Complete assessments with evidence-backed decisions.

AegisForge is the assessment platform for firms and the organizations they assess: CMMC, FedRAMP, RMF, NIST 800-53 and 800-171. Aegis, its agent, reads the evidence and proposes; every rating and every determination stays with a person, on one record.

Record · 16:04:03 · Aegis is reading EVD-NWA-0006 for PS.L2-3.9.1[a]

Evidence arrives, and becomes an organized result

The client drops what they have. Each file is screened and fingerprinted, matched to the open request it answers, and shown for review. The client changes any match, submits, and sees what is covered and what still needs attention. Aegis offers the next action.

AssessmentASSESS-HPPM-2026-0001Evidence due 28 Nov
You are ClientEB
ZIP
harbor-point-evidence-nov.zip
38 files · 212 MB
Received
Dropped asProposed match
scan_0427.pdfPersonnel screening procedure v3.2 → PS.L2-3.9.1
IMG_2231.pngMFA policy, privileged accounts → IA.L2-3.5.3
export (3).xlsxLocal administrators, PMC-APP-01 → AC.L2-3.1.1
diagram-final-v2.pdfBoundary diagram r2 → SC.L2-3.13.1
… 33 more · 37 proposed · 1 file held for a marking

Open requests · 11

Submit 37 matchesElena Brooks · changed 2 · held 1
REQ-…-019Personnel screening procedureOpenEvidence attached
REQ-…-018MFA policyOpenEvidence attached
REQ-…-021Admin group membershipOpenEvidence attached
REQ-…-017Boundary diagramOpenSuperseded · r1 still cited
REQ-…-020Access control policyOpen · nothing matched
Covered 9 of 112 need attention
Aegis advisory
Two requests still need something. REQ-020 has no matching file in the drop. REQ-017 cites boundary diagram r1, and you uploaded r2. You also mentioned a new file share: I can start the scoping interview for it.
Open REQ-020Replace with r2Start scoping
Staged example · synthetic data

A client drops a ZIP into AegisForge.

  1. Drop what you haveA ZIP, a folder, or files chosen together. Supported formats are screened and fingerprinted on arrival.
  2. Matched, for your reviewEach file gets a proposed name and a proposed match to an open request. One file with a marking is held, not entered.
  3. Reviewed and submittedChange any match, then submit. The requests fill in as the evidence that answers them is attached.
  4. Covered, or needs attentionThe client sees the state of the whole request list, not an inbox.
  5. The next action, offeredAegis explains the two gaps and offers to start scoping.

Evidence becomes a human decision

The assessor opens an objective and the relevant artifact opens beside it. Aegis identifies the passage that supports it, or contradicts it, and suggests a rating with a rationale. The assessor edits, confirms, and the saved result carries its source trail.

  1. Open the objectivePS.L2-3.9.1[a], not yet rated.
  2. The artifact opens beside itEVD-NWA-0006, page 4, already filed to this control.
  3. Aegis finds the passageSupporting text highlighted in the file; anything contradicting is flagged the same way.
  4. A suggestion, not a ratingMet, with the methods it supports and a draft rationale. Nothing is saved.
  5. The assessor edits and confirmsAdds the interview, presses Save. The server requires result, method, rationale and artifact.
  6. On the record, with its sourcesRated by a named person at a time, pointing to the file, the page and the hash.
AssessmentASSESS-HPPM-2026-0001Assessors test controls
You are AssessorDW
PS.L2-3.9.1[a] · Personnel security
Individuals are screened prior to authorizing access to organizational systems containing CUI
Not ratedMetMethods: examine · interview · test
Personnel Screening Procedure, v3.2EVD-NWA-0006 · p. 4

4.1 Human Resources maintains the screening standard in Appendix A and reviews it annually.

4.2 Prior to authorizing access to any organizational system, Human Resources completes the background screening defined in Appendix A and records the result in the personnel file. Access is not provisioned until the screening result is recorded. Rescreening occurs every five years or on change of role.

