Products
Built on senior-assessor analysis of all 320 NIST SP 800-171A (Rev 2) assessment objectives, with NIST SP 800-171 Rev 3 beside it. The full Concura Reference Library is included. Hover or tap a card for full details.
Where CMMC stands right now: third-party (C3PAO) assessments are suspended during DoD's 60-day review — but Level 2 self-assessments, SPRS submissions, and annual affirmations remain required, and a defensible self-assessment today is the same evidence base a C3PAO reviews if they return.
Which one do you need? If your environment already exists — whatever it looks like — and you need to assess and document it, subscribe to Level 2 Self-Assessment. It works for any architecture. If you want a CUI enclave built and run for you in Microsoft GCC / GCC High, talk to us about Concura Managed Enclave.
Concura Level 2 Self-Assessment
Conduct and document a defensible NIST SP 800-171 self-assessment — Rev 2 or Rev 3, chosen in your Company Profile — with determinations, SPRS score (Rev 2), POA&M, the annual affirmation that follows, and Lead Assessor guidance beside every objective.
- All 320 NIST 800-171A objectives (Rev 2) with senior-assessor analysis + verbatim NIST/CMMC source text
- NIST SP 800-171 Rev 3 as well: every requirement with its 800-171A Rev 3 determination statements and the DoD-defined parameter values, recorded as met / not met — DoD has published no Rev 3 scoring methodology, so Concura does not invent one
- MET / NOT MET determinations with basis and pinned evidence, objective by objective
- SPRS score computed under the DoD Assessment Methodology, with your scope statement
- POA&M and operational plan of action tracking — overdue items stay flagged until closed
- Annual affirmation — your Affirming Official must attest in SPRS at the time of assessment and every year thereafter. Concura keeps the affirmation clock, the Affirming Official of record, and the evidence behind each year's attestation
- Continuous monitoring between assessments — control drift, expiring evidence, and lapsed periodic reviews surface as they happen
- Three-year reassessment clock tracked alongside the annual affirmations
- Upload your own SSP and artifacts; AI assessor interview (voice or text) drafts your narratives
- Exportable SPRS entry package, scored self-assessment report, POA&M, artifact index
- Delta Corp example SSP, Knowledge Base, completion tracker, community
Billed annually as Consultant Works, LLC. Use the same email at checkout that you use to sign in.
Concura Managed Enclave
We build your CMMC Level 2 CUI enclave in your own Microsoft government cloud, then manage and monitor it for you. Now talking with pilot customers.
- Your enclave is built with you, from a tested reference design, in your own Microsoft GCC / GCC High tenant and Azure Government subscription — you own it
- Managed from day one: our team operates the enclave with access you grant, time-boxed and audited
- Configuration Drift and Security Monitoring: we continuously monitor your Microsoft environment, compare it with approved baselines, detect and report drift — and, when applicable, align and explain each change against potentially affected CMMC requirements
- Full Concura Reference Library and Level 2 Self-Assessment tooling included
- Microsoft licensing and Azure consumption are not included — Microsoft bills you directly
In development. Pricing is quoted for each pilot based on number of users.
Concura Consulting
Direct senior-assessor (CCA) time when you want a human in the loop.
- Control-interpretation questions
- SSP review for one or more control families
- Self-assessment determination review before you submit your SPRS score
- Scoping decisions (CRMA vs CUI Asset, enclave boundary)
- Mock-assessment Q&A and pre-assessment readiness checks
- Prepaid via Stripe; buy any quantity; unused hours don't expire
Available to active Concura subscribers. Buy from your account once your subscription is active.
Learn more before you subscribe
The prospectus is a four-page overview of the value-vs-consulting math, product pricing, the senior-assessor backing, and how customers actually use Concura. The live demo is a 30-minute Zoom session with a senior assessor — not a sales pitch, a working session for you to decide whether Concura fits your situation.
What's included in the Delta Corp example SSP
Every Concura subscriber gets the Delta Corp example SSP — a complete, fictional-OSC system security plan that demonstrates a defensible CMMC L2 implementation in Microsoft GCC High with AVD. It covers all 14 NIST 800-171 families, all 110 controls, all 320 sub-objectives, with full implementation narratives, GCC-H inheritance citations, and per-objective supporting artifacts. Use it as a tailoring template — and as the starting content your AI-assisted authoring builds from.
