What does PolicyCortex actually do that a CSPM doesn't?

PolicyCortex is not sold as another CSPM dashboard. Our delivery team uses it to keep technical evidence, documentary work, remediation decisions, and the assessment package connected. For cloud changes, every proposed action carries a matched capture-state and restore-state pair, and the software refuses an action when a deterministic rollback path is undefined.

Does PolicyCortex perform the documentary work?

Yes. Within the agreed scope, our team writes and updates policies, procedures, the SSP, POA&M, control narratives, evidence indexes, and assessment materials. We also prepare control owners for interviews and help answer sample and clarification requests during assessor review.

Did the Department of War cancel CMMC?

No. On July 13, 2026, the Department suspended the Phase II transition and future implementation milestones while it conducts a 60-day reform review. Phase I self-assessment requirements remain in force, and DFARS 252.204-7012 still requires contractors to safeguard covered defense information.

What does PolicyCortex validate during the pause?

PolicyCortex maps your live cloud environment against the 110 NIST SP 800-171 Rev. 2 requirements, identifies and remediates technical gaps, and assembles the evidence behind your SPRS self-assessment. The same evidence remains useful for government reviews and any future CMMC assessment model.

What clearances does the founder hold?

Leonard Esere holds an active DoD Secret clearance and a DoE Q clearance. PolicyCortex is built on 11+ years of regulated-infrastructure work across federal R&D, financial services, and aviation. 4 U.S. patent applications filed.

What does the $15K pilot include?

NIST SP 800-171 Rev. 2 baseline assessment, SPRS score review, technical and documentary gap work, policies and procedures, System Security Plan, POA&M, assessment-ready evidence bundle, CUI boundary analysis, PolicyCortex software access, interview preparation, and assessor review support for questions tied to the agreed scope. The standard engagement is $15,000 flat for one agreed primary cloud environment.

What happens when an assessor asks for more evidence?

We stay with your team through assessor review. If the assessor requests more detail, new samples, or clarification tied to the agreed pilot scope, we update the evidence package and remediation plan until the question is resolved at no additional cost. The independent assessor still makes the certification decision.

MANAGED CMMC DELIVERY // SOFTWARE-POWERED

Make your assessment a boring confirmation.

THROUGH ASSESSOR REVIEW│SUPPORT INCLUDED

We do the work. We stay through review.

Our cleared delivery team uses PolicyCortex to collect evidence, map every control, write and maintain the policies, SSP, and POA&M, coordinate approved remediation, prepare your team for interviews, and support you through assessor review.

Scope my readiness plan See exactly what we deliver

WE BUILD

The package gets done

policies, SSP, POA&M, and evidence

WE CLOSE

Gaps get worked

documentary and technical remediation

WE DEFEND

Questions get answered

support stays through review

PolicyCortex delivery engine · 12 secSignal → decision → proof

Recorded in the current production demo tenant · illustrative demo dataNo simulated feature screens

POLICY UPDATE // JUL 13, 2026

CMMC Phase II is suspended. The security baseline is not.

The Department of War paused the November Phase II transition while it runs a 60-day reform review. Phase I self-assessments remain in force, and contractors handling covered defense information still have to meet their DFARS safeguarding obligations.

What changed and what to do Official release

PHASE II: SUSPENDED; Transition and future milestones paused
PHASE I: ACTIVE; Self-assessment requirements remain
CONTRACT DUTY: DFARS 7012; Covered defense information still protected
INTERIM BASELINE: NIST REV. 2; 110 requirements · government checks continue

The PolicyCortex promise

We stay with you through the audit.

PolicyCortex performs the documentary work, builds the defensible evidence package, prepares your team, and keeps working when the reviewer asks for more.

If your assessor requests more detail, new samples, or clarification tied to the agreed engagement scope, we update the evidence package and remediation plan until the question is resolved, at no additional cost.

01 / CURRENT PROOF

Every control has an evidence story

The package connects technical state, policies, procedures, responsible people, and the evidence your assessor will examine.

02 / ASSESSOR REQUEST

More detail does not become a fire drill

Clarifications, added samples, and follow-up questions become traceable review work.

03 / SUPPORTED RESPONSE

We keep working the package

Evidence and the remediation plan are updated until the in-scope question is resolved.

Assessment decisions remain with the independent assessor. Audit support covers questions and remediation tied to the agreed engagement scope. It is not a guarantee of certification.

NIST 800-171 BASELINE

110 / 110

technical, documentary, and interview evidence mapped

PILOT GAP CLOSURE

85.5%

of evaluated drift fixed in policy-gated mode

PILOT MEDIAN

~30s

detect → safe cloud fix → evidence, end to end

THESIS // 02 · EXECUTION SAFETY

Close cloud gaps without creating the next outage.