Page 4 of 9
Aegis advisory
Reading EVD-NWA-0006, 9 pages
Supports p. 4 §4.2
“Access is not provisioned until the screening result is recorded.”
Contradicts · none found
SuggestedMetMethodsExamine, InterviewRationaleProcedure §4.2 requires screening before provisioning. Confirmed with the HR lead in interview, 6 Nov.
ConfirmEditSave rating
MetRated by Dana Whitfield · 6 Nov 16:04:12 · examine, interviewEVD-NWA-0006 · p. 4 · sha256 9f3a…c21e · r4
Staged example · synthetic data

The assessor opens PS.L2-3.9.1[a].

One assessment, four roles, every handoff on the record

The same assessment, ASSESS-HPPM-2026-0001, moves from the client to the assessor, to the independent reviewer, to the approver. Each handoff is a visible event. Each decision is a person's. Choose a role to watch its part.

Client

Establishes scope, uploads evidence and works through outstanding requests with assistance. Answers the CUI question for each file.

Handoff: 37 files sent to Northwind Assurance, each bound to revision 4 with its hash.

Assessor

Examines the evidence, works through the controls, records ratings and rationale, and packages the work. Aegis reads and suggests; the assessor rates.

Handoff: revision 3 frozen and hashed, submitted for independent review.

Reviewer

Performs quality control: checks the evidence and the conclusions against the assessment plan, samples, and can return issues for correction. Never on the team.

Handoff: concurred with one note resolved, sent to the approver.

Approver

Approves the package for release. In a CMMC Level 2 assessment that is the firm's approver confirming the score, the status the results support and which Not Met items may carry a plan; in an RMF or FedRAMP workflow the same seat is the authorizing official. Reads the exact revision, down to the file behind any page.

Approved: score 104 of 110, Conditional Level 2 recommended, six 1-point items on a POA&M to close within 180 days. The MFA finding could not be deferred, so it was fixed and re-examined before the freeze. Released to the client.

AssessmentASSESS-HPPM-2026-0001Evidence
You are ClientEB
Needs you · 2 of 11
Evidence & documents
✓Scope v1 confirmed · 14 items · bound to this assessment
✓37 files named, filed, CUI question answered · 1 held for a marking
✓9 of 11 requests covered · 2 answered this morning
RequestControlStatus
REQ-…-019 · Personnel screening procedurePS.L2-3.9.1Evidence attached
REQ-…-018 · MFA policyIA.L2-3.5.3Evidence attached
REQ-…-021 · Admin group membershipAC.L2-3.1.1Evidence attached
REQ-…-017 · Boundary diagramSC.L2-3.13.1Replaced with r2
REQ-…-020 · Access control policyAC.L2-3.1.1Answered this morning
HandoffSent to Northwind Assurance · 6 Nov 10:42 · 37 files · bound to r4 · hashed
Elena Brooks pressed Send. From here the assessor sees the files; the client sees the assessment move in real time.
Staged example · synthetic data
AssessmentASSESS-HPPM-2026-0001Assessors test controls
You are AssessorDW
Arrived37 files from Harbor Point · 6 Nov 10:42 · read by Aegis against 110 controls · 320 objectives
38 of 110 rated6 Not Metread 16:04
PS.L2-3.9.1[a]Metexamine, interview · EVD-NWA-0006
PS.L2-3.9.1[b]Not ratedMetexamine · EVD-NWA-0006
IA.L2-3.5.3[a]Not ratedNot Metfinding F-003 · not POA&M-eligible · must be Met before close-out
AC.L2-3.1.1[a]Not ratedMetexamine, test · EVD-NWA-0021
HandoffRevision 3 frozen · 110 of 110 rated · sha256 3b7e…91d0 · submitted for independent review by Priya Raman (Lead)
Staged example · synthetic data
ReviewASSESS-HPPM-2026-0001 · r3Frozen
You are ReviewerML
ArrivedRevision 3 · frozen 6 Nov 18:30 · sha256 3b7e…91d0 · independent of the team
Aegis pre-check never answers for you
✓110 of 110 controls rated with method, rationale and artifact
✓6 Not Met · 6 findings · 6 POA&Ms with steps and a clock
Check2 rationales cite r2 evidence · confirm the r3 copy
PS.L2-3.9.1[a]r2 citationChecking…Concur · r3 copy matches · note added
IA.L2-3.5.3[a]Not Met 6 Nov · re-examined after enrollment · Met 17:50Concur
HandoffConcurred · 1 note resolved · sent to the authorizing official by Marcus Lindqvist · 7 Nov 09:31
Staged example · synthetic data
PackageASSESS-HPPM-2026-0001 · r3Frozen
You are ApproverRK
ArrivedRevision 3 · reviewer concurred 7 Nov 09:31 · sha256 3b7e…91d0
104
score of 110 · minimum 88
104
Met
6
Not Met · all 1-point · POA&M-eligible
0
reviewer flags open
Return to LeadApprove · Conditional Level 2
ApprovedConditional Level 2 recommended · Rina Kaur · 7 Nov 16:40 · POA&M close-out within 180 days
Nov 7 17:05Released to client: assessment report, findings, POA&M
Nov 7 16:40Rina Kaur approved · Conditional Level 2 recommended
Nov 7 09:31Marcus Lindqvist concurred · 1 note
Nov 6 18:30Priya Raman froze revision 3 · 3b7e…91d0
Nov 6 17:50Dana Whitfield re-examined IA.L2-3.5.3[a] after MFA enrollment completed · Met
Staged example · synthetic data

