800-171 assessment & SPRS scoring
Scored against all 110 requirements, with the System Security Plan and POA&M written properly and your SPRS submission squared away under DFARS 252.204-7019.
For the defense industrial base
Shrink the CUI boundary. Then prove it holds.
CMMC Level 2 and NIST SP 800-171 readiness for defense contractors — including the Microsoft enclave to put your CUI in, and the hands to close the findings rather than hand you a list of them.
Track record
5
companies taken through CMMC Level 2 certification, all inside a single year
2
FedRAMP assessments, with the environment designed and built in-house
1
compliance practice built from nothing — method, project plans, policy set
Led by [FOUNDER NAME] prior to founding Redoubt Assurance. Client names withheld.
Services
Assess it, build it, fix it.
CMMC Level 2 readiness
Gap analysis against the assessment objectives, a complete evidence package, and a rehearsal before your C3PAO arrives. The certification assessment itself is theirs to conduct — our job is that you pass it.
Microsoft enclave design & build
A scoped GCC High or Azure Government environment that holds CUI in one defensible place. Entra ID, Intune, Purview, Defender, conditional access — designed, built and documented against the controls.
Remediation
We close findings in your environment rather than listing them in ours. Works alongside your IT team or your MSP, in whatever you already run.
The enclave
The cheapest control is a smaller boundary.
Every system that touches CUI falls in scope, and every system in scope has to satisfy 110 requirements, be documented, and be assessed. Most contractors let CUI spread across the whole estate and then try to bring the whole estate into compliance.
The alternative is to pull CUI into one hardened environment and leave the rest of the business out of scope. Fewer systems to control, fewer to document, fewer to pay an assessor to look at. That environment is the redoubt, and building it is what we do.
Approach
Scope, build, evidence, hold.
01 Scope
Find where CUI actually lives — including the places nobody meant it to. Draw the smallest boundary that holds it.
02 Build
Stand up the enclave and migrate CUI into it, or harden what you already run if an enclave is not the right answer.
03 Evidence
SSP, POA&M and the artifacts an assessor will ask for — each with a date, a source and someone’s name on it.
04 Hold
Keep the score current and the enclave clean between assessments. Certification is a moment; compliance is not.
What you are held to
If a contract put one of these in front of you, we can tell you what it actually obliges you to do.
CMMC Level 2
NIST SP 800-171
DFARS 252.204-7012
DFARS 252.204-7019
DFARS 252.204-7020
DFARS 252.204-7021
FAR 52.204-21
About
A redoubt is the inner work — the small, strong position a garrison falls back to and holds when the outer wall is lost. A CUI enclave is the same idea in a different century: give up defending everything, and defend the thing that matters properly.
[FOUNDER NAME] took five companies through CMMC Level 2 certification inside a single year and worked through two FedRAMP assessments, designing and building the environment on both. The harder part was building the practice that made it repeatable — the delivery method, the project plans, the policy set, the way an SSP gets written so an assessor can follow it. Redoubt Assurance exists to bring that to contractors who cannot hire it in-house.
Send us the clause.
Tell us which flowdown landed in your contract and what your environment looks like today. We will tell you plainly what it will take and whether we are the right firm for it.