Bastion walks defense suppliers through all 110 NIST 800-171 controls, calculates your live DoD SPRS score, and assembles a C3PAO-ready handoff package — entirely in your browser. Self-assessment and prep, not certification.
The CMMC rule is final. The 48 CFR rule was published Sept 10, 2025 and CMMC Phase 1 began Nov 10, 2025 — Level 2 self-assessment plus discretionary C3PAO via DFARS 252.204-7021. Mandatory Level 2 C3PAO certifications phase in starting ~Nov 10, 2026. Primes like Boeing already make CMMC Level 2 a condition of award. For small and mid-size suppliers — often with no GRC staff and no budget for a six-figure engagement — that means proving compliance against 110 controls now, and being ready to hand off to an assessor when your turn comes.
One tool takes you from "where do we even start?" to a documented, scored, defensible posture.
Pick your scope — L1 (FCI), L2 self-assessment, or L2 C3PAO — or answer three questions and let the built-in triage tell you whether you self-attest or need a third-party assessor.
Step through every NIST 800-171 control in plain language, with practical guidance on what each one means for your shop.
Your Supplier Performance Risk System score updates in real time using the official DoD weighted methodology — no spreadsheet math.
See exactly where you stand across all 14 control families so you fix the highest-impact gaps first.
Turn your answers into a complete System Security Plan documenting how each control is implemented — the artifact every assessor expects.
Every open control becomes a Plan of Action & Milestones entry with an owner and target date, so remediation is tracked, not forgotten.
Attach a file and Bastion computes a SHA-256 hash in your browser, then discards the bytes — only the filename, size, and hash are kept. Your CUI never leaves the machine.
Snapshot your assessment over time and see exactly what moved — score change, newly satisfied controls, and any regressions — as proof of an upward trajectory.
One bundle: SPRS Basic-assessment worksheet, validated SSP, POA&M, evidence index, and the annual Affirming-Official affirmation — assembled locally to cut your assessment bill. Prep, not certification.
Bastion executes locally. Your CUI, evidence, and assessment never leave your device — there's no server to trust.
Bastion auto-evidences controls from the tools you already run — so your score reflects real, current data, not stale screenshots.
Pulls live endpoint posture — encryption, patching, MFA, EDR, and logging — to auto-evidence your technical controls with real, current data.
Links your policies, procedures, and training records to the controls they satisfy, auto-evidencing the documentation controls assessors scrutinize most.
When it's time to face a C3PAO, you hand off a single bundle instead of starting from a blank page — which is where the assessment bill comes down.
📋 SPRS Basic-assessment worksheet. The exact fields you transcribe into SPRS via PIEE — score, requirements implemented, open items, and the 180-day plan-of-action date. You post it yourself; Bastion never touches a DoD system.
📄 Validated SSP + POA&M. A completeness review flags the gaps an assessor challenges first — Met controls with no evidence, unattributed inheritances — so your SSP and POA&M go in clean.
🔎 Evidence index. A flat table of every evidence item across all controls, with locally computed SHA-256 hashes for attached files — integrity facts an assessor needs, with no CUI in the document.
✍️ Annual Affirming-Official affirmation. A ready-to-sign affirmation per 32 CFR 170.22, with a cadence reminder so the required annual re-affirmation doesn't slip.
The bundle is assembled locally and stamped with a SHA-256 integrity hash so a recipient can confirm it wasn't altered after handoff. An optional redacted export strips notes and evidence locations while keeping status, scores, ownership, and dates — safe to share outside your CUI boundary. It's labeled as preparation, not a CMMC certification.
◆Accurate by design. SPRS scoring follows the official DoD weighted methodology — the number you see is the number that counts.
◆Artifacts in minutes. Audit-ready SSP and POA&M generated in minutes, not the weeks a consultant would bill for.
◆Your CUI stays put. Fully local execution — no cloud upload, no third party holding your sensitive data.
◆Priced for your shop. A straightforward licence — see your SPRS score and get audit-ready without a six-figure consulting engagement.
No six-figure consultant, no CUI leaving your machine. Just an accurate score and audit-ready artifacts.