NIST SP 800-171 assessment and SPRS scoring
A scored assessment against all 110 requirements, a System Security Plan that describes what you actually run, a realistic POA&M, and your SPRS submission under DFARS 252.204-7019.
Compliance services for defense contractors
CMMC Level 2 and NIST SP 800-171 readiness, including the environment to hold your CUI.
We help defense contractors scope their CUI boundary, build a Microsoft enclave to contain it, prepare for the C3PAO assessment, and fix what the assessment finds.
Redoubt Assurance is run by Nathan Bailey, who has led defense contractors through CMMC Level 2 certification from initial scoping through the C3PAO assessment, and has designed and built the Microsoft environments behind two FedRAMP authorizations.
Services
What we do
CMMC Level 2 readiness
Gap analysis against the assessment objectives, the evidence package your C3PAO will ask for, and a rehearsal before they arrive. We are not a C3PAO; we prepare you for the assessment they conduct.
Microsoft enclave design and build
A GCC High or Azure Government environment scoped to hold CUI and nothing else, configured against the controls and documented for the SSP. Entra ID, Intune, Defender, Purview and Conditional Access.
Remediation
We fix findings in your environment, working with your IT staff or MSP, and produce the evidence that they are closed.
Why we start with the boundary
Every system that touches CUI is in scope. Fewer systems means less to control, document and assess.
Most contractors let CUI spread across the whole company and then try to bring the whole company into compliance. That means 110 requirements applied to every laptop, every mailbox and every file share, and an assessor looking at all of it.
The alternative is to move CUI into one hardened environment and keep the rest of the business out of scope. That environment is what we design and build.
Approach
How an engagement runs
1. Scope
Find where CUI actually lives, including places nobody intended, and define the smallest boundary that contains it.
2. Build
Stand up the enclave and move CUI into it, or harden the environment you already have if an enclave isn't the right answer.
3. Document
Write the SSP and POA&M and assemble the evidence an assessor will ask for, each item dated and attributed.
4. Maintain
Keep the SPRS score current and the enclave clean between assessments. Certification is a point in time; the requirement is ongoing.
Requirements we work with
If one of these appeared in your contract or a letter from your prime, we can tell you what it requires of you.
CMMC Level 2
NIST SP 800-171
DFARS 252.204-7012
DFARS 252.204-7019
DFARS 252.204-7020
DFARS 252.204-7021
FAR 52.204-21
About
A redoubt is the inner position of a fortification, the part a garrison falls back to and holds when the outer wall is lost. A CUI enclave works on the same principle: rather than defend everything equally, defend the thing that matters properly.
Redoubt Assurance was founded in 2026 by Nathan Bailey. Before that, Nathan led defense contractors through CMMC Level 2 certification end to end, built the Microsoft environments behind two FedRAMP authorizations, and developed the delivery method, project plans and policy framework that made the work repeatable.
Get in touch
Tell us which clause you've been handed and what your environment looks like today. We'll give you a plain answer about what it will take.