“40 controls pass” becomes “40 of 110, and here are the 23 nobody can assess at all.”
Most tools stop at the first half of that sentence. The engine joins the checks that can actually be evaluated against a Microsoft tenant with each framework's full control catalog. The gap between the two is the part of your program no automation can see. It stays on your assessment and POA&M as human-verified requirements, so it never drops silently out of the score.
How much of each framework automation can reach
| Framework | Controls | Reachable by automated checks |
|---|---|---|
| CMMC 2.0 Level 2 | 110 | 87 (79.1%) |
| NIST SP 800-171 Rev. 2 | 110 | 85 (77.3%) |
| NIST SP 800-53 Rev. 5 | 970 | 186 (19.2%) |
Figures come from the engine's current mapping pack. FedRAMP baselines are mapped and their labels are being validated; the NIST SP 800-171 Rev. 3 catalog is in progress.
The scoring rules it follows
- Coverage appears beside every score. The score is computed only over controls that were actually assessed, so it is never shown on its own. A 100% score across 12% of a catalog does not describe a compliant system.
- A control without evidence does not pass. If no check reaches it, it is marked “not assessed.”
- Every run is kept. Nothing is overwritten, so when a control regresses, the run history shows the regression.
- The POA&M is generated from the results. Every unmet control becomes an item with its weakness, priority, and effort estimate, so no row gets forgotten.
- SPRS is scored the DoD way. The summary score follows the Assessment Methodology exactly. It starts at 110 and subtracts the weight of each unmet requirement, treats the SSP as a prerequisite, and gives partial credit only where the methodology allows it.
The engine is in pre-release. It runs against synthetic tenants while it is hardened; client tenants are connected once onboarding opens, and results then appear in your client portal. Its SPRS figure is a working number: the score you submit still comes from a documented assessment and the organizational review DFARS 252.204-7019 requires.
Built on public datasets: community-maintained check-to-control mappings (CheckID) and Microsoft's Azure Policy regulatory-compliance catalogs, joined and pinned by version.
Questions we get about it
Is this live monitoring of our tenant today?
Not yet. The engine is in pre-release and runs against synthetic tenants while it is hardened. Client tenants are connected once onboarding opens; until then, our managed-compliance team validates controls on a schedule.
Why not just show one compliance percentage?
Because a percentage computed over only the controls a tool can see overstates your position. We always show coverage beside the score so you can see how much of the framework the number actually describes.
Can the SPRS number from monitoring go straight into SPRS?
No. It is a working figure that shows direction. The score you submit comes from a documented assessment and the organizational review DFARS 252.204-7019 requires.
Be first when onboarding opens.
Tell us your cloud (commercial, GCC, or GCC High) and which frameworks you answer to, and we will bring you in as tenants are connected. Or email rj@indirectit.com directly.