Client · scope, upload, respond

1 of 4

The Front Door: the conversation is the workspace

The Front Door is where an assessor works with Aegis. Ask for a control and its objectives, ratings and evidence come into the conversation. Open a file and the value that matters is marked. Where the evidence and the requirement disagree, Aegis shows the two side by side and proposes a result. Then do the same across a whole family: Aegis reads every unrated objective, you save the safe proposals in one press, and the adverse ones stay yours, one at a time.

Demonstration with fictional data at a simulated pace. It shows how the Front Door is designed to work; some of what it shows is not in the product yet.

Assessment in contextASSESS-HPPM-2026-0001 · Harbor Point CUI EnclaveActive You are Assessor Search or jump to…/ DW

Good morning, Dana

Assessor on ASSESS-HPPM-2026-0001 · Harbor Point CUI Enclave

118 objectives not rated, 7 Not Met, 3 requests without files. As of 09:41.

Open AC.L2-3.1.10 with its objectives and evidenceAsked on Today

AC.L2-3.1.10 has 3 objectives: 1 Met, 2 not rated. 2 files are linked. As of 09:41.

AC.L2-3.1.10 SESSION LOCK ·AC Access Control This controlIncomplete1 of 3 rated · Points: 1

Use session lock with pattern-hiding displays to prevent access and viewing of data after a period of inactivity.

ObjectiveResultRationaleEvidence
AC.L2-3.1.10[a] · the period of inactivity after which the system initiates a session lock is defined;1MetExamined the access control policy v6; §4.3 sets the period at 15 minutes.PDF 1
AC.L2-3.1.10[b] · access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity; and0Not AssessedAdd rationaleXLSX 1 PDF 1
AC.L2-3.1.10[c] · previously visible information is concealed via a pattern-hiding display after the defined period of inactivity.0Not AssessedAdd rationaleNone · a gap, not a result
Evidence for this controlXLSXworkstation-security-settings.xlsxEVD-NWA-0031PDFaccess-control-policy-v6.pdfEVD-NWA-0030
Show the settings export for [b]Asked on Today

Opened beside objective [b]. One value does not match the period your client defined: cell B5.

XLSXworkstation-security-settings.xlsxEVD-NWA-0031Close
SHA-2568c21e4d07b3f…a94fa0Copy checksum
Records · 6 rows6 rows × 2 columns · sheet SettingsCited by Aegis · Settings!B5
Settings
RowAB
1SettingConfigured value
2Account lockout threshold5 attempts
3Account lockout duration15 minutes
4Minimum password length14 characters
5Interactive logon: Machine inactivity limit3600 seconds
6Password protect the screen saverEnabled
AC.L2-3.1.10[b] Not Assessed Aegis proposes Not Met Draft Saved Nobody has saved a result yet.Saved by DWDana Whitfield · 09:44

access to the system and viewing of data is prevented by initiating a session lock after the defined period of inactivity; and

Reading 1 file against this objective
What Aegis foundAcceptDismiss
Suggested rating:Not MetHigh confidence · 2 sources · 9 Nov 2026 · 09:42

Requirement AC.L2-3.1.10[b] · a session lock after the defined period of inactivity.

Suggested rationale Examined the workstation settings export. The session lock engages after 3600 seconds (60 minutes); the access control policy defines 15 minutes (§4.3). The defined period is not implemented.

