One requirement, cascaded to many
For DoD subcontractors, 20–200 employees
Find your base truth
before your assessor does.
BaseTruth connects to the AWS, GitHub, and M365 you already run and shows you — with real evidence, not a spreadsheet — exactly where you stand against CMMC Level 2 and NIST 800-171.
Read-only access · No agents · 110 controls scored
Compliance postureCMMC Level 2
110 controls scored64%Overall posture+4% this month
ACAccess Control82%
AUAudit & Accountability58%
SCSystem & Comms Protection41%
IAIdentification & Auth74%
Evidence connected
AWS · GitHub · M365
The term
What's your base truth?
Your base truth is the verified state of your compliance posture — not a consultant's guess, not a six-month-old spreadsheet, but what your actual AWS, GitHub, and M365 environment shows right now, mapped to every NIST 800-171 control family. It's the one number and the one list you can defend to a prime, a C3PAO assessor, or your own team.
The part nobody tells you
Your gap list isn't proof you did compliance wrong.
CMMC Level 2 is new, the assessment ecosystem is still standing itself up, and the requirements have shifted more than once since your prime sent that flow-down letter. Every subcontractor your size got the same letter this year.
The gap isn't that you were careless. It's that nobody handed a 20-person shop the resources a prime's own compliance department has — and most of what's marketed to you is sized for companies ten times your headcount.
You don't need a compliance department. You need your actual gaps, mapped to what a C3PAO will actually ask for, without paying enterprise-GRC prices to get them.
You got the letter. This isn't because you did compliance wrong — CMMC is new, requirements keep shifting, and every subcontractor your size is scrambling right now. That gap between what you assume and your base truth isn't a failure. It's just how fast this moves.
Where your base truth gets checked
Three places your compliance posture gets judged before a human ever opens your file.
The flow-down checklist
Your prime's contracts team checks a box on whether you can self-attest, and increasingly, whether you've started a real assessment. No checklist, no subcontract.
The pre-assessment scan
C3PAOs are starting to run automated evidence checks before the formal assessment even begins. What your AWS, GitHub, and M365 environments actually show matters before a person looks at anything.
What a security researcher finds
Public-facing gaps — exposed repos, stale IAM policies, unpatched systems — get found whether or not you were ready to be looked at.
The only one of these you fully control is what your evidence actually shows. That's what a gap scan gives you before anyone else looks.
The good news
Not an enterprise GRC seat you'll never fully use.
Just your base truth — mapped, current, and ready when someone asks.
How you get your base truth
What we actually do, in the order we do it.
Baseline gap scan
We pull your evidence from AWS, GitHub, and M365 and run it against the NIST 800-171 control set — the same public framework a C3PAO assessor uses, not a proprietary scoring system. You get your actual gap list, not a sales call.
Map to OSA
Every gap gets mapped to the Open Security Architecture Security Capability Model, so you can see which capability domain it falls under, not just a bare control number.
Score & prioritize
One consistent, data-driven scoring pass across every control — not selective spot-checks — so nothing gets missed and nothing gets inflated.
Generate your POA&M
Every unmet control becomes a real Plan of Action & Milestones entry, ready for your prime or your assessor, not a generic template you fill in yourself.
The mechanism
Raw cloud config in. Defensible assessment package out.
Every stage turns scattered account settings into a control-by-control record you can hand an assessor without flinching.
Evidence connectors
Link AWS, GitHub, and Microsoft 365 once. Configuration and activity are pulled read-only on a schedule — nothing installed on your endpoints.
AWSIAM · CloudTrail · Config
GitHubBranch rules · secrets
M365MFA · DLP · audit log
One evidence schema
Every source is flattened into the same evidence shape, so an MFA setting in M365 and an IAM policy in AWS answer the same control question.
All 110 controls, rated
Each control resolves to met, partial, or failed, with the evidence that produced the verdict attached.
64%+4% MoM
Coverage by family
AC
AU
SC
IA
CM
IR
CMMC ↔ NIST 800-171
One piece of evidence satisfies its CMMC practice and the NIST 800-171 requirement behind it — mapped once, never re-gathered.
CMMC AC.L2-3.1.5800-171 3.1.5
CMMC AU.L2-3.3.5800-171 3.3.5
Immutable audit trail
Every score change is append-only and timestamped with the evidence hash behind it, so you can prove when a control was met — not just that it is.
2026-01-14 09:12 · AC.L2-3.1.5 → Metsha256:4f1c…a09e
POA&M export
Open gaps become Plan of Action & Milestones entries with owners, remediation steps, and target dates — formatted the way assessors expect.
POAM_2026Q1.xlsx
SSP_appendix.docx
evidence_bundle.zip
Pricing
Priced below one day of consultant time
No per-control fees, no per-seat surprises. Cancel whenever your assessment is behind you.
Assess
For a single entity getting its first honest score.
$490/ month
- All 110 NIST 800-171 controls scored
- 1 connector (AWS, GitHub, or M365)
- Monthly evidence refresh
- Gap list with plain-English reasons
Most common
Operate
For contractors actively closing gaps before an assessment.
$1,290/ month
- Everything in Assess
- All three connectors, continuous sync
- POA&M generation and export
- Evidence bundle for your assessor
- Posture history and trend tracking
Enclave
For primes and MSPs managing multiple subcontractor environments.
Custom
- Everything in Operate
- Multi-org rollup dashboard
- SSO and role-based access
- Custom control mappings
- Named compliance advisor
FAQ
Questions we get before every assessment
Still unsure whether this fits your contract requirements? Reach out and we'll tell you plainly if it does not.
Stop guessing. Get your base truth.
Connect your AWS, GitHub, or M365 environment and get a real baseline — the same control set a C3PAO will use, not a sales pitch.