What you see
- Posture shows your SPRS score and its trend, coverage across the 14 control families, and every control with its status. Scores change only when a practitioner publishes a completed assessment, so a stray edit cannot move them.
- POA&M lists open items by severity with due dates and overdue flags. Items are generated from assessment findings, so nobody retypes them.
- Evidence is an inventory of artifacts with control mapping, SHA-256 fingerprint, and staleness. Each entry points into your own GCC High environment.
- Baseline shows your level on each of the Brilliant at the Basics 20 and the next rung to reach.
- Calendar and to-dos hold assessment dates, evidence refreshes, and reviews, along with the action items assigned to your people.
- Documents and policies holds your SSP, POA&M exports, reports, and letters, plus your adopted Master Library release once it is approved.
- Planned integrations for billing synchronization, native support tickets, and project tracking are not available yet. Until they are, contact your delivery team through your existing support channel.
What our team does on the other side
Practitioners run objective-level assessments against all 320 NIST SP 800-171A objectives, scoped to the whole enterprise, a family, or a single control. The SPRS engine applies the DoD Assessment Methodology scoring rules, including the SSP prerequisite and the two partial-credit requirements. Findings become POA&M items in one step, reports render from live data, and nothing reaches your dashboard until a complete assessment is published.
The portal holds no CUI. It stores metadata and pointers only. Your evidence files stay in your GCC High boundary, and the portal records where they are and a fingerprint of what they were. Server-side authorization enforces organization access. Signed sessions expire after eight hours and are checked against revocable session records. Commercial Microsoft 365 and GCC High sign-in each require separate tenant configuration and acceptance before client access opens.
| Status | Detail |
|---|---|
| Client access in preparation | The portal and CUIckStart enclave record views are implemented. Production access opens after Entra tenant configuration and a secure client pilot. Enclave records are maintained by the delivery team; live tenant telemetry, provider synchronization, native tickets, and work tracking remain unavailable. |
Questions we get about it
Does the portal store our CUI?
No. It holds metadata and pointers only. Evidence files stay in your GCC High environment; the portal records where each artifact lives, what control it supports, when it was collected, and its SHA-256 fingerprint.
Can we change our own SPRS score in the portal?
No, and neither can a single edit on our side. The published score changes only when a practitioner publishes a completed assessment covering all 110 controls with the SSP in place, which is how the DoD methodology treats it.
How do our people sign in?
The portal supports separately configured commercial Microsoft 365 and GCC High work identities. Client access opens after your tenant is configured and accepted, with MFA and conditional access governed by that tenant. Public demo sign-in is disabled.
Watch your own program in it.
We walk prospective clients through the portal with their own scope in mind. Or email rj@indirectit.com directly.