Rev. 2 live. Rev. 3 mapped. Not at audit time.
The July 2026 CMMC interim baseline is NIST SP 800-171 Rev. 2: 110 requirements across 14 families. PolicyCortex validates that baseline continuously, captures evidence, remediates drift, and maintains a Rev. 3 crosswalk so current obligations and transition planning stay distinct.
- CAP-01Rev. 2 baseline coveredAll 110 requirements across the 14-family CMMC interim baseline.
- CAP-02Rev. 3 deltas trackedRev. 2 → Rev. 3 mappings kept explicit; evidence is not relabeled.
- CAP-03Auto-SSP narrativesGenerated from live state. Always current, never stale.
- CAP-04CUI scope respectedControls only enforced where CUI lives.
- CAP-05Auto-remediationDrift fixed with rollback-safe actions. Type-checked.
- CAP-06POA&M liveFindings open → closed with closure evidence.
- 01ScopeCUI boundary defined. Resources mapped to control families.
- 02BaselineAll 110 controls validated. SSP narratives auto-drafted.
- 03MaintainContinuous validation. POA&M updates as findings cycle.
- DOE National LabActive consultant
- MITRECybersecurity engineering
- USAAFinancial-grade ops
- FrontierProduction cloud architecture
Founder runs every engagement personally. 4 U.S. patent applications filed.
Rev 2 vs Rev 3?
NIST published Rev. 3 in May 2024 and reorganized the requirement structure. The Department's July 2026 CMMC suspension release names Rev. 2 as the interim enforcement baseline. PolicyCortex tracks both without presenting Rev. 3 as the 110-requirement CMMC baseline.
Connection to CMMC?
During the reform review, the Department says it will enforce NIST SP 800-171 Rev. 2 through self-assessments and selected government-led assessments. The same live-state evidence can be cross-walked for Rev. 3 transition planning.
Self-assessment vs C3PAO?
Both supported. Self-attestation uses the same evidence; C3PAO assessment uses the OSCAL bundle and auditor ZIP.
What about NIST 800-172?
Enhanced security requirements for high-value assets. Mapped as an L3-overlay on top of the 110 baseline controls.
Run the baseline as a runtime. Not a spreadsheet.
$15,000 flat for the 30-day pilot. All 110 Rev. 2 requirements baselined and continuously validated, with a separate Rev. 3 transition crosswalk.