Advisory · You decide the rating and final wording.

Aegis draft accepted · edit anything before you rate
Methods usedExamine Interview Test
Rationale Required, 20 or more characters
Examined the workstation settings export (EVD-NWA-0031). The session lock engages after 3600 seconds (60 minutes); the access control policy defines 15 minutes (§4.3). The defined period is not implemented.
This objective
1Met2Not Met3N/A0Not Assessed
Now run Aegis on the rest of Access ControlAsked on Today
Run AegisFamily · AC Access Control · 22 requirementsWorkingFinished

It will read 65 objectives. It skips 5 already rated. It rates nothing and never changes a saved result.

0 of 65

What Aegis did Read 65 of 65 objectives. Proposed: 49 Met, 3 Not Met. 9 objectives have no files to read. 4 not read: no readable text. Advisory only: nothing is rated until you accept it.

AC Access Control Needs you 652118 Aegis proposals 5285 No evidence 9 Run AegisAccept safe proposals…
ObjectiveResultAegisEvidence
AC.L2-3.1.1[a] · authorized users are identified;0Not Assessed1MetProposes Met · High confidenceSaved by you 09:49 · Aegis’s textXLSX 1
AC.L2-3.1.1[d] · system access is limited to authorized users;0Not Assessed1MetProposes Met · High confidenceSaved by you 09:49 · Aegis’s textXLSX 1 PDF 1
AC.L2-3.1.5[b] · access to privileged accounts is authorized in accordance with the principle of least privilege;0Not AssessedProposes Met · Moderate confidencePDF 1
AC.L2-3.1.8[b] · the defined means of limiting unsuccessful logon attempts is implemented.0Not Assessed1MetProposes Met · High confidenceSaved by you 09:49 · Aegis’s textXLSX 1
AC.L2-3.1.9[b] · privacy and security notices are displayed.0Not Assessed2Not MetProposes Not Met · High confidenceReviewed and saved by you 09:53PNG 2
AC.L2-3.1.11[b] · a user session is automatically terminated after any of the defined conditions occur.0Not Assessed2Not MetProposes Not Met · High confidenceReviewed and saved by you 09:58PDF 1
AC.L2-3.1.12[d] · remote access sessions are monitored.0Not Assessed2Not MetProposes Not Met · High confidenceReviewed and saved by you 10:04PDF 1
AC.L2-3.1.10[c] · previously visible information is concealed via a pattern-hiding display after the defined period of inactivity.0Not AssessedNo proposal · no files to readNone

8 of 65 shown · 57 more objectives in this family

Accept and save 44?

44 High-confidence proposals on rows nobody has saved. Left for you: 3 with an adverse result; 5 below High confidence. Each is saved as your determination, marked as Aegis’s text.

Accept and save 44Cancel

44 saved as your determinations · Dana Whitfield · 09:49 · each marked as Aegis’s text

A accept X dismiss ⌘↵ save and nextAdverse results are yours, one at a time.

18 still need you: 5 below High confidence, 13 without a proposal.

Draft POA&M items for today’s Not Met resultsAsked on Today

4 Not Met results today. 3 are POA&M-eligible at 1 point each. AC.L2-3.1.12 is a 5-point requirement, so it gets no draft: it has to be Met before close-out.

POA&M items 3 drafts, not saved3 created Set for all 3 Choose an ownerElena Brooks · Harbor PointElena Brooks · Harbor PointSam Okafor · Harbor Point Set a date9 Dec 2026
RequirementWeaknessPlanOwnerPlanned completion
AC.L2-3.1.101 point · eligiblePOAM-HPPM-0007 · OpenWorkstations lock after 60 minutes of inactivity; the policy defines 15 (§4.3).Set the machine inactivity limit to 900 seconds; export the settings again.—Elena Brooks—9 Dec 2026
AC.L2-3.1.91 point · eligiblePOAM-HPPM-0008 · OpenThe logon notice is missing on 2 of 14 servers.Apply the notice policy to both servers; capture their logon screens.—Elena Brooks—9 Dec 2026
AC.L2-3.1.111 point · eligiblePOAM-HPPM-0009 · OpenVPN sessions have no idle timeout; the policy defines 30 minutes (§4.5).Set the VPN idle timeout to 30 minutes; export the configuration.—Elena Brooks—9 Dec 2026
AC.L2-3.1.125 pointsNot POA&M-eligible. No draft: it has to be Met before close-out.
Create 3 POA&M itemsDismissWeakness and plan drafted by Aegis. Nothing is created until you create it.
Created by DWDana Whitfield · 9 Nov 2026 · 10:09Weakness and plan drafted by Aegis

Today in Access Control: 48 objectives rated under your name (44 Met, 4 Not Met) and 3 POA&M items created. 18 objectives still need you.

