What changed · July 13, 2026
The Department of War suspended CMMC Phase II, the third-party certification rollout, pending review. Phase I remains in force: defense contractors must still complete a NIST SP 800-171 self-assessment and post a senior-official affirmation to SPRS. The self-assessment is the requirement now, and it is the one we specialize in.
Our standard, in public
We don't just document compliance. We live it.
Before we ask a client to trust us with their security, we hold our own house to the full NIST 800-171 Level 2 standard, self-assess it honestly, and our CEO affirms it. This is our posture, stated plainly.
109 / 110
Our indicative NIST SP 800-171 self-assessment score. All 110 controls documented with real evidence, a full written policy set, a tested incident-response plan, and continuous monitoring. The one open item applies only once we hold a specific type of federal data. It is a build-on-contract item, not a gap in our security.
CUI-readyU.S.-person workforce
We staff U.S. citizens only, so we can support ITAR and export-controlled work that many providers legally cannot touch. Full background checks and screening on every hire.
IdentityMFA, least privilege, vaulting
Multi-factor everywhere, no standing over-privilege, no plaintext secrets, separate administrative identities.
DataEncrypted, isolated
Encrypted at rest and in transit, everywhere. Deliberate data isolation and separation. Sensitive data is kept out of general systems by design.
DetectionContinuous monitoring
Centralized audit logging with long retention and behavioral monitoring. We see attacks, not just operations, and alert on them.
GovernanceReal, not shelfware
A written policy set across all 14 control families, a documented and exercised incident-response plan, and an annual risk assessment.
Beyond Level 2Toward the enhanced bar
Enhanced screening, strict isolation, and encrypt-everything put us on the path toward the Level 3 / 800-172 requirements for high-value CUI.
Note: this is a NIST SP 800-171 self-assessment, the assessment type Phase I requires, affirmed by our senior official. It is not a third-party certification (no one issues those while Phase II is suspended).
How we help you
From an honest gap to a defensible score.
A self-affirmed SPRS score is a representation to the government. An inflated one is a False Claims Act problem. We make yours real and defensible, and we stand up the controls that make it true, not just the paperwork that says so.
01
Scope & gap
We map your environment against all 110 controls and tell you exactly where you stand, no sugar-coating.
02
SSP & POA&M
Assessor-ready documentation: the System Security Plan, a policy set, and a Plan of Action & Milestones that closes gaps on a real schedule.
03
Your SPRS score
A defensible score you can affirm with confidence, with the evidence behind every determination.
04
Managed monitoring
Our own security platform enforces and proves a block of your controls continuously, so your score stays true between assessments.
Why RedEyeWe did it ourselves
The exact package we run you through is the one we used to score our own environment 109 of 110. Proof, not promises.
Built for your sizeSmall and mid-size subs
The self-assessment burden falls on small defense subs, and that is who we are built to serve. Independent, hands-on, no enterprise minimums.
OT depthThe plant floor too
Defense manufacturers with ICS/OT exposure are underserved. We assess the control systems, not just the office network.
ITAR-readyExport-controlled capable
Our U.S.-person workforce means we can support export-controlled engagements end to end.