Billing
Level 2 Self-Assessment is billed annually in advance at $7,000 / year. Concura Managed Enclave is quoted per pilot. There is no separate trial — every subscriber has their full product from day one. Annual subscriptions are non-refundable once active; you may cancel auto-renewal at any time, and cancellation takes effect at the end of your current term.
Frequently asked
Which product do I need?
If your environment already exists and you need to assess and document it — determinations, SPRS score, POA&M, SSP — you want Level 2 Self-Assessment. If you want a CUI enclave in Microsoft GCC / GCC High built and managed for you, talk to us about Concura Managed Enclave.
Third-party assessments are paused. Why do I still need this?
The pause suspended the C3PAO requirement, not the compliance obligation. NIST SP 800-171 Rev 2 self-assessments and SPRS submissions remain required under DFARS 252.204-7019/7020, and self-attested scores carry False Claims Act exposure. A documented, evidence-backed self-assessment is what defensibility looks like right now — and it's exactly what a C3PAO would review if the requirement returns.
What is the annual affirmation requirement?
A CMMC Level 2 self-assessment is not a one-time filing. Under 32 CFR 170.16 and 170.22, a senior official of your company — the Affirming Official — must affirm in SPRS at the time of the self-assessment and annually thereafter, and again after any POA&M closeout. What the Affirming Official attests is not "we were compliant on assessment day" but that the organization "has implemented and will maintain implementation of all applicable CMMC security requirements." The self-assessment itself is redone every three years; the affirmation is every year in between. DFARS 252.204-7021 carries the same obligation into your contracts, and a false affirmation is the exact fact pattern False Claims Act cases are built on.
None of this was affected by the pause on third-party assessments — the Department suspended the C3PAO verification mechanism, not the self-assessment, the affirmation, or the enforcement behind them.
Where is my SSP data stored?
Your SSP narratives, voice transcripts, company profile, build evidence, determinations, and uploaded artifacts live in Microsoft Azure Government — GCC High, the cloud environment used for Department of Defense Controlled Unclassified Information and Impact Level 5 data. Your data never transits Concura's public-content infrastructure.
Can I print or download anything from Concura?
Concura's reference content (the 320 Rev 2 control pages, the Rev 3 requirement pages and the Delta Corp example SSP) is for online viewing within your subscription — printing and bulk extraction are disabled to protect the senior-assessor expertise that makes it valuable. You can generate and download your own personalized SSP .docx, your scored self-assessment report, your POA&M, and your assessment package — that's the whole point. Code snippets (PowerShell commands, Microsoft Graph queries, etc.) in the implementation guidance remain copyable — those are operational helpers, not extractable narrative content.
Do I need a Microsoft account to sign in?
No. Concura sign-in works with any email address — Google, Microsoft, or any work email. Choose "continue with Google," or enter your email and we'll send a one-time code. No new password to remember, no Microsoft account required.
What happens if I cancel my subscription?
Your data is preserved for 30 days, then moved to cold storage for 12 months. You can request export at any point during that window. After 12 months, data is purged. We'll always notify you before purge.
Can I file the SSP and self-assessment as my own documents?
Yes. Your SSP narratives and your determinations, once authored, are your work product. Concura provides the structure, the assessor-perspective starting examples, and the AI-assisted tools — but the resulting documents belong to you, including the right to file your score in SPRS and present your SSP to assessors, customers, and authorizing officials as your own.
Does the tool decide my score for me?
No. You make every determination; the tool computes what the DoD Assessment Methodology yields from your determinations, and shows you the Lead Assessor perspective on what each determination has to survive. AI assistance only ever suggests — a human confirms everything, and you sign your own SPRS entry.
Will Concura work for an OSC that doesn't use VDI?
For Level 2 Self-Assessment — yes, whatever your architecture. The 320 objectives, the assessor guidance, the determinations, the SPRS scoring, the POA&M and the SSP tooling do not assume any particular environment. Customers handling CUI on endpoints, across distributed operations, or on-premises use it exactly as VDI customers do. Concura's worked example (Delta Corp) happens to run VDI in GCC High, but it is an example to tailor, not a requirement.
For Concura Managed Enclave — it is a VDI CUI enclave in Microsoft GCC / GCC High, built and run by us. If that is not what you want, Level 2 Self-Assessment on its own covers any architecture.
Who's behind Concura?
See the About page. Concura is built by a senior CMMC assessor with deep field experience. The reference content is authored or reviewed by working assessors — not generated by a generic AI. The voice cleanup uses AI, but the underlying control-by-control assessor expertise is human-validated.