--- title: "SPRS Score Evidence for NIST 800-171" description: "Evidence behind the SPRS score you affirm: 110 NIST 800-171 requirements as hash-chained records in your tenant. Optional 30-day fixed-fee engagement." url: https://policycortex.com/solutions/sprs-score sealed: 2026-09-02 amended: 2026-11-10 register: solutions/sprs-score records: 6 digest: sha3:6c4a85d33a8cc72f0f81aec0b6f5db42afc203834c2b50b5cf52bbf0c58c9393 --- # The evidence behind the SPRS score you affirm. DFARS 252.204-7012 / 7019 / 7020 / NIST SP 800-171 Rev. 2 CMMC Phase II is suspended, but Phase I self-assessments and DFARS 252.204-7012 safeguards remain, and the SPRS score you affirm is a claim about your environment. PolicyCortex records that environment against the 110 NIST 800-171 Rev. 2 requirements, hash chained inside your tenant, so the score rests on rows an assessor can recompute. A fixed-fee 30-day engagement is optional. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) A person replies within one business day. Scope and onboarding are agreed with your team. ## What the score commits you to prove Every organization handling covered defense information affirms a SPRS score under DFARS 252.204-7019, safeguards CUI under 7012, and can be assessed by the government under 7020. The Department suspended the CMMC Phase II transition on July 13, 2026 pending a reform review, has announced no replacement date, and named NIST SP 800-171 Rev. 2 as the interim baseline; Phase I self-assessments remain in place. None of that pauses the obligation behind the score: for each of the 110 requirements, the state that satisfies it, the record of what changed it, and proof the package is the one that was assessed. A score is a projection. If the rows behind it cannot be produced as of the date you affirmed it, the score is a memory. - **sprs.baseline**: NIST SP 800-171 Rev. 2, 110 requirements, 14 families. The interim CMMC baseline named by the Department. - **sprs.policy**: CMMC Phase II suspended 2026-07-13; Phase I self-assessments and DFARS 7012 safeguards remain active. - **sprs.boundary**: The CUI enclave is a declared scope on every record. Azure Government, AWS GovCloud (US), and GCC High are supported clouds; commercial cloud where CUI is out of scope. - **sprs.assessor**: Your C3PAO remains independent and controls the assessment package and eMASS submission. The output is C3PAO-agnostic. - **sprs.source**: Department of War release, July 13, 2026 (official release); the site's explainer: what changed and what to do. - **sprs.handoff**: The eMASS and C3PAO handoff package: what the assessor receives and how they verify it by hash. ## The evidence behind the score One evidence base for the 110 requirements, handed to the assessor as generated evidence with the raw payload attached. Where each proof files: - **AC · IA · SC**: Proof of state: access control, identification, and system protection settings as point-in-time records, content hashed, regenerable to the date the assessor names. - **CM · AU**: Proof of change: who or what altered a CUI-scope resource, under what authority, with before and after hashes and a rollback identifier. - **Machine actions**: Proof of agency: what any autonomous action was permitted to do before it ran, what it did, and what would have stopped it. Every action type it executes registers a restore that reads the resource back, or the reason no restore exists: 41 of 49 restore. - **SSP · POA&M · OSCAL**: Generated from the one implementation record and exported as OSCAL 1.1.2 with an eMASS and C3PAO handoff package. - **SPRS**: SPRS-relevant evidence carried per requirement, so the score you affirm is a projection of rows, not a spreadsheet estimate. ![The PolicyCortex evidence package export: complete evidence inventory, validation results, POA&M, SSP, and SAR in ZIP, OSCAL, and eMASS shapes](https://policycortex.com/images/pcx-evidence-package-export-1600.webp) Exhibit SB-5 · the assessor-ready package: inventory, validations, POA&M, SSP, SAR in ZIP and OSCAL shapes, with the eMASS POA&M worksheet. Illustrative demo data; the interface is real. ## How an assessor verifies the score For a SPRS score the recomputation proves the number is a projection: an assessor recomputes the rows behind each of the 110 requirements as of the date you affirmed it, and a score with no rows behind it cannot be recomputed at all. Every exported package carries the records PolicyCortex writes for this obligation in a SHA3-256 hash-chained stream, with declared gaps for any unobserved interval, so any second party can recompute it offline without our API. **Stated limit.