Ahead 2 days·Evidence due Thu 19 Nov·Next: 18 objectives in Access Control
Ask AegisOpen AC.L2-3.1.10 with its objectives and evidenceShow the settings export for [b]Now run Aegis on the rest of Access ControlDraft POA&M items for today’s Not Met resultsNext: 18 objectives in Access Control (Tab)
How much is left to rate?How many objectives are Not Met?Open AC.L2-3.1.10

Aegis suggests; you decide. Check its sources.

Demonstration · fictional data

The assessor types what they need: a control, with its objectives and evidence.

One control, in depth. Ask for a control and its objectives, results and evidence arrive in the conversation. The file opens beside the objective with the value Aegis cites marked, and what was defined sits beside what is configured.

Then the whole family. Run Aegis reads every unrated objective against its mapped evidence and proposes. It rates nothing, skips what a person already rated, and offers no proposal where there is no evidence to read.

Safe in bulk, careful where it counts. Accept safe proposals saves only High-confidence proposals with no adverse result, on rows nobody has saved, in one press, under your name. Adverse and less certain proposals are left for you, counted by reason.

POA&M items, together. Aegis drafts one per eligible requirement and says which are not eligible. You set the owner and the date and create them; the record shows who and when.

Pathfinder: scope it, then collect it

The two slowest parts of any assessment are defining the boundary and answering evidence requests. Pathfinder is Aegis's scoping and collection capability. Vector proposes the scope from an interview and your documents; Beacon turns the confirmed scope into collection tasks. You keep, reject, capture or skip.

SystemProperty Management CloudScope draft v1
You are ClientEB
Scope · VectorCollect · Beacon
Vector interview
Which systems store or process FCI for the DoD contract?
You: The PMC application servers, the finance file share, and the backups our MSP runs.
Do any contractors or providers reach those systems?
You: Harbor Cloud Services manages backups and the firewall.

Boundary · drawn as you answer

Property Management Cloud · boundary PMC-APP-01app server PMC-APP-02app server FS-FIN-02finance file share Harbor CloudMSP · backups, firewallinherited WIFI-GUESTout of scope · R-07 BLDG2unknown v1 confirmed · sha256 7c1d…e9a2

Proposed scope · each with its source

PMC-APP-01/02Application servers · in scopeanswer + asset export rows 14–15Kept
FS-FIN-02Finance file share · in scopeanswer · rule R-03Kept
HCS-BACKUPMSP backup service · inheritedCRM import §4 · provider evidence refKept
WIFI-GUESTGuest Wi-Fi · out of scoperule R-07 · no path to FCIKept
BLDG2-PRINTBuilding 2 printers · unknownasset export row 31 · no answer yetAsk IT
Scope v1 confirmed14 items · 1 unknown · sha256 7c1d…e9a2bound to ASSESS-HPPM-2026-0001
Beacon collection tasks from the confirmed scope
11 tasks across 9 objectives. Each says what to capture and where. You press Capture or Skip.
AC.L2-3.1.1PMC-APP-01 · local administrators group membership · screenshot or exportcaptured 10:42 · named · routed · EVD-NWA-0012Captured
IA.L2-3.5.3PMC-APP-01 · MFA policy for privileged accounts · policy exportwaiting for your pressCapture
SC.L2-3.13.1Boundary diagram · inherited from Harbor Cloud Servicesprovider evidence reference · CRM §4Skip · inherited
Ready to send · 1 of 11Aegis checks each capture against its objective after you send.
Staged example · synthetic data

Scope, with Vector. A guided interview and the documents you already have (an SSP, an asset export, a vulnerability scan, your provider's responsibility matrix) become a proposed boundary. Every item carries its source and the rule that placed it. A person with full permission keeps or rejects each one.

