DFARS compliance evidence for defense contractors.

Start with the clauses in your contract and the systems handling covered defense information. Flow-down obligations depend on the clause and subcontract scope. 7012 addresses safeguarding and requires reporting covered cyber incidents within 72 hours of discovery. 7019 requires a current NIST SP 800-171 assessment in SPRS where applicable. 7020 addresses government assessment access and support; the Basic assessment is your own. 7021 is the CMMC contract clause, whose Phase II transition the Department suspended on July 13, 2026 while Phase I self-assessments remain.

Every one of them is a question about the same environment. The evidence that answers 7012 is the evidence behind the 7019 score, is the evidence a 7020 assessment examines, is the package a 7021 assessment would receive.

One evidence base for the NIST SP 800-171 Rev. 2 baseline, projected into every clause. Where each proof files:

A government assessor at Medium or High recomputes the same chain your Basic self-assessment and SPRS score were projected from, so the 7019 number and the 7020 assessment cannot describe two different environments.

Every record PolicyCortex writes for this obligation is content hashed with SHA3-256 and carries the digest of the record before it, so each line commits to the entire history above it. The log is append only: a correction is a new record, never an edit. Verification is a recomputation, not an assertion. Run the chain from the first record forward and it returns one of two answers: intact, or the sequence number of the first record that breaks.

A second party can do that recomputation without our help. The records, the digests, and the chain rule are everything required: no PolicyCortex account, no API of ours in the loop. When a collector was down or a scope was unobserved, the chain carries a declared gap with the interval and the reason, never silently fewer rows. Absence is declared, not inferred.

Read-only onboarding is scoped to the NIST SP 800-171 Rev. 2 baseline behind 7012. Captured evidence supplies the rows behind a 7019 score, with digests that can be recomputed.

Request access so we can review your environment, evidence needs, and onboarding scope. After access is approved, read-only onboarding uses SHADOW mode inside your own tenant. Nothing executes. Policy evaluation, evidence collection, and action gating run where your data already is; there is no telemetry pipeline to PolicyCortex servers and no egress of evidence. You hold the records and can recompute the chain yourself.

If you want the record stood up for you, the delivery engagement is 30 days at a fixed fee: $15,000 flat for the standard scope, one primary cloud environment. A cleared delivery team collects the evidence, writes the policies and assessment documents, coordinates approved technical remediation, prepares control owners, and stays through assessor review for in-scope follow-up at no additional cost. The independent assessor makes the certification decision. No certification is guaranteed.