 controls with the SSP in place, which is how the DoD methodology treats it.
How do our people sign in?
The portal supports separately configured commercial Microsoft 365 and GCC High work identities. Client access opens after your tenant is configured and accepted, with MFA and conditional access governed by that tenant. Public demo sign-in is disabled.
Watch your own program in it.
We walk prospective clients through the portal with their scope in mind, not a canned demo tenant. Or email rj@indirectit.com directly.