Frozen and bound. The confirmed scope is hashed and bound to the assessment that uses it. A later change opens a new version with a "what changed since v1" diff; a significant change reopens only what moved.

Collect, with Beacon. From the confirmed scope, Beacon lays out what each control's request needs, item by item, with capture help. Signed in as an administrator of your own environment, you press Capture or Skip. What you capture is named, routed and given an evidence ID before you send.

Facts once, every framework. CMMC Level 2 first, HIPAA next. Cloud and managed-service inheritance is first class: inherited, shared or yours, with the provider's evidence reference.

Aegis works for the assessor. You make the call.

Aegis is the assessor's companion inside AegisForge. It reads the evidence on your assessment, finds the passage, drafts the finding and proposes the rating, inside your permissions. The parts below show what the platform does; the band after them shows how the agent is kept inside the lines.

Aegis proposes. You decide with one press. The record shows both.

In the product today · six parts, each shown working

  • Your evidence stays where you keep it

    Link a SharePoint folder, read only. AegisForge reads a file where it lives and records its fingerprint and version each time. Nothing is copied unless you send it.

    Or send files in, or record a file by its hash alone. Whichever home you choose, Aegis works from the passages it needs and the counts, never the files, and marked content is refused at the door.

  • Drop a ZIP, review the matches, submit

    Upload supported files in a ZIP or select them together. Review the proposed matches to open evidence requests, change any match, then submit.

    Every file is screened and fingerprinted on arrival: PDF, Word, PowerPoint, Excel, images, text, CSV, JSON, XML, email and HTML. A match is a proposal until you submit it, and the record keeps each file's name, size, hash and arrival time.

  • Pick the framework at setup

    CMMC Level 2 / NIST SP 800-171 Rev. 2, NIST SP 800-53 Rev. 5, and FedRAMP Rev. 5 Low, Moderate and High, chosen when the assessment is created.

    When an assessment is created from a published catalog, its selected catalog version and baseline are pinned to that assessment, so every role rates the same version of the same controls.

  • Reports in your organization's name

    Draft and export SSP content, assessment reports and POA&M records from the assessment workflow. Supported report PDF and Word exports use configured organization branding and defined report outlines.

    People review and accept drafted content before release. The export is built from the record, so the figures in it are the figures on the record at the time it was generated.

  • Aegis+

    POA&Ms tracked to close-out

    Each weakness gets a plan, an owner, a date and the evidence that closes it. Aegis watches the recorded dates and flags what is due. Closing is your press.

    Milestones, risk and the remediation evidence live on the item, between assessments as well. Reminders come only from recorded dates, never estimates, and the close-out is recorded with who and when.

  • Scan exports in, findings you confirm

    Import supported Nessus or Tenable scan exports, review the results and confirm candidate findings.

    The import is previewed before anything is created, and a confirmed finding carries the scan as its source. Every number on the dashboard is computed from the records, with the time it was read.

Hover, tap or focus a card for the detail. Every frame is a staged example with synthetic data.

How we run the AI

The decision is yours. Every time.

Aegis reads, finds, drafts and proposes. It cannot rate, accept, approve, submit or send. Each of those is a press by a named person, and the record keeps the press, the proposal it answered and the evidence both pointed to.

AegisForge is built to protect the client's record and to keep the agent inside the lines. The frame beside this is one rating, as the back end sees it.

Aegis
Proposed Met for PS.L2-3.9.1[a]
source EVD-NWA-0006 p. 4 · SHA-256 3f2a…9c · methods examine, interview
16:04:02
Check
Permission passed
role assessor · tenant NWA · ASSESS-HPPM-2026-0001
16:04:02
Check
Data label FCI · no marked content
marked controlled content would have stopped here
16:04:02
You
Rate MetRated Met — M. Reyes · one press
nothing was rated until this press
16:04:12
Record
Audit #0419 written · 9C1E… chained to #0418 · 7A40…
who, what, when, which proposal, which evidence
16:04:12
Receipt
Model call · local engine · 1 passage · 0 files · 412 tokens
engine, model, what it read, what it proposed
16:04:12
Staged example · synthetic data

One rating, as the record sees it.

