Don’t see your question? Email hello@ai4cmmc.ai. Replies are triaged by an Enclave AI™ agent; humans on escalation.
No. Every connector is scoped to configuration metadata only, never the data itself. AWS uses the AWS-managed SecurityAudit + ReadOnlyAccess policies (no decryption, no object reads). Azure / M365 use Reader + Security Reader at subscription scope. Okta and CrowdStrike use vendor-defined read-only token scopes. The agents read who has MFA enabled, whether CloudTrail is on, whether a bucket policy is permissive, not what’s in the bucket.
Credentials are encrypted at rest with AES-GCM and decrypted in-process only at scan time. The evidence binder stores hashed API responses, not data payloads. Every connector is revocable in 30 seconds by deleting the IAM role, Service Principal, API token, or OAuth2 client on your side. Revocation takes effect on the next scan cycle, no support ticket required.
Details in the privacy policy and the DPA attached to every subscription.
No platform can guarantee that, the C3PAO decides. The honest answer: assessments fail when evidence is disorganized, stale, or doesn’t map cleanly to a control ID. They rarely fail because a control was missing entirely.
What the platform does: every one of the 110 controls and 320 assessment objectives has current measured evidence in a format your assessor can consume on the first pass. Every artifact has a SHA-256 hash and a NIST control ID stamped on it. Your SPRS submission reflects measured posture, not self-attestation. That removes the most common reason assessments stretch from five days to eight.
Your C3PAO retains its independence and its judgment. We don’t talk to your assessor on your behalf; we hand you the package they expect to see.
Those platforms are dashboards. They were built to serve SOC 2 first, then bolted CMMC features on. You log in, you see your control score, you go assemble the SSP and evidence binder yourself or hire a consultant to do it.
Enclave AI is Agent-as-a-Service. The work product lands in your inbox each cycle, written by the agents and ready to forward to your C3PAO: the SSP Word document, the POA&M tracker, the evidence binder, and the SPRS posture report. The agents work whether you log in or not. The deliverables ship whether you read them or not.
Practical implication: if you don’t want to spend your week inside another compliance dashboard, you don’t have to. If your team is one person wearing the compliance hat alongside three other hats, the tier subscriptions are designed for that situation.
A 5-page PDF in your inbox within minutes of intake submission. Three things on it:
What it is not: a C3PAO pre-assessment, a certification, a legal opinion, or consulting. It is a measurement, nothing more.
The $799 credits to month one if you start a subscription within 30 days. Net cost of a Readiness Snapshot that converts: $0. Net cost of a Readiness Snapshot that confirms you’re not ready and you walk away: $799 well spent.
The full subscription. From minute zero you get the welcome email, the intake, the read-only cloud connectors, the first multi-cloud scan, and the first deliverable bundle (SSP draft, POA&M, evidence binder, readiness analysis, 30-day remediation list). On Fortress, you also get twice-monthly scan cycles and an automated quality gate on every deliverable with a documented QA review after delivery. On Sovereign, per-entity bundles, the parent-level roll-up, and parent-level account handling.
Monthly subscription. The card you provide at checkout is charged the tier price on the day you subscribe and on the same day each month going forward. Cancellation is one click in your Stripe billing portal; no email, no call. Access continues through the end of the paid period after cancellation.
The first billing cycle delivers enough real work product in the first hour for you to judge whether your C3PAO would accept it. Billing is month-to-month; you can cancel in the Stripe billing portal before the next cycle.
No. Stripe checkout, intake, scan, PDF in inbox, the entire buy-and-deliver path is self-service. Reply to any deliverable email with a question; agents answer in minutes, humans inside four business hours when judgment is needed.
The only path that requires a call is custom engagement above 10 entities or in classified / IL5+ environments, handled by hello@ai4cmmc.ai.
Six subscription tiers, billed annually with a month-to-month option, all managed in the Stripe billing portal:
Annual pricing per tier: Standing $6,000, Sentinel $23,940, Garrison $35,940, Standard $71,940, Fortress $143,940, Sovereign $299,940. Annual equals twelve times monthly on every tier; there are no discounts. Every tier also has a month-to-month option billed monthly in advance. Fair-use thresholds in Terms of Service.
It means the deliverables ship in your inbox each cycle: the SSP file, the POA&M file, the evidence binder, the SPRS posture report, and the 30-day remediation list. You don’t open a dashboard to assemble them. You don’t schedule a check-in to review them. The agents ingest your environment, map controls, draft documentation, collect evidence, and produce the deliverables. You and your team remain in the loop for the executive decisions (what to remediate first, what to accept as a residual risk, what to flag to your prime), but the production work is done.
If a dashboard is what you want, this isn’t the right product. If outcome-shaped work product is what you want, it is.
Each connector is read-only, scoped, and revocable:
Each scan stores its API responses with SHA-256 hashes for chain-of-custody. Cycle cadence: monthly on Standard, twice-monthly on Fortress, per-entity on Sovereign.
You still get a readiness package. The intake captures the parts the cloud connectors can’t reach, on-prem infrastructure, niche SaaS, process-only controls, contractual posture. Findings derived from intake answers are labeled as such on the report (versus connector-measured findings); your C3PAO sees the distinction. On Sovereign, custom integration into legacy on-prem GRC, ticketing, SIEM, and IAM tools brings additional environments into the measured path.
On the next scan cycle. When the scan runs and a configuration has changed since the previous cycle, the diff appears on the first page of that cycle’s deliverable bundle: which control moved, which API response changed, when it changed, and what the POA&M needs to reflect. We do not promise “drift detected in minutes”, that’s a SaaS-dashboard claim. We promise the deliverable bundle reflects current posture each cycle.
SSP as a Word .docx and a signed PDF. POA&M as a Word .docx with an embedded table (so your team can edit in Word) plus an .xlsx export for GRC tool import. Evidence binder as a folder of JSON evidence files (one per finding, with SHA-256 hash) plus a PDF index that maps each evidence file to its NIST control ID and assessment objective. SPRS posture report as a PDF.
No, and the framing matters. Operational leverage, not headcount elimination. The platform handles continuous measurement, evidence collection, and document production. Your compliance lead keeps making executive decisions, what residual risk to accept, what to escalate, what to flag in board reporting. Human-in-the-loop by design. The platform is the leverage that lets one compliance person do the work a small team used to do.
No. Enclave AI is software for CMMC Level 1 and Level 2 readiness. Assessments are conducted exclusively by independent Certified Third Party Assessment Organizations (C3PAOs) authorized by the Cyber AB. We’re a software vendor in the CMMC ecosystem, built to make life easier for the OSAs preparing for assessment, the C3PAOs assessing them, and the RPOs guiding them.
Read more in our Policy Position on the structural integrity of the CMMC ecosystem.
No. ElasticD3M, LLC is a CMMC compliance software vendor. We are not an RPO and we do not provide consulting, advisory, or readiness services as defined under 32 CFR Part 170. We make software that customers operate themselves, and that RPOs can use to deliver their consulting work more efficiently if they choose.
No. Under 32 CFR 170.9 a C3PAO cannot provide consulting to an organization it will assess. The CMMC Readiness Snapshot is a measurement product, not a consulting engagement, no advisor, no SOW, no recommendation to take specific remediation actions beyond the factual gap list. Running a Readiness Snapshot before assessment is something many contractors do, and it does not affect your C3PAO’s independence.
Not today. Level 3 (CUI Specified, the highest sensitivity tier) is currently out of scope. If your contracts require Level 3, contact hello@ai4cmmc.ai for a custom engagement conversation. We will not sell you a Level 2 subscription and tell you it covers Level 3.
No. The Readiness Snapshot and the subscription tiers are CMMC / NIST 800-171-specific. If your compliance need is SOC 2, ISO 27001, HIPAA, PCI, or anything other than CMMC / NIST 800-171, this is not the right product for you. Buying it anyway would waste your money.
Stripe Checkout, billed immediately with no free trial. Card or US bank account (ACH) at checkout; card, ACH, or wire for annual prepay. Stripe sends receipts automatically. Invoices on request to hello@ai4cmmc.ai.
Inside the Stripe billing portal, one click, no email, no call. Subscriptions are month-to-month; auto-renewal stops at the end of the then-current paid month. The $799 Readiness Snapshot is a one-time purchase. Full cancellation policy.
For Standard and Fortress, no, the Stripe-signed terms cover the engagement. For Sovereign, an ElasticD3M-signed mutual NDA is delivered for executive countersign within 24 hours of intake submission, most parent-organization legal teams require it before subsidiary data flows.
If your procurement requires a custom MSA before any data touches the platform, email hello@ai4cmmc.ai with “MSA request” and entity name.
The platform is compliance management software, not a legal opinion, not a certification, not a substitute for a C3PAO assessment, not a guarantee of pass. Every material compliance decision requires executive approval on your side. Full liability terms in the Terms of Service.
No. Pricing is the same for every buyer and there are no discount codes. What the C3PAO Partner Program carries instead is a partner revenue share: 20% of gross revenue on an OSA you refer and do not assess yourself, for the first 12 months of that customer’s paid relationship with us, across every offering they buy, reconciled monthly. No fee ever attaches to an OSA your firm assesses. Details on the For C3PAOs page.
Email hello@ai4cmmc.ai. Replies are triaged by an Enclave AI™ agent; humans on escalation.
Start with the $799 CMMC Readiness Snapshot →Enclave AI™ is purpose built software for the CMMC ecosystem, for the OSAs preparing for assessment, the C3PAOs assessing them, and the RPOs guiding them. We deliver CMMC Level 1 and Level 2 readiness software. We do not conduct assessments, those run exclusively through independent Cyber AB-authorized C3PAOs. ElasticD3M, LLC is a Texas limited liability company.