Finding a violation is the easy part. The expensive part is changing a production cloud account without breaking mission systems or losing the evidence trail.

Every proposed action must carry a verified restoreState path before it can run. If PolicyCortex cannot prove the change can be undone, it refuses the action and records why.

Your team gets faster gap closure, a safer change process, and an evidence record a reviewer can follow without trusting a black box.

DELIVERY ENGINE PROOF // REMEDIATION LIFECYCLE

CURRENT SOFTWARE│DEMO TENANT

Current PolicyCortex remediation lifecycle showing applying, failed, verified, and awaiting-approval runs in the production demo tenant — /actions/runs · production demo tenant · illustrative dataSee safe execution

THESIS // 02 · PROOF — RUN IT YOURSELF

Don't trust the text. Run the contract.

Pick a remediation. Watch the runtime refuse the one it can't prove it can undo — and roll back the ones it can. The system is more careful than you are, on purpose.

The Rollback Contract

Reference run · Synthetic payload · Not a live connection

AC-3stprodeastus01 / telemetry·Container telemetry has public blob read enabled.

00 DRIFT
01 CAPTURE
02 PROPOSE
03 INVERSE
04 GATES
05 EXECUTE
06 EVIDENCE

00 DRIFT
01 CAPTURE
02 PROPOSE
03 INVERSE
04 GATES
05 EXECUTE
06 EVIDENCE

Contract trace

Idle. Press RUN CONTRACT to execute the Public storage scenario.

OUTCOMES // WHAT THE PILOT DELIVERS

Leave with proof, not another findings report.

Each engagement ties technical evidence, documentary work, approved changes, and accountable owners into a package a reviewer can follow.

See how our team delivers

O-01

Defend the SPRS score you submit

PolicyCortex compliance workspace showing framework posture and prioritized policy findings in the current production demo tenant

Current product · demo tenant

Tie each scored requirement to technical evidence, policies, procedures, control narratives, and accountable owners instead of relying on a spreadsheet assertion.

Close cloud gaps without unsafe changes

PolicyCortex remediation runs showing applying, failed, verified, and awaiting-approval states in the current production demo tenant

Current product · demo tenant

Our engineers coordinate approved fixes through policy gates. A technical change runs only when the proposed action has a verified restore path.

Walk into review with a package you can defend

PolicyCortex CMMC Level 2 collection showing posture, living evidence, control coverage, and package readiness in the current production demo tenant

Current product · demo tenant

Bring an updated SSP, POA&M closure records, OSCAL, and control-linked evidence, plus our support when the assessor asks for more.

Keep AI inside the governed boundary

PolicyCortex AI Control Plane showing governed model inventory, request volume, spend, and open findings in the current production demo tenant

Current product · demo tenant

Inventory models and map risk to MITRE ATLAS so AI assets do not become an untracked authorization or CUI gap.

ASSESSOR RESPONSE // BUILT FROM CURRENT STATE

When the assessor asks, the answer is already attached.

Every control sample can point back to current state, the decision that produced it, and the person or policy that approved it. Our team uses that trail to work assessor follow-ups without turning review week into a scramble.

Every sample stays tied to the live control state that supports it.
Clarifications remain linked to the original evidence and remediation record.
We work in-scope review questions at no additional cost.

See how the answer is built Inspect the review package

Current PolicyCortex Evidence and Audit workspace showing cryptographically verified activity records in the production demo tenant — /audit · production demo tenant · illustrative dataCurrent product surface

Compliance Insights

Know what changed and what to do next

A concise briefing on CMMC, NIST 800-171, and the cloud decisions defense contractors need to make now.

No spam. Unsubscribe anytime.

PROCUREMENT // 30-DAY SPRS ASSURANCE PILOTQUOTE-ID :: PC-PILOT-30D

Make the assessment a documented confirmation

FLAT FEE · ASSESSOR SUPPORT INCLUDED

SKU	Line item	Qty	Unit	Price (USD)
PC-PILOT-30D	30-day NIST SP 800-171 Rev. 2 + SPRS assurance pilot	1	engagement	$15,000.00
PC-EVIDENCE	Policies, procedures, SSP, POA&M, OSCAL, and control evidence package	1	package	INCLUDED
PC-REMEDIATE	Approved technical and documentary remediation coordination	1	month	INCLUDED
PC-REVIEW	Assessor review support for evidence questions within pilot scope	1	review cycle	INCLUDED
TOTAL (FLAT)				$15,000.00