Your CUI stays inside a purpose-built enclave, and the enclave carries the proof. Start with a repository, or collapse your whole assessment into an enclave.
Phase 1 is underway: self-assessments in new DoD solicitations, affirmed annually in SPRS. Getting assessment-ready typically takes 6 to 12 months. Starting your pre-assessment now is on time, not early.
Level 1 and 2 self-assessments required in new DoD solicitations, affirmed annually in SPRS.
Most contracts involving CUI require third-party Level 2 certification.
Rollout currently suspendedCertification requirements extend to option exercises on existing contracts.
CMMC requirements in all applicable solicitations and contracts.
The Phase 2 timeline is suspended as of July 2026. The direction is not. The contractors who keep moving own the queue when it restarts.
CMMC applies to the unclassified networks of an estimated 300,000+ organizations that process, store, or transmit Federal Contract Information or CUI. Which level you owe depends on what you handle.
15 basic safeguarding requirements from FAR 52.204-21, met through an annual self-assessment affirmed by a senior official in SPRS.
The 110 practices of NIST SP 800-171. Most contracts involving CUI point here, with third-party assessment by a C3PAO on the horizon for many.
Level 2 plus selected enhanced requirements from NIST SP 800-172, assessed by the government rather than a C3PAO.
The catch people miss: even with no CUI anywhere on your network, handling FCI alone still obligates an annual Level 1 self-assessment with a senior official's affirmation filed in SPRS. Almost nobody in the defense supply chain is fully outside this program.
110 practices, assessed against 320 objectives. One score. Proof, not promises. And all of it applies only to systems inside your assessment scope, which is why everything on this page starts with scope.
Security controls across 14 families, decomposed into 320 assessment objectives, implemented, not just written down.
A self-assessment score and an annual affirmation posted to the DoD's SPRS.
A System Security Plan for scoped systems, with open gaps tracked and closed.
A certified third party assesses the systems that touch CUI every three years. Currently paused by the Department of War.
The GCC High re-platform with virtual desktops and an MSP contract, a stack of point tools stitched together, or one enclave. We put them side by side so you don't have to.
The enclave holds the data and the applications. Devices get a live session: frames down, keystrokes up, and nothing else. Watch what happens when a file tries to leave.
Scope diagrams obsess over file shares and ERP systems, then wave email through as "just communication." That assumption is where assessments quietly fall apart. The instant CUI reaches a mailbox, the inbox, the platform behind it, and every account that sends or receives the data are in scope.
Encrypted email does not escape this. It relocates it. Encryption is a confidentiality control, not a scope-reduction mechanism. A mailbox that holds CUI still stores and transmits CUI, and in the sync model, so does every endpoint the tool touches.
The only way to keep email out of scope is to keep CUI out of email. In the CCE model, CUI lives in the enclave and never lands in a mailbox. The lockdown that keeps it there isn't a project you assemble and defend. It's the engineered default, running on the right.
Nothing lands on the device. Everything lands in the audit trail.
A secure virtual workspace where users, applications, and CUI operate together inside a single compliant boundary. Work on Office documents, CAD files, and databases in the cloud, with your endpoints documented Out-of-Scope.
Explore CCE →A purpose-built CUI repository: end-to-end encryption, MFA, secure viewer with watermarking, and tamper-proof audit trails. Supports DFARS 7019 reporting and improves your SPRS score.
Explore SDR →308 of 320 NIST SP 800-171A assessment objectives are addressed by the RegDOX solution. 100% when you implement based on our documentation library, ready for your SSP on day one.
The enclave and Secure Data Room provision within 3 business days of signature, live training included. Most teams are uploading and working within 1 to 2 weeks.
CUI never touches your corporate network or devices, so endpoints are documented Out-of-Scope under 32 CFR §170.19 and your boundary collapses to the enclave.
Encrypted storage, MFA, immutable audit logging, watermarked viewing, and downloads, clipboard, and printing blocked by engineered default.
A Registered Practitioner, proven templates, and SSP support at whatever depth you want, from a sanity check to an end-to-end partnership.
Dozens of defense industrial contractors rely on RegDOX. The enclave approach has carried them through formal CMMC Level 2 assessments, with the boundary independently confirmed.
Grounded in regulation, confirmed by third parties, and proven in the field. Here is ours. Ask your other candidates for the same.
No vendor can sell you certification. What the platform does is collapse your assessment boundary and carry a large share of the control burden, while our Audit & Assessment team supports your SSP and drives you toward a passing assessment.
When CUI never reaches the endpoint, the endpoint can be documented Out-of-Scope under 32 CFR §170.19. That is the engineered default of the enclave model.
They stay out of your CUI assessment scope.
The enclave provisions on your timeline rather than an infrastructure projects. The pacing item is usually your documentation and process work, which is what our team helps carry.
Bring your contract clauses and your current scope diagram. We will show you exactly what falls away in the enclave model.
(800) 517-3171 · Nashua, NH · U.S. data centers & personnel