  • You decide

    Every rating, acceptance, approval and submission is a human press, recorded with who and when. Nothing fires on its own.

  • Permission on every call

    Role, tenant and assessment are checked on each read. Aegis has no database access and no free-form queries, and an instruction found inside a document is text, never a command.

  • Every file fingerprinted

    SHA-256 when a file arrives and when it is read for the record, with its version. A changed file is a new fact, and a proposal that cited the old one is withdrawn.

  • Tagged at the door

    Every item carries a data label. Marked controlled content is refused before any model sees it. A hosted model receives client content only on an approved path, never silently.

  • Counts by code

    Every number on screen is computed from the records, with its numerator, denominator, scope and the time it was read. The model names a view. It never does the arithmetic.

  • A receipt for every call

    Which engine, which model, what it read, what it proposed, what it cost. Audit entries are hash-chained, so a change to the past shows.

  • Honest about gaps

    Missing or unreadable evidence is reported as missing, never turned into a rating. There is no confidence percentage and no score. A prior opinion is a claim to check, never a source.

  • Replaceable models

    No model and no vendor is written into the code. A model is tested against a blind set before it is activated, and it can be swapped without touching the record.

Aegis can

  • Read the evidence and find the passage that answers an objective
  • Propose a rating, with its sources and the methods it suggests
  • Draft the finding, the summary and the client's response
  • Build the sheet, chart or card you asked for, from the live record
  • Flag what changed since you last looked
  • Remind you from recorded dates, never estimate one

Only you can

  • Rate a control
  • Accept evidence
  • Approve a package, or make the determination
  • Submit, send or assign
  • Set or change a data label
  • Close a POA&M

Aegis never speaks for the reviewer or the approver, and never keeps a proposal after the evidence behind it changed.

Plans

Aegis is on for everyone during an assessment. After close-out, the record stays; what you add is how much Aegis keeps doing between assessments.

  • Assessment

    For the assessment, from invitation to close-out. A firm and its client, every role.

    • The recordLive
    • AegisOn for every role, start to close-out
    • ConversationsEach role's own lane
    • PathfinderGuided scoping with fixed rules
    • POA&M follow-upsUntil close-out
    • Continuous monitoring—
    Request a demo
  • Basic

    After close-out. The client keeps the record and its read-only history.

    • The recordKept, read-only history
    • AegisClosed at close-out
    • ConversationsReadable, not active
    • Pathfinder—
    • POA&M follow-upsManual
    • Continuous monitoring—
    Request a demo
  • Aegis+

    Always on, between assessments as well. For the client who wants the agent working the record all year.

    • The recordLive
    • AegisOn, all year
    • ConversationsEach role's own lane
    • PathfinderVector proposals and Beacon recipes
    • POA&M follow-upsTracked to closeout
    • Continuous monitoringReadiness kept current
    Request a demo
  • Talk to us

    Self-assessment, bring your own assessor, enterprise. Firms with their own teams and organizations assessing themselves.

    • The recordLive
    • AegisOn
    • ConversationsEach role's own lane
    • PathfinderVector proposals and Beacon recipes
    • POA&M follow-upsTracked to closeout
    • Continuous monitoringReadiness kept current
    Talk to us

Pricing and seats are set with you in the demo.

Watch one assessment, start to record

Under a minute, six chapters: the client drops a ZIP, Aegis reads the evidence, the assessor works through the controls, the reviewer checks the work, the approval lands on the record, and the assessment is delivered. A staged example with synthetic data, scripted from the product as it will ship.

AssessmentASSESS-HPPM-2026-0001Evidence
You are ClientEB
REQ-HPPM-2026-0001 · 11 open requests
Evidence & documents
ZIP
harbor-point-evidence-nov.zip
38 files · 212 MB
Received
✓Malware scan 38 of 38 clear
HeldMarking check 1 file held for the Lead · 37 clear
✓CUI question No · answered by Elena Brooks

Aegis · proposed matches

Dropped asProposed nameProposed match
scan_0427.pdfPersonnel screening procedure v3.2PS.L2-3.9.1
IMG_2231.pngMFA policy, privileged accountsIA.L2-3.5.3
export (3).xlsxLocal administrators, PMC-APP-01AC.L2-3.1.1
diagram-final-v2.pdfBoundary diagram r2SC.L2-3.13.1
… 33 more · 37 proposed · reviewed by Elena Brooks
Submitted37 files · evidence IDs issued · bound to r4 · hashed
PS.L2-3.9.1[a] · Personnel security
Individuals are screened prior to authorizing access to organizational systems containing CUI
Personnel Screening Procedure, v3.2EVD-NWA-0006 · p. 4

4.2 Prior to authorizing access to any organizational system, Human Resources completes the background screening defined in Appendix A and records the result in the personnel file. Access is not provisioned until the screening result is recorded. Rescreening occurs every five years or on change of role.