** PolicyCortex is not an assessor and does not certify anything. It produces the records a compliance decision rests on; the assessor, the authorizing official, or the accountable official makes the determination. What is not connected is not observed, and the record says so. Control identifiers cite NIST SP 800-53 Rev 5, NIST SP 800-171 Rev 2, PCI DSS 4.0, SOC 2 TSC, ISO/IEC 27001:2022 and 45 CFR 164 as published. ## Access and scope before affirming a score We review your CUI boundary, evidence needs, and onboarding scope for Azure Government, AWS GovCloud, or GCC High before product access is granted. The CUI enclave is declared on every record collected within the agreed scope. - **eval.mode**: SHADOW. Watch only; nothing executes. - **eval.onboarding**: A person replies within one business day. Scope and onboarding are agreed with your team. - **eval.location**: The hosted service, or a customer-operated installation delivered with our engineers. Azure, AWS, and GCP are observed clouds; AWS GovCloud (US), Azure Government, and GCC High are supported. - **eval.egress**: In a customer-operated installation: none, with no telemetry to PolicyCortex. On the hosted service, evidence is stored in PolicyCortex's Azure tenant, in the United States. - **eval.after**: You keep the records. Licensing is annual and the tenant owns the evidence; a delivery engagement is optional. - **eval.assessment**: Start with the public CMMC Level 2 readiness assessment: ten questions in your browser, with no account or cloud connection required. ## The offer: a defensible SPRS baseline in 30 days, fixed fee If you want the baseline stood up for you, the engagement is 30 days at a fixed fee: connect one primary cloud environment (Azure Government, AWS GovCloud, or GCC High), validate the 110-requirement Rev. 2 baseline, coordinate approved technical remediation of cloud gaps, and walk away with the evidence behind your SPRS score as an SSP, POA&M, and OSCAL bundle your C3PAO can review, select from, and use for eMASS submission. The cleared founder runs the engagement. No hourly, no overages. The independent assessor makes the certification decision. The engagement does not guarantee certification; it produces a package built to be verified. - **offer.price**: Fixed fee, agreed with the scope before work begins. No hourly, no overages, no surprises. - **offer.duration**: 30 days from cloud connection to the evidence package. - **offer.scope**: One primary cloud environment: Azure Government, AWS GovCloud, or GCC High. Multi-cloud or multi-tenant scope is priced separately. - **offer.package**: SSP, POA&M, OSCAL 1.1.2 bundle, and the hashed evidence behind them, organized by control objective. - **offer.review**: Support through assessor review for in-scope follow-up, at no additional cost. - **offer.limit**: No certification guarantee. Your C3PAO remains independent. - **offer.people**: Founder runs every engagement personally. DoD Secret and DoE Q clearances, both active. Patent pending. [Every term of the engagement, on its own page.](https://policycortex.com/engagement) ## Questions assessors and buyers ask **Q: Did the Department of War cancel CMMC?** A: No. It suspended the Phase II transition and future implementation milestones on July 13, 2026, pending a reform review, and has announced no replacement date. Phase I self-assessment requirements remain in place. **Q: Is GovCloud required for CMMC Level 2?** A: Not strictly. Azure Government, AWS GovCloud (US), and GCC High are supported clouds, and commercial cloud is supported when CUI is out of scope. The boundary is declared on every record either way. **Q: How long until we are assessment ready?** A: The engagement is 30 days from cloud connection to the evidence package, at a fixed fee, no hourly, no overages. Assessment readiness is the assessor's judgment; the package is built so that judgment rests on rows they can recompute. **Q: What if a remediation breaks production?** A: Every action type registers either a restore that reads the resource back or the reason no restore exists: 41 of the 49 action types executed directly in Azure and AWS restore the captured pre-change value, and the other 8 say why they cannot. A hashed-delta mismatch after execution triggers rollback where the action type has a restore and rollback is enabled for the action; otherwise the action goes to manual review. The rollback is itself a row in proof of change. **Q: Can we stay in advisory mode?** A: Yes. SHADOW mode watches and executes nothing; read-only onboarding uses it after access is approved and scope is agreed. GATED is the default for approved actions: a named human approves each action and becomes part of its record. AUTONOMOUS is reserved for narrow, well-tested action classes, with every gate still run on every act. **Q: Does PolicyCortex make us compliant?** A: No. It produces the records compliance decisions rest on. The authorizing official, the C3PAO, or the accountable official makes the determination; PolicyCortex hands them evidence they can recompute instead of a narrative they have to believe. ## Related solutions - [CMMC Level 2](https://policycortex.com/solutions/cmmc-compliance) - [Federal R&D](https://policycortex.com/solutions/federal-rd) - [ITAR compliance](https://policycortex.com/solutions/itar-compliance) - [AWS](https://policycortex.com/solutions/aws) Affirm a score you can hand over as rows. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book) ## Register colophon | Seq | Label | SHA3-256 | Prev | |---|---|---|---| | REC 0000 | OBLIGATION | 9bc7a27a06d6 | bc622c3f89d4 | | REC 0001 | EVIDENCE | 574d620ce5af | 9bc7a27a06d6 | | REC 0002 | VERIFICATION | 287ed97c1fa5 | 574d620ce5af | | REC 0003 | EVALUATION | 800ca653b441 | 287ed97c1fa5 | | REC 0004 | DELIVERY | 079ae3f590f6 | 800ca653b441 | | REC 0005 | QUESTIONS | 6c4a85d33a8c | 079ae3f590f6 | Head sha3:6c4a85d33a8cc72f0f81aec0b6f5db42afc203834c2b50b5cf52bbf0c58c9393. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.