“40 controls pass” becomes “40 of 110, and here are the 23 nobody can assess at all.”
Most tools stop at the first half of that sentence. The engine joins two things: the checks that can actually be evaluated against a Microsoft tenant, and each framework's full control catalog. The difference between them is the part of your program no automation can see, and it stays on your assessment and POA&M as human-verified requirements instead of quietly disappearing from the score.
How much of each framework automation can reach
| Framework | Controls | Reachable by automated checks |
|---|---|---|
| CMMC 2.0 Level 2 | 110 | 87 (79.1%) |
| NIST SP 800-171 Rev. 2 | 110 | 85 (77.3%) |
| NIST SP 800-53 Rev. 5 | 970 | 186 (19.2%) |
From the engine's current mapping pack. FedRAMP baselines are mapped and their labels are being validated; the NIST SP 800-171 Rev. 3 catalog is in progress.
The rules it will not break
- Coverage beside every score. Score is computed only over controls that were actually assessed, so it is never shown alone. 100% of 12% of a catalog is not a compliant system.
- No evidence, no pass. A control that no check reaches is “not assessed,” never a quiet pass.
- History, not a snapshot. Every run is kept and never overwritten, so a control that regressed shows up as a regression instead of a changed number.
- POA&M derived, not authored. Every unmet control becomes an item with its weakness, priority, and effort estimate, because a POA&M with a forgotten row has a gap in it.
- SPRS the DoD way. The summary score follows the Assessment Methodology exactly: 110 less the weighted subtractor for each unmet requirement, the SSP as a prerequisite, partial credit only where the methodology allows it.
Pre-release, and we say so. The engine runs against synthetic tenants while it is hardened; client tenants are connected once onboarding opens, and results then appear in your client portal. Its SPRS figure is a working number: the score you submit still comes from a documented assessment and the organizational review DFARS 252.204-7019 requires.
Built on public datasets: community-maintained check-to-control mappings (CheckID) and Microsoft's Azure Policy regulatory-compliance catalogs, joined and pinned by version.
Questions we get about it
Is this live monitoring of our tenant today?
Not yet. The engine is in pre-release and runs against synthetic tenants while it is hardened. Client tenants are connected once onboarding opens; until then, our managed-compliance team validates controls on a schedule.
Why not just show one compliance percentage?
Because a percentage computed over only the controls a tool can see overstates your position. We always show coverage beside the score so you can see how much of the framework the number actually describes.
Can the SPRS number from monitoring go straight into SPRS?
No. It is a working figure that shows direction. The score you submit comes from a documented assessment and the organizational review DFARS 252.204-7019 requires.
Be first when onboarding opens.
Tell us your cloud (commercial, GCC, or GCC High) and which frameworks you answer to, and we will bring you in as tenants are connected. Or email rj@indirectit.com directly.