Page 4 of 9
Aegis advisory
Reading EVD-NWA-0006, 9 pages
Found in file
“Access is not provisioned until the screening result is recorded.”
p. 4 · sha256 9f3a…c21e
ProposedMetMethodsExamine, InterviewBasisProcedure states screening precedes provisioning
AcceptDismiss
Controls · assigned to you
Personnel security · PS
PS.L2-3.9.1[a]Not ratedMet
PS.L2-3.9.1[b]Not ratedMet
PS.L2-3.9.2[a]Not ratedNot Met
PS.L2-3.9.2[b]Not rated

PS.L2-3.9.1[a] · rating

MethodsExamine ✓ · Interview ✓ RationaleProcedure §4.2 requires screening before provisioning; confirmed in interview with the HR lead. ArtifactEVD-NWA-0006 · p. 4 ResultMet · saved 16:04:12
41 of 110 rated7 Not Met1 new findingread 16:11
Revision 3 · frozen 6 Nov 18:30 · sha256 3b7e…91d0
Independent review
Aegis pre-check never answers for you
✓320 of 320 objectives rated with method, rationale and artifact
✓6 Not Met · 6 findings · 6 POA&Ms with steps and a clock
Check2 rationales cite evidence accepted in r2 · confirm the r3 copy
SampledWhyDecision
PS.L2-3.9.1[a]Rationale cites r2 evidenceConcur · note added
IA.L2-3.5.3[a]Not Met 6 Nov · re-examined after enrollment · Met 17:50Concur
AC.L2-3.1.1[a]RandomConcur
Concurred · sent to approver
Revision 3 · reviewer concurred 7 Nov · sha256 3b7e…91d0
Harbor Point Property Management · CMMC Level 2
104
score of 110 · minimum 88
104
Met
6
Not Met · all 1-point · POA&M-eligible
0
reviewer flags open
ApprovedRina Kaur · 7 Nov 16:40 · Conditional Level 2 recommended · POA&M close-out within 180 days

The record

Nov 6 16:04Dana Whitfield rated PS.L2-3.9.1[a] Met · EVD-NWA-0006 · 9f3a…c21e
Nov 6 17:50Dana Whitfield re-examined IA.L2-3.5.3[a] after MFA enrollment · Met
Nov 6 18:30Priya Raman froze revision 3 · 3b7e…91d0
Nov 7 09:31Marcus Lindqvist concurred · 3 sampled · 1 note
Nov 7 16:40Rina Kaur approved · Conditional Level 2 recommended · 6 one-point items on the POA&M
Nov 7 17:05Released to client: assessment report, findings, POA&M

Assessment delivered

Harbor Point Property Management · CMMC Level 2 · released by Northwind Assurance · 7 Nov 17:05

PDFAssessment reportPDFFindingsXLSXPOA&MConditional Level 2 recommended
104
score of 110
320
objectives rated
37
evidence files, each fingerprinted
6
POA&M items · close-out within 180 days
The assessment is the record. Aegis reads it with you.
Staged example · synthetic data
0:00 / 0:52

Press play. Captions appear here.

Request a demo

See your assessment workflow come together.

Explore how your team can review evidence, work through controls, and turn findings into clear next steps, with Aegis assisting throughout.

  • A working session, not a slide deck. We work your kind of assessment, with the roles you care about.
  • Bring a real question. A framework, an assessment challenge you would like to work through, an evidence set that never fits. We will work it in the demo.
  • A person replies. Not a sequence.

Tell us about your assessments

* required

Enter your name.
Enter a work email address, like [email protected].
Enter your organization.
Choose the side you are on.
Frameworks (optional)
We reply from a person, not a sequence.

The assessment is the record. Aegis reads it with you.