Frequently asked questions

ComplianceONE is an AI-powered compliance platform built for federal frameworks: 33 baselines across 10 families, from CMMC and NIST to FedRAMP, GovRAMP, ITAR and AS9100.

Our AI automates the heavy lifting: gap assessments, document generation, control guidance, evidence analysis, and remediation planning. It's not a generic chatbot. It's purpose-built for GRC.

Thirty-three baselines across ten families, each seeded with its full catalog: CMMC 2.0 Levels 1–3 (17, 110 and 134 practices); NIST SP 800-171 Rev 2 with SPRS scoring and Rev 3 (110 and 97 requirements); NIST SP 800-53 Rev 5 Low, Moderate, High and the full catalog (370 baseline controls, 644 in the catalog); FedRAMP Rev 5 LI-SaaS, Low, Moderate and High (410 controls); FedRAMP 20X Classes A, B and C (46 KSIs); GovRAMP Core, Low, Low+, Moderate and High (406 controls); TX-RAMP 2.0 Levels 1 and 2 (223 controls); DoD Impact Levels IL2, IL4, IL5 and IL6 (611 controls); ITAR for registrants, custodians and brokers (89 obligations); and AS9100 QMS: AS9100D, AS9110C and AS9120B (77 obligations). They share one evidence base, so a control you satisfy once counts everywhere it maps, and each framework keeps its own vocabulary, policy library, calendar and package documents.

Currently one organization per account. Multi-client portal management for partners and consultants is on our roadmap. Contact us for early access.

Hosted exclusively on Microsoft Azure Government (Microsoft's FedRAMP High authorized cloud; ComplianceONE is listed in the FedRAMP Marketplace in the Initial Implementation Phase, FedRAMP ID FR2700754082, and is pursuing FedRAMP 20x Class C certification). All data is encrypted at rest and in transit in US-only datacenters, and sensitive content is automatically detected before storage.

Not at all. The AI guides you through every requirement in plain language. No compliance background needed.

Minutes. CMMC Level 1 is completely free. Sign up with no credit card and run your first gap assessment the same day.

Yes. It is completely free, forever. Sign up and run it yourself, no credit card. It includes monthly AI Credits, so normal use costs nothing. Higher CMMC levels and the other frameworks need a paid plan, starting at $199/month, month to month.

Twenty package documents (System Security Plan, CRM, POA&M with owners and dates, asset and inventory lists, QMS records, export registers) in Word, Excel, PDF and OSCAL. Plus an authorization-boundary diagram and inventory from the discovery script, your SPRS score and scoresheet (CMMC and NIST 800-171), an evidence library with expiry tracking, a risk register, and a read-only Trust Center you can publish for a C3PAO or a prime.

Each framework carries its own reporting clock, and the platform tracks the real deadline rather than a generic reminder. Under DFARS 252.204-7012 a DoD cyber incident is reportable within 72 hours. FedRAMP and the DoD Impact Levels want an initial report inside one hour (IR-6, DISA SRG §6.2.2). ITAR allows 60 days for a full voluntary disclosure to DDTC (22 CFR 127.12). An AS9110C repair station files an FAA service difficulty report within 96 hours (14 CFR 145.221). Reports are drafted from your own records.

It replaces the months of preparation that come before your assessor. By the time you sit down with an auditor, your findings are already written and defensible.

Yes. We offer multi-year discounts and custom plans for organizations managing multiple frameworks. Contact us for a quote.

Automated ongoing compliance after certification: evidence tracking, scheduled assessments, POA&M management, and drift detection to keep you audit-ready year-round.

A DoD-required metric for CMMC Level 2 and NIST SP 800-171 self-assessment, ranging from -203 to 110. ComplianceONE calculates yours in real time and tracks your score history.

33 live integrations across cloud, identity, SIEM, endpoint, vulnerability, and DevOps tools, including Entra ID, Okta, AWS, GCP, CrowdStrike, Wiz, Tenable, Splunk and ServiceNow. Your stack feeds the AI: we pull compliance posture summaries, not raw data, and alerts you to drift when a control stops being satisfied. Evidence pushes out to SharePoint, Google Drive, GitHub and GitLab, and access is role-based across 14 roles and 313 permissions.

Yes. Every paid plan includes a Model Context Protocol server, so Claude, GitHub Copilot or any MCP-capable agent can read your frameworks, controls, policies and gap reports and, with a read-write token, draft and update them. Access is scoped by the same roles and permissions as the app.

Your posture, your package documents and near-real-time evidence from your integrations. Each check lands in the Trust Center as it runs, for your independent assessor, your prime, an agency AO or any trusted third party. Connect AWS, for example, and they see whether every S3 bucket is encrypted at rest with KMS, whether AWS Config's hardened settings and baseline inventory are in place, and whether console MFA is on. FIPS validation is drawn from your cryptographic-module register, not inferred from a setting. That goes beyond what every framework except FedRAMP 20x requires.

It is opening soon for independent assessors, trusted advisors, managed service providers and technology partners. Visit the Partners page to join the waitlist.

Yes. Every paid plan includes FedRAMP 20x landing-zone packages for AWS, Azure and Google Cloud, each with a commercial and a government variant (GovCloud, Azure Government, Assured Workloads). They are Terraform, built on each provider's own accelerator, with a KSI crosswalk and an evidence exporter that feeds your Trust Center.

Yes, in DOCX or PDF. We extract your control implementations and flag sensitive content automatically.

Each plan includes a monthly allowance of AI Credits that powers every AI feature (the User plan's is 1,500 AI Credits): gap assessments, document generation, evidence analysis and more. Because the engine sends only what a determination needs, a CMMC Level 2 SSP (110 controls) costs about 56 AI Credits, or 4% of the User plan's allowance, and a FedRAMP High SSP (410 controls) about 210 AI Credits, or 14%. The allowance refills every month, and you can buy more AI Credits at any time.

Yes. Unused AI Credits roll over month to month, up to 2x your monthly allowance. You never lose what you paid for.

Yes. Paid plans can buy additional AI Credit packs at any time from your account, with no plan upgrade required.

No, and that's by design. Fine-tuned models go stale. ChatGPT wrappers hallucinate. We built a purpose-built reasoning engine that stays current, cites your actual policies, and produces audit-defensible results.