Sovereign is the parent-organization tier. Multiple subsidiaries, each with its own CUI environment, each headed for its own C3PAO assessment against the same 110 NIST 800-171 controls. Enclave AI™ runs 24/7/365 across all of them, delivering a per-entity CMMC readiness package from read-only configuration data from your connected cloud each cycle, and rolling everything into a single parent-level posture report your General Counsel and CISO can read in five minutes. Per-entity SSPs and evidence binders build out as each entity’s environment data accrues. One contract. One pipeline. Modern AI across the whole portfolio.
What Sovereign adds on top of Fortress
- Up to 10 entities under one contract. Each subsidiary or CUI environment gets its own readiness package and SPRS submission line, measured from its own scoped intake and its own connected clouds, with its SSP and evidence binder building out as its data accrues. The parent organization gets a roll-up posture report each cycle that shows which entities are inside SPRS threshold, which are drifting, and which are blocking a flow-down.
- Cross-entity consistency review. When assessor #4 walks into subsidiary #4 a month after assessor #1 walked subsidiary #1, the readiness packages and remediation structures don’t contradict each other. An ElasticD3M reviewer runs a consistency pass across your entity packages.
- Parent-level account handling. Every reply to
hello@ai4cmmc.aiis answered in the context of your full entity portfolio rather than a single subsidiary ticket, with same-business-day reply in writing. - NDA on file in 24 hours. ElasticD3M-signed mutual NDA delivered for executive countersign within 24 hours of intake submission. Required by most parent-organization legal teams before any subsidiary data flows.
- Priority email response, including weekends during active assessment windows. The agents don’t stop on Saturday. Neither does our review when an assessment is mid-flight.
- Everything in Fortress and Standard. Per entity. Reconciled at the parent.
Custom integration into legacy on-premise tooling (ServiceNow, Splunk, Archer, RSA SecurID, Tenable, on-prem AD) is available under a custom MSA on top of Sovereign, not included by default. Email hello@ai4cmmc.ai with the integration scope and we’ll quote it.
What life looks like at the parent level
The Monday morning posture email lands. One PDF, ten entity rows. Three entities are inside SPRS threshold and assessor-ready. Five are inside threshold with open POA&M items closing on schedule. Two are drifting; the diff against last cycle is in the appendix, with the control ID, the remediation owner already named in last quarter’s POA&M, and the day-of-closure target. Your GC forwards the email to the audit committee chair without opening another tab. Your CISO clicks through to the entity-level binder when an assessor on entity #4 asks for a copy.
The first 30 days, per entity and at the parent
- Minute 0. Stripe processes your subscription. Welcome email + intake link. Mutual NDA in your legal team’s inbox inside 24 hours.
- Day 1. Per-entity intake for each subsidiary in scope. Each entity’s read-only cloud connectors are configured against its own AWS account, Azure tenant, M365 tenant, Okta org, CrowdStrike CID.
- Day 2. First multi-entity scan. Per-entity readiness packages drop: control-gap analysis against the 110-control baseline, SPRS posture, and a 30-day remediation plan. Parent-level roll-up posture report drops alongside.
- Day 14. Mid-cycle drift check across all entities; any subsidiary that moved out of SPRS threshold is flagged, and you can reply for a same-business-day written answer.
- Day 30. Second-cycle bundle per entity. Parent-level diff against month one shows which subsidiaries advanced and which are blocking.
“Why not run ten Standard subscriptions?”
You can. Ten Standard subscriptions are $49,950/month with zero reconciliation across them. Each entity’s POA&M lives in its own thread. Your team reconciles at the parent by hand each month. Sovereign is $24,995/month and reconciliation is the product, the parent-level roll-up, the cross-entity drift comparison, the cross-entity readiness review that stays internally consistent when each subsidiary’s C3PAO reads it.
Above 10 entities, classified environments, or on-prem deployment
If your scope exceeds 10 entities, you operate in classified or IL5+ environments, you require on-premise deployment of the platform itself, or you need a contract structure beyond our standard MSA, including Level 3 (CUI Specified) readiness, which is not on the platform today, contact hello@ai4cmmc.ai for a custom engagement. Self-serve checkout is not available for these arrangements; reply by email goes to a human.
The Big Idea, restated
The gap between your self-reported SPRS score and what your environment actually shows is the difference between passing your assessment and re-doing it. Sovereign measures the gap across every CUI environment your parent organization owns, reconciles ten readiness packages into one signed-off posture report, and hands you a roll-up your GC and audit committee can read without opening a tab.
Start your subscription
$299,940 per year, or $24,995 month-to-month. If you ran the $799 CMMC Readiness Snapshot in the last 30 days, it credits to month one.
Subscribe to Sovereign